What leaves your device
Last updated 8 September 2026.
This is the long form of the privacy centre inside the app. Everything on this page is checkable with a browser network panel rather than taken on trust — the application’s own test suite asserts it on every build, and fails the build if a request appears that is not listed here.
Every host the application can contact
| Host | When | What is in the request |
|---|---|---|
huggingface.co and its CDN |
The first time you transcribe with a given model, and never again | Nothing of yours. It is a download — the model weights come to you |
| The site itself | Loading the page, and ONNX Runtime’s WebAssembly binary | Nothing of yours |
auth.opennotetaker.app |
When you open the Account page, and while signed in | Your sign-in method and your credit balance. No transcripts, ever |
gateway.opennotetaker.app |
Only when you press a button that shows a price | The text that button names, and nothing else |
There is no analytics script, no tag manager, no error reporter and no font CDN, on this page or in the application. The fonts are served from this origin, and so is ONNX Runtime’s binary — specifically so that it is not a second, silent third party. You can confirm all of that in view-source.
The meeting detector extension contacts nothing at all
It has no network code in it. It reads the URL of tabs on four meeting sites,
draws a prompt, and hands a tab to the application. It does not read page
content, never sees audio, and has no server to report to. Its entire source
is four small files, and grep -r fetch over them comes back
empty.
Audio never goes anywhere
Not as an upload, not as a sample, not to improve a model. The three paid routes take text — the transcript you already have and can read on screen.
That is a property of the wire format rather than a policy that could be revised. The request bodies have no field for audio, the application shows you the exact body before sending it, and the backend’s test suite includes a case that smuggles base64 audio into an extra field and asserts it never reaches the vendor.
What is stored, and where
In your browser’s own storage, on the device you recorded on. Nothing syncs. There is no server-side copy to subpoena, breach or lose.
- Transcripts, titles and speaker names — kept until you delete them.
- The audio — discarded when you close a note, unless you turn on “keep the audio”, which is off by default.
- Your settings — interface language, model choice, and whether to keep audio.
Clearing site data for this origin removes all of it, immediately and permanently. We cannot recover it, because we never had it.
If you make an account
An account is needed for exactly three things: AI-written minutes, questions across your meetings, and translating a finished transcript. It holds a sign-in method and a credit balance. It does not hold recordings, transcripts or titles.
Signing in with Google visibly passes through our account provider’s own domain on the way back, and Google’s consent screen names it. That is how the OAuth hop works and we would rather say so here than have you find it in the address bar.
Consent to record
Whether you may record a meeting depends on where everyone in it is, and this application cannot answer that for you. It does not try. Every recording opens on a consent screen with words you can read out, and there is no way to skip it or ask it to stop appearing.
Contact
Open an issue — the source is public, and a privacy claim you can read the code for is worth more than one you can only email about.