Legal

Privacy Policy

Effective 9 November 2026.

Une version française de ce document est en préparation.

We don't store your meetings. The app has no way to send them to us. Your recordings, transcripts and notes are kept on your device, never on ours; Recordist has no server that could hold them. We keep nothing about your meetings: only the email you give us on a receipt, in the app when it asks where to send your key, or on one of our forms, and what each form on this site says it stores. This policy explains what little we do process, why, and what your rights are.

Who we are

Recordist is made by Havihi Digital Inc., a corporation under the Canada Business Corporations Act, of 2 McMillan Place, Welland, Ontario L3B 0L5, Canada ("we", "us"). Pro is sold through Link, a service of Stripe, as section 3 explains. We are the controller of the personal data described in sections 2 to 4. Our Privacy Officer is accountable for how we handle personal information and answers questions and complaints about it. Write to the Privacy Officer at privacy@recordist.app, or by post to the Privacy Officer at the address above. Legal notices go to legal@recordist.app.

Summary

The desktop app records, transcribes and summarises on your computer. Audio, transcripts and notes are stored there and are never sent to us.
The optional browser extension keeps its live transcript of a call, with the names the captions show, in your browser on your machine until you delete it. It never sends it to us (section 1.4).
Apart from one first-launch mark from version 1.0.3 and three first-step marks from version 1.0.7, each sent once with no identifier so we can count new installs and see where people get stuck (section 1.2), the app has no analytics, tracking or crash reporting. This website counts page views without cookies, keeping the page, the referring site, the country, whether the device is a phone, the time and, if you followed one of our own links, which kind of link it was. It keeps no IP address or identifier.
We send no newsletters, and nothing goes to an address after the three notes in section 3.2 unless you sign up for it. You get only the emails you ask for: replies to you, the emails a form on this site says it sends (sections 2.1 and 3.1), your Pro key, then three short notes, the last the day after your 14 days end, each with a stop link (section 3.2), news of new versions and security notices once you confirm you want them, and, if you buy a plan, Link's receipt, your licence keys and the billing notices Stripe sends for us.
If you buy a plan, Link, a service of Stripe, takes your payment, and we receive your email address and order details so we can issue a licence key. The licence email is delivered by Resend; Stripe and Resend see the email address on your receipt and nothing about your meetings.
If you choose to use a third-party AI provider with your own key, the meeting's transcript text, title and attendee names go to that provider directly from your computer, under their privacy policy. That is your choice, off by default, and those requests are listed in the app's Privacy Ledger.

1. The desktop app

1.1 Data the app stores on your device

Audio recordings, transcripts, AI notes, action items, markers, speaker names, templates, settings and a search index. All of it lives in a folder under your user account (see Privacy and data). We have no access to this folder. It is "personal data" only in the sense that it is on your device; we are not its controller or processor. The app also keeps a few small records in your operating system's keychain, such as when it was installed, when its trial started and how many AI notes the Free plan has written this month, so that a new data folder does not start a second trial or reset that count. They stay on your computer, and we have no access to them either.

1.2 Network connections the app makes

The app connects to the internet only in these cases, each described in the documentation and each avoidable, by you or, for the archive, by your organisation. Most are listed in the app's Privacy Ledger; the ledger article says which are not yet:

