What Recordist can never see

We don’t store your data. We can’t. Your recordings, transcripts and notes are kept on your device, never on ours. Recordist has no server that could hold them. We keep nothing about your meetings. We keep only the email you give us on a receipt, in the app when it asks where to send your key, or on one of our forms, and what each form says it stores.

What “can’t” means

There is no Recordist account and no login. If you ask for your Pro key, we hold the address you gave until a week after the last of three short notes, and then only a one-way code of it. A Pro subscription that renews by itself registers only a one-way code of a random secret (below).
The app has no analytics, tracking or crash reporting. It sends no usage data beyond four anonymous marks, each sent once with no identifier: the first launch, and from version 1.0.7 your first call of a minute or more recorded, the Pro trial starting and the License screen opened. The three first-step marks have their own switch, Settings → General → Count first steps anonymously, and none is sent while update checks are off. Each is listed in the Privacy Ledger.
Audio is captured to WAV files on your disk. Transcription runs on your machine with Whisper. Notes run on your machine with the built-in engine unless you choose otherwise.
Support, including the people who build Recordist, cannot look up your meetings, because they are not anywhere we can reach. If you want us to see a transcript, you have to send it.

The short list of what can leave

Only these, each explained on the Trust Center:

Cloud notes with your own key (optional): the transcript text of that meeting, its title and attendee names, the date of the meeting and your template, sent directly to the provider you chose. Logged in the Privacy Ledger.
Your own Ollama on another machine (optional): if you choose an Ollama you already run and set its address to another machine, the same meeting content goes to that machine to write the notes. The Privacy Ledger marks those requests Local network or Internet.
Model downloads: the speech models setup downloads and any you pick later, the 1 MB voice-activity model, and once the built-in notes engine and its model. A file is fetched; nothing about you is sent.
Calendar feeds you add (optional): a request for the feed address you entered, every five minutes while the app runs, except during a recording.
Update check: a request for one fixed file, at launch and every six hours. It carries no identifier and nothing about you. Off switch under Settings → General → Check for updates automatically.
Licence check (only while a licence key is stored): with each update check, a request to license.recordist.app. It carries no key, licence id or account. Turning update checks off turns it off too.
Automatic renewal (from version 1.0.5, only with a Pro subscription key, and only while update checks are on): so that each renewed key arrives without pasting, the app sends license.recordist.app the key once, with a one-way code of a random secret it keeps in your keychain, and then, in the last days of each paid period, only the key’s licence id and that secret. Neither request carries anything about your meetings. The privacy policy says what is kept and for how long.
Pro after you buy from inside the app (from version 1.0.9, only after you open Pro checkout from the app): so that Pro switches on without a paste, the app asks license.recordist.app for the key you bought, sending only a random code it made for that checkout, until the key arrives or 24 hours pass. Logged in the Privacy Ledger.
Your email for the Pro key (from version 1.0.10): only if you give it, when Recordist first opens or after the update. The app sends recordist.app the address, a random code for this install, the platform, the app’s version, your time zone and which words you saw, and tries again while offline for up to 7 days. Listed in the Privacy Ledger. If you answer How did you hear about Recordist? there, that one word, the platform and the version go on their own, to be added to a total. The privacy policy says what is kept and for how long.
Update download: a download request to our release host, by itself in the background from version 1.0.9 while Settings → General → Install updates automatically is on (the default), otherwise when you choose to install an update. Nothing about you is sent, and the update is installed only if its signature matches the key built into the app.
Your AI assistants: whatever they ask for, through a connection on your own machine; where they send it is up to the assistant you connected.
Your organisation’s archive (only on a Mac your organisation manages, and only when it turns it on): after each meeting, that meeting’s record, with the audio as recorded, goes to your organisation’s own storage. We never receive it. Logged in the Privacy Ledger.

How to check rather than trust

Open the Privacy Ledger in the app. It lists the app’s outbound requests with the host, the bytes and the reason, since the day you installed, apart from a few kinds listed in The Privacy Ledger, explained, none of which carries meeting content. On the default setup it shows the downloads, the update checks and the app’s requests to the notes engine on your own machine, and nothing about your meetings. You can also watch the network with any monitor you like; the app never opens a port that is reachable from outside your machine.