Speech-model downloads from our download host, or from Hugging Face if our host cannot be reached, when you pick a transcription model. The request contains no personal data.
The built-in notes engine and its model, downloaded once after setup while the built-in engine is your notes provider (the default), and a model again if you pick another one: the engine from our download host, or from GitHub if our host cannot be reached, and the model from Ollama's registry. These requests contain no personal data.
Update checks against our release host: a request for one fixed file. It carries no app version, platform or identifier; its user agent names only the updater component and that component's version. Can be disabled in Settings.
One first-launch mark, from version 1.0.3: the first update check after you install the app also asks once for one fixed address on our release host, whose path names only the app's version and the kind of computer (for example a Mac with Apple silicon), so we can count new installs by day, country and version. It carries no identifier, no account and nothing about you or your meetings, only what any web request carries, such as your IP address, which our hosting provider sees in its standard logs (section 6). It is sent once and never again: not after an update, not after a reinstall over your existing data, and not at all while update checks are off. It is listed in the Privacy Ledger.
Three first-step marks, from version 1.0.7, so we can see where Recordist works for people and where they get stuck: your first call of a minute or more recorded in the app, the Pro trial starting, and the License screen opened. Each is sent once, with an update check, to one fixed address on our release host whose path names only the step, the app's version and the kind of computer. Like the first-launch mark, it carries no identifier, no account and nothing about you or your meetings: not a title, a name, a word of a transcript or how long a call was. None is sent while update checks are off, or while Settings → General → Count first steps anonymously is off. Each is listed in the Privacy Ledger.
Your email for the Pro key (from 1.0.10): only if you give it, when Recordist first opens or after the update. The app sends recordist.app the address, a random code for this install, the platform, the app's version, your time zone and which words you saw, and tries again while offline for up to 7 days. Listed in the Privacy Ledger. If you answer How did you hear about Recordist? there, that one word, the platform and the version go on their own, to be added to a total. What happens to it is in section 3.2.
The withdrawn-keys list, while a licence key is stored in the app: with each update check, the app downloads from our licence service the public list of licence keys we have withdrawn, for example after a refund, and compares it with your key on your computer. The request is a plain one that carries no key, licence id, account or other identifier, only what any web request carries, such as your IP address, which our hosting provider sees in order to answer. Turning update checks off turns it off too.
Automatic renewal of a Pro subscription, from version 1.0.5, only while a monthly or yearly Pro key is stored in the app (a key from a team purchase included), and only as part of the update check, so turning update checks off turns it off too. It lets a paid renewal arrive without you pasting a new key. The app makes a random secret once and keeps it in your operating system's keychain; it is made from nothing about you or your machine. When such a key is saved, or at the first update check after you update to version 1.0.5 with one already saved, the app sends our licence service the key with a one-way code of that secret. It sends them again only when the machine has to register again: if the secret is lost, if our licence service no longer knows the machine (at most once a day), or to try again after a request fails (a few hours later) or is refused (a week later). In the last days of each paid period, and for up to a month after it if a payment is late, the app asks about once a day for the renewed key, sending only the key's random licence id and the secret, until the new key arrives. The key carries only what we put in it when we issued it (section 3), so sending it tells us nothing new. For each machine we keep the one-way code, when it registered and when we last heard from it, with the key's licence id, until 90 days after the subscription's last key ends. We never keep the secret itself. Our licence service's logs note each request with the licence id and are kept like our other server logs (section 6). Like any web request, each one also carries your IP address, which our hosting provider sees in order to answer. Each request is listed in the Privacy Ledger before it is sent. With update checks off, the renewal email still brings each new key.
Pro after you buy from inside the app, from version 1.0.9, and only after you open Pro checkout from the app. So that Pro switches on without pasting a key, the app makes a random code for that checkout, made from nothing about you or your machine, and adds a one-way code made from it to the address of the page it opens, never the code itself. Until your key arrives, and for 24 hours at most, the app asks our licence service whether a key was bought with that code, sending only the code: about every 15 seconds for the first 15 minutes, then when the app starts, when you switch back to Recordist and about once an hour. When the key arrives, the app checks it as it would a pasted key, switches Pro on and forgets the code. The code itself goes only to our licence service. Our website and Stripe receive only the one-way code, which cannot collect a key (sections 2 and 3); it is in the address of the page the app opens, so, like any address, it can appear in our host's standard server logs for up to 30 days (section 6), and the page takes it out of the address as soon as it opens. Like any web request, each one also carries your IP address, which our hosting provider sees in order to answer. Each request is listed in the Privacy Ledger.
Update downloads from our release host. From version 1.0.9, while Settings → General → Install updates automatically is on, as it is unless you turn it off, a new version downloads by itself in the background after the update check that finds it, never during a recording, and installs when Recordist is quiet. With it off, a download happens only when you choose to install an update. The request contains no personal data, and each download is listed in the Privacy Ledger.
Calendar feeds you add by address, fetched from wherever you said.
Third-party AI providers (Anthropic, OpenAI or an OpenAI-compatible endpoint) when you enter your own API key. For each meeting whose notes you have written this way, its transcript text, title and attendee names, today's date and your template are sent directly to that provider. When you use Ask, the transcripts of the meetings it reads go to that provider too. The Test button in Settings → AI notes sends one short request with no meeting content. We are not involved in these transfers and they are governed by the provider's terms.
Your own Ollama server on another computer, if you set its address to one: the same meeting content as for a third-party provider goes to that computer, along with status checks and model lists that carry no meeting content.
Your organisation's archive, only on a Mac your organisation manages and only when its settings name its own storage (Amazon S3 or an S3-compatible store): after each meeting, that meeting's record, with the audio as recorded, the transcript, the notes, the notice marks and its record-log entries, goes to that storage. Your organisation turns it on or off; you cannot turn it on yourself. We never receive it, and each upload is listed in the Privacy Ledger before it is sent.

The app never transmits audio to us, or to anyone else except your organisation's own archive, above.

Assistants you connect. If you connect an AI assistant to Recordist, through the open-source gateway, the Claude extension or another program you give a token in Settings → Integrations, the assistant receives what it reads from your meetings, under its provider's terms. The gateway and the extension talk to Recordist on your machine and send nothing to us.

1.3 Recording other people

You decide what to record. A detected meeting or a recording started from the menu bar or the shortcut is recorded only after you confirm it on the record card, unless you turn off "Ask before a manual recording too" in Settings → Record prompt; pressing Record inside the app window is itself the confirmation. Two settings let a recording start without the card, and both are off by default: apps you add to "Record without asking for" in Settings → Detection, and "Allow agents to start recordings" in Settings → Integrations, which lets programs that use the app's local API with its token, such as the MCP gateway, start one. The app records whatever your microphone picks up and whatever plays through your computer's sound output, so it can also record a conversation you are not part of. Before your first recording it asks you to confirm that you are responsible for any consent or notice required where you record. Laws on recording conversations differ between countries and states; some require the consent of all participants. You are responsible for complying with the laws and policies that apply to you. We recommend telling participants when you record. See our plain-English guide, which is not legal advice.

1.4 The browser extension

The Recordist extension for Chrome and Edge is optional. It reads what a meeting page in your browser shows, the meeting's title, its address and the names of the people on the call, and gives them to the Recordist app on the same machine (127.0.0.1) so the record card and the notes carry them. From version 0.3.0 it can also keep a live transcript of a Google Meet or Microsoft Teams call in the browser:

What it keeps. Only after you press Start transcript: the words of the meeting's captions as they appear, the name the captions show beside each line, the time of each line, the meeting's title and site, and when the transcript started and ended. It reads no audio, video or screen. The captions themselves are made by Google or Microsoft, under their terms.
Where. In your browser's storage for the extension, on this machine. It is never sent to us or to anyone else. It goes to the Recordist app on the same machine only when you press Get notes from this call and that app can take a transcript.
For how long. Until you delete it, one transcript or all of them, in the extension's side panel, or until you remove the extension, which removes everything it kept.

The extension has no account, runs no analytics and loads no remote code. Its use of what it reads follows the Chrome Web Store User Data Policy, including the Limited Use requirements, as its page sets out.

2. This website

The site is static. It sets no cookies and loads no analytics script. Our hosting provider, Cloudflare, counts page views for us: for each view we keep the page, the referring site, the country, whether the device is a phone or a desktop, the time and, if you followed one of our own links, which kind of link it was. We store no IP address and no identifier. Automated traffic is marked as such and kept out of our counts, using standard information that comes with every request; the count keeps only that mark. Some of our forms, the links in their emails and the download page count their own steps in the same way, such as a page opened, a download and its version, or a sign-up for news of new versions, never with your address or anything else that could identify you. The Memory Test (recordist.app/memory-test) runs in your browser: your answers stay in the page and in the part of its address after the # sign, which your browser never sends to us, and the result card is drawn in your browser and saved or shared only by you. We count visits to its pages like any other page view, never answers. The call check (recordist.app/check) runs in your browser in the same way: nothing you move, tick or type there is sent to us or kept, and its card is drawn in your browser and saved or shared only by you. We count visits to it like any other page view, never answers. When you open Pro checkout from our site, your browser keeps the plan you chose and the time, so the site can offer to pick up where you left off; it is never sent to us, and it is removed once you have paid, or after 7 days. Not now hides the offer until you close the tab. When the Recordist app opens our pricing page, the page's address carries a one-way code made from the app's random code (section 1.2), never the code itself, so, like any address, it reaches our host and can appear in the standard server logs below; the page takes it out of the address at once and keeps it in that browser tab, until you pay, close the tab or 24 hours pass; when you open checkout, that one-way code goes to Stripe with your order (section 3). The page recordist.app/activate, which the Open in Recordist link in your key email opens, reads your key from the part of its address after the # sign, which your browser never sends to us, and hands it only to the Recordist app on your machine when you press Open in Recordist. Fonts and films are served from recordist.app, so no font or video service is involved. Cloudflare also keeps standard server logs (IP address, user agent, requested URL and time) for security, for up to 30 days (section 6).

2.1 Forms on this site

Early-access requests: until version 1.0 was released, the form at recordist.app/early-access took requests for the download link. It stopped taking requests at 1.0 and stores nothing new: the app downloads free from the download page with no email, so no request is needed. For each request it took, our hosting provider holds your email, which computer you would run Recordist on, when you asked and when you accepted the terms, whether the address was a work, personal or unconfirmed one, how we answered, when download links were sent, which version was downloaded and, if you came from one of our own links, which kind of link it was. Each download link we sent is a short record of its own, with the address it went to, deleted when the link expires. To check that an address could receive mail, we looked up only its domain, never the full address, in the public domain name system and, for a domain we did not know, the public domain registration records. We used the record to email you what you asked for and to note which version you downloaded, and we use it now to run the early-access draw described in the rules; the only emails it can still bring are the ones those rules describe, to the people drawn. We keep the record until the draw is complete, then for up to 12 months in case of a dispute, and we delete it sooner if you ask.
News of new versions: if you ask on the download page to be emailed when a new version is out: your email, when you asked, when we sent the confirmation email and how many times, when you confirmed, a random id that the links in our emails carry instead of your address, and, if you came from one of our own links, which kind of link it was. We check the address's domain in the same public directories as the early-access form did, to see that it can receive mail; only the domain is looked up, never the full address. We send one email to confirm. Once you confirm, we email you only when a new version is released, with its release notes, or when there is a security notice about the app; never an offer. If you don't confirm within seven days, the request is deleted. You can also ask with the separate box under a key on the page our confirmation link opens (section 3.1): we keep the same record, with the programme and the version of the box's words you agreed to, and send no email to confirm, because you have just confirmed the address. The unsubscribe link in every one of these emails, and your mail app's unsubscribe button, delete the address at once.
Ideas: when you check in, suggest an idea or vote for one at recordist.app/ideas, we send one email to confirm the address, and nothing is done until you press Confirm on the page its link opens. For an idea we keep its title, its description, the first name you chose to show, if any, the day you confirmed and, if you came from one of our own links, which kind of link it was. A person at Recordist reads every idea before it is shown, and may correct a typo in it. Your email address is never shown, on the board or anywhere else. We do not keep the address with an idea or a vote: we keep a one-way code made from it, so that each address counts once per idea, and your browser keeps a random voting pass on this site, so it can see the details on the board and your later votes need no email; clearing this site's data in your browser removes it. If you tick "Email me when this idea ships", we keep the address for that one note, use it for nothing else, and delete it once the note is sent or the idea is removed. We check the address's domain in the same public directories as our other forms, to see that it can receive mail; only the domain is looked up. A request you don't confirm is deleted after seven days.
Checkout interest: if you ask on the pricing page to hear when a plan's checkout opens: your email, the plan and the time, on the same record as your early-access request if you made one. We send one short note when you ask, even if you also asked for early access, and one email when that checkout opens, and keep it until then, then for up to 12 months.
Support tickets: your email, subject, message, the page you were on, your browser's user agent and, if you gave it, your app version. Kept for up to 2 years after the last message, like support email; we delete them by hand at the end of that time.
The team contact form on the teams and pricing pages: your work email, and, if you chose to give them, your name, your organisation, your team size, which computers you use, what you need (pricing for a team, billing, our security questionnaire, deploying with IT, a call) and a message, with the time and which of the two pages you used, kept with our hosting provider, with a copy sent to our own inbox, hello@recordist.app, so that we can reply. We use it only to answer you about Recordist for your team, and we send you nothing else: no confirmation email, no marketing email, no list. We keep the enquiry for 12 months and then it is deleted automatically, or sooner if you ask. The copy in our inbox is kept like other support email (section 6). Your IP address and browser are not kept with it.
Applying for a role at recordist.app/careers, through the form on a role's page or by email: your name, your email address, where you live, your answers, your resume or cover letter, the role, the time and, if you gave them, your LinkedIn profile and how you heard about us. We use your application only to decide on it and to reply to you, and we never publish it or add you to a list. A person reads every application and makes every decision; AI tools help us organize applications and draft our replies. If you use the form, our hosting provider, Cloudflare, holds your application in private storage, none of it public, and one short note with your name, your address and the role reaches our own inbox, careers@recordist.app. Resend, our email service, sends that note and your confirmation and keeps its copy of each for 30 days. We keep your application for 12 months after we decide, then delete it, or sooner if you write to careers@recordist.app and ask. What you sent through the form is deleted automatically 400 days after you send it, and a form you started but did not finish sending within 2 days. Your IP address and browser are not kept with it. Our basis: your consent, given when you send the application, and our legitimate interest in limiting abuse (the counts of repeated tries).
The withdrawal and cancellation form at recordist.app/legal/withdrawal: your name, the email address you used at checkout, the order date if you gave it, whether you are withdrawing from the purchase or cancelling the subscription, and the date and time (UTC) you pressed Confirm. We email the statement to our support inbox and a copy to you as your confirmation, and we keep it with your order record (section 6), because it is part of the record of your contract.
Repeated tries: to limit repeated tries and abuse, our forms, Wren, the download button and the purchase confirmation page keep short-lived counts against your connection's IP address (for some, a one-way hash of it), and a few also against your email address or its domain, then delete them within a day at most (section 6). The purchase confirmation page, recordist.app/thanks, shows only after our licence service confirms your checkout with Stripe. It keeps the confirmed checkout for 48 hours, and a note of the check for as long as our other server logs (section 6), never with your customer details.
Our own notifications: we hear of new requests through Slack, which sees an address only masked, as its first letter and its domain, and never a name, organisation or message. A request to hear when checkout opens, or a team enquiry, also reaches our own inbox, hello@recordist.app, with the full address, so that we can reply.
Wren, the support assistant (AI): messages you type are sent from our website to Anthropic's API to generate a reply, with anything that looks like an API or licence key removed first. We do not store chat messages and do not log their contents; Anthropic's API terms govern its processing. If you open a ticket from the chat, only the ticket is stored.

Legal basis for what our hosts receive from the app (section 1.2) and for sections 2, 2.1 and 4 (where the GDPR or UK GDPR applies): our legitimate interest in delivering updates and keeping licences valid, for the app's requests to our hosts, and our contract with you, for the automatic renewal of a Pro subscription and for handing a key you bought from inside the app to that app; our legitimate interest in running and securing this site and knowing how it is used without identifying anyone, for page views, server logs, the counts of repeated tries and our own notifications; the steps you ask us to take, for the forms, support and Wren, and our legitimate interest in improving Recordist from what support teaches us; your consent, for news of new versions, which you can withdraw at any time with the unsubscribe link; our contract with you under its rules, for the early-access draw, and our legitimate interest in handling a dispute, for keeping an early-access record after the draw; and our legal obligation, for keeping a withdrawal or cancellation with the record of your contract. In Canada, we collect and use this information for the purposes above with your consent, as PIPEDA requires.

3. Purchases and licence keys

When you buy Pro, Link, a service of Stripe, is the seller of record. Link collects your payment details, billing address and email under its own privacy policy, sends you the receipt and answers payment questions. Stripe tells us your email address, the plan, the amount and currency charged, and your country, which we use to issue your licence key, to answer you, and to keep the records tax law requires. We never see your card number. Stripe sends us:

your email address,
the plan you bought, the amount, currency, date, and a Stripe customer and payment id,
your billing name and address, which Stripe collects to work out tax, a business name if you give one, and your VAT or GST number if you give one.

We use this to issue your licence key, send it by email (through Resend, our transactional email provider), calculate and remit taxes, provide support, and keep accounting records. For each subscription we also keep the checkout session id, the time, the price, currency and interval, the version of the Terms you agreed to and, if you came from one of our own links, which kind of link it was, as the record of your consent to the automatic renewal, for three years or for one year after the subscription ends, whichever is longer. A licence key bought through checkout contains a one-way hash of your email address, made with a secret that only we hold, so that we can confirm a request to send the key again. The key does not contain your address, and nobody without our secret can work the address out from the key. We treat the hash as personal information, because we can match it to your address. A key we make by hand, such as a prize or a replacement, may instead contain a plain one-way hash, which someone who has the key could check a guessed address against. A key bought through checkout also carries a "Licensed to" name: the business name you gave at checkout, or else your billing name. The name is kept inside the key, which stays on your computer, and the app shows it under Settings, License, so a key that is passed around names its owner. Anyone you give the key to can read it. If a payment is refunded or reversed, we add that key's random licence id, never your name, address or email, to our public list of withdrawn keys, until the key's own end date has passed.

When you buy, the email with your licence key also tells you where to get the app: the download page, open to everyone with no email. A purchase made before downloads opened also marked the address as approved on its early-access record (section 2.1), or started one; such a record is not an entry in the early-access draw, and we keep it as long as an early-access request (section 6).

When you open Pro checkout from inside the Recordist app, from version 1.0.9, the checkout also carries a one-way code made from the random code the app made for it (section 1.2), and Stripe sends that one-way code back to us with your order. Once you pay, our licence service keeps a note of which licence that one-way code bought for 7 days, so the app on your machine can collect your key and switch Pro on, then deletes the note. The code is made from nothing about you or your machine, and only the app that made it can collect the key, and only from the same network as the page that confirms your purchase: when that page opens, after any purchase, our licence service keeps a keyed one-way code of the network it opened from, never the address itself, for the same 7 days. Your key also arrives by email, as always.

Legal basis (where the GDPR or UK GDPR applies): performance of a contract with you, and our legal obligation to keep tax and accounting records. In Canada, we collect and use this information for the purposes above with your consent, as PIPEDA requires.

3.1 Free keys and programme keys

The Terms (section 3) let us issue free keys and programme keys under programmes we publish on this site, such as an invitation, founding testers, pro bono work, students, interns or more time with Pro. This is what we collect when we run one; the key for 14 days of Pro has its own section, 3.2, and keeps its address longer than the 24 hours below. We use your address to send a confirmation link, then the key. We keep the address until you confirm, for 24 hours at most, and for one more hour after you confirm so the separate release-notes button can work. After that we keep a one-way code made from it, with the key's id and dates, so each address gets one key: for two years after the last email for a Free or invitation key, and for a year after a student key ends. A founding tester's answer is kept until 30 June 2027 and used only to improve Recordist; the address goes once we send our decision. A pro bono application is kept until 12 months after its keys end; the applicant's address goes once we send our decision. The one-way code is personal data under the law of some places, and we treat it as such. Resend, our email service, keeps its copy of each email for 30 days. We send these emails because you asked for them; we use the address for nothing else, and we never add it to the release notes unless you press that separate button. Each email has a link that stops us sending that address a Recordist key again. If you use that link, we keep the one-way code of the address for as long as we run these programmes, so that we can keep that promise. Our basis: your request (the key emails), our legitimate interest in limiting abuse (the one-way code, the counts per connection), and your consent (release notes). Whether a programme is open is stated on its own page; this section describes no collection that happens before you ask for a key.

More time with Pro. When you ask for more time at recordist.app/more-time, we collect your email address, the length you chose and, if you write one, your note. We use them to answer your request and for nothing else: to check whether the address has a subscription with us, to decide, and to email you our answer and any key. A person reads your note. It is kept with our hosting provider (section 5), never copied into any other service, such as a chat or translation tool, and never used for anything else. Please don't tell us about your health; if you do, we read it only as part of your note, and it is deleted with it. If you don't confirm your request within 24 hours, we delete your address and your note. Once you confirm, we delete them when we send our answer, or an hour after you confirm if our answer comes sooner. If you ask by email instead, or reply to one of our emails, we delete the email thread once your request is settled. After our answer we keep a short record of it, with no address or note: what we answered, the dates, the length and whether you subscribe. If we gave you time, we also keep a one-way code made from your address, with the id of the key we gave and the date it ends, so that a new request can follow on without a gap. Both go 30 days after that key ends, or 30 days after our answer if we gave no key. If you subscribe and we move your next payment, Stripe and Link record the new date as part of your subscription, and Link may email you about it. Our own record of your subscription keeps that date and how it was moved, so that a reminder reaches you before it, and forgets both once that payment is taken; if the subscription ends before that payment, they stay in that record for as long as section 6 keeps it. Our email provider keeps a copy of the emails we send for 30 days (section 5). Our basis: your request.

More time from the end of your Pro trial. When Recordist opens recordist.app/more-time at the end of your Pro trial, you can ask for 14 more days of Pro with your email address alone. Nobody reads these requests: we send the key as soon as you confirm, and we keep your address no longer than this section says above. If the app opened the page with one, the button also sends the app's trial code, a random code the app makes for that install, which it also sends when you ask for your Pro key (section 3.2); we never keep the trial code itself. So that these days come once for each address and each install, we keep a one-way code made from your address and, if the app sent its trial code, a one-way code made from that, each with the id of the key we gave and nothing else, for a year after we give the key. If these days were given already, or your address has time from us, we email the address a short note instead of a link. Our basis: your request (the key and the note), and our legitimate interest in limiting abuse (the one-way codes).

Switch Credit. When you ask for a Switch Credit at recordist.app/switch, we collect your email address, the notetaker you name, the months you say you paid for, and the receipt you add: a photo, a screenshot or a PDF. A photo or a screenshot is drawn again in your browser before it is sent, which leaves its location and other hidden details behind, and you may cover anything on the receipt we don't need, such as card digits. We use them to decide your request and to email you our answer and any key, and for nothing else. A person at Recordist reads the receipt. It is kept with our hosting provider (section 5), never copied into any other service, such as a chat or translation tool, and never used for anything else. If you don't confirm your request within 24 hours, we delete your address, the receipt and the rest of the request. Once you confirm, we delete the receipt the moment we decide, and after 30 days in any case, and your address when we send our answer. While your request waits, and after it if we gave you a credit, we keep a one-way code made from your address so that each person has one request at a time and one credit; with a credit it holds the id of the key and the date it ends. After our answer we keep a short record of it, with no address and no receipt: what we answered, the dates, the notetaker if it was one on our list, and the months. The record and the code go 30 days after the key ends, or 30 days after our answer if we gave no credit, when the code goes at once. If you send the receipt by email instead, we delete the email thread once your request is settled. Our email provider keeps a copy of the emails we send for 30 days (section 5). Our basis: your request.

3.2 Your key for 14 days of Pro

When Recordist first opens (from version 1.0.10), it may ask for your email to send your key for 14 days of Pro. You can skip it and use Recordist free. If you give an address there, or on our download page from a phone, this is what happens.

If you answer How did you hear about Recordist? on the same screen, the app sends that one word, the platform and the version on their own, and we only add it to a total. It is never kept with your address or your key.

What we keep: the address; a one-way code of it; a one-way code of the random code the app makes for your machine, with that machine's key id and dates; the key's id and the dates it was issued and ends; when you gave the address and the version of the words you saw; which of our three notes we have sent and whether you stopped them; and, only while we hold the address, the app's platform and version and your time zone, so notes arrive in your morning. From a phone, we keep the address only until the email with the link is sent, and a one-way code of it for 7 days, so we can count how many phone requests became keys. To limit abuse we also keep, for 40 days, daily counts of new keys per network and per work domain, each against a short one-way code, never the IP address or your address.

Why: to send your key and keep a copy within reach, to keep it to one key per machine, and to send three short notes, the last the day after your 14 days end.

How long: the address until a week after the last note, so its "Keep me posted" link still works: about three weeks after you gave it, and never more than 30 days. Resend, our email service, keeps its copy of each email for 30 days after it is sent. The address is deleted sooner if you choose "Send only my key, no notes" (once the key is sent), stop the notes, press "This wasn't me", the email can't be delivered, or you buy Pro (your purchase has its own record). The one-way code, the key's id and dates, the words you saw and when, which notes we sent and whether you stopped them are kept for three years, as our record of what you agreed to; everything else goes with the address. The machine's one-way code is kept for a year. If you press "This wasn't me" or "Stop all email", we keep only a one-way code of the address, so we never write to it again.

Who handles it: Cloudflare stores it, Resend sends the emails, and replies reach our mailbox (section 5). We never sell your address or share it for advertising. Our emails carry no tracking pixels and no tracked links.

Your choices: "Send only my key, no notes" when you give the address; a stop link in every note, and your mail app's unsubscribe button; "Just the key, please" in the key email; and "Stop all email from Recordist to this address" on the stop page. To have the address deleted at any time, press "This wasn't me" in the key email or any of the three notes, or write to support@recordist.app.

Legal basis: sending the key is what you asked for. The notes rely, in Canada, on your request and on your use of Recordist under our Terms; in the EU and the UK, on the rule that lets a business write to people who asked about its product, as long as they could say no when they gave the address and can stop in every email, and on our legitimate interest in helping you use what you asked for. You can object at any time with the stop link. The one-way codes and the counts rest on our legitimate interest in keeping to one key per machine and per address and in limiting abuse; the three-year record rests on our legitimate interest in being able to show what you agreed to.

4. Support

If you email us we keep the correspondence to answer you and to improve the product. Anthropic's AI helps us sort email sent to our recordist.app addresses, such as hello@, support@, licenses@ and privacy@, and draft answers; a person at Recordist reads and sends every reply. Anthropic does not use this email to train its models and deletes it within 30 days, unless it is flagged for a safety review. Support never asks for your transcripts or meeting audio. If we need details, we ask for the diagnostics bundle only, which contains neither. It does contain your settings and the last 400 lines of the app's log, which can name meetings, so read it before you send it, and don't send it if your meeting titles name clients or patients. Current versions show calendar feeds only by their host and replace the tokens and keys they recognise, such as the licence key and AI providers' API keys. Please do not send audio or transcripts of other people unless they have agreed, and please do not send us health information about anyone.

5. Data we share

We share personal data only with the processors needed to run the business: Stripe (payments, and Link as the seller of record), Resend (email delivery), Cloudflare (hosting this site and its forms, our downloads and updates, the licence service, and the routing of email sent to our recordist.app addresses, with a copy of each message kept like support email), Slack (notifications to our team, which show addresses only masked), Anthropic (generating Wren's replies, and helping us sort and draft answers to email sent to our recordist.app addresses, such as hello@, support@, licenses@ and privacy@; a person reads and sends every reply) and Google (the mailbox our recordist.app addresses forward to). We do not sell personal data and we do not share it for advertising.

6. Retention

Order and licence records, including a withdrawal or cancellation you send through our form: for as long as your licence may be valid, plus the period required by tax law (typically 7 years). The record of your consent to automatic renewal: three years, or one year after the subscription ends, whichever is longer.
Automatic renewal of a Pro subscription, from app version 1.0.5: for each machine, the one-way code of its renewal secret, when it registered and when we last heard from it, until 90 days after the subscription's last key ends (section 1.2).
A purchase from inside the app, from app version 1.0.9: the note linking the one-way code to your licence is kept for 7 days after the payment, then deleted (section 3). The one-way code of the network the confirmation page opened from is kept for the same 7 days. The order itself is kept like any other.
Support email and tickets: up to 2 years after the last message. The copy Anthropic's AI sees while helping us sort and draft answers is not used to train its models and is deleted within 30 days, unless it is flagged for a safety review.
Early-access requests (the form closed at version 1.0): until the draw is complete, then up to 12 months in case of a dispute. Download links: deleted when they expire, seven days after they are sent.
Checkout interest: until that plan's checkout opens, then up to 12 months.
Team contact form enquiries: 12 months from the day you send one, then deleted automatically. The notification email in our inbox: like support email, up to 2 years after the last message.
Job applications: 12 months after we decide, then deleted, or sooner if you ask. What came through the form is deleted automatically 400 days after you send it, and a form you did not finish sending within 2 days. Email about an application, in our mailbox, goes on the same schedule.
Free keys and programme keys, and requests for more time: as section 3.1 says for each programme.
Your key for 14 days of Pro: as section 3.2 says; the address never longer than 30 days.
News of new versions: until you unsubscribe; a request you don't confirm, seven days after the confirmation email.
Ideas: an idea, and the one-way codes of the addresses that voted for it, for as long as it is on the board or waiting to be read; a voting pass, a year from when it was made; an address kept for the shipped note, until that note is sent or the idea is removed; a request you don't confirm, seven days after the confirmation email.
Counts of repeated tries: a minute to an hour, a day for the per-address and per-domain counts, and 40 days for the daily counts of the key for 14 days of Pro (section 3.2). A checkout session id the confirmation page confirmed: 48 hours.
Server logs: up to 30 days.
A transcript the browser extension keeps: in your browser on your machine, until you delete it or remove the extension (section 1.4). We never receive it.
Data on your device: entirely under your control; see how to delete it.

7. Your rights

Depending on where you live you may have the right to access, correct, delete or export the personal data we hold about you, to withdraw consent, and to object to or restrict certain processing. Write to our Privacy Officer at privacy@recordist.app and we will respond within 30 days. If you are not satisfied with our answer, you can complain to a supervisory authority: in Canada, the Office of the Privacy Commissioner of Canada; in Québec, the Commission d'accès à l'information; in the EU or the UK, the data protection authority where you live. We may need to keep transaction records we are legally required to retain even after a deletion request.

California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising.

8. International transfers

We are based in Canada. Our processors operate in Canada, the United States and the European Union. Where data leaves the EU or UK we rely on the processors' standard contractual clauses or adequacy decisions.

9. Children

Recordist is not directed at children under 16 and we do not knowingly collect their data.

10. Changes

We will post any change to this policy here with a new effective date, and, for material changes affecting paying customers, email you before it takes effect.

In good faith

Recordist was built in good faith by a small team who wanted meeting notes without a bot in the room or a vendor holding the recording. It is a tool for remembering your own conversations. It is not a tool for recording people who do not know, monitoring staff, or surveilling anyone. By default the app asks before it records a call. While it records, an amber dot shows in your menu bar. Only you see it; the other people on the call don't, so telling them is up to you; Recordist can copy a short notice for you to read out or paste into the chat, and keeps a mark of when you said you gave it. Our recording-law guide has notice templates you can use, because we think the people you talk to deserve to know. Use it responsibly; the recording is yours, and so is the responsibility for it.

Contact

Havihi Digital Inc. · Privacy Officer · 2 McMillan Place, Welland, Ontario L3B 0L5, Canada · privacy@recordist.app