Privacy Policy

1. Introduction

The Takeaway ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our personal meeting assistant and Takeaway-curation service.

2. Information We Collect

We collect information you provide directly:

• Audio recordings you upload or record
• Text transcripts you paste
• Account information, including email and profile name
• Connected-service data when you choose to enable an integration
• Payment information processed securely through Stripe

We automatically collect:

• Usage data (features used, session duration)
• Device information (browser type, operating system)
• IP address in service and security logs

3. How We Use Your Information

• To transcribe and analyze your meeting audio
• To generate summaries, action items, and other takeaways
• To monitor and improve service reliability and quality
• To process payments and manage subscriptions
• To communicate important service updates

4. Data Processing & Third Parties

We use trusted third-party services to provide our functionality:

• Deepgram — for speech-to-text transcription
• OpenRouter and DeepSeek — for AI-powered analysis and summarization
• Supabase — for secure data storage and authentication
• Stripe — for payment processing
• Vercel — for hosting and content delivery
• PostHog — for limited product event counts and sanitized browser errors when you opt in, and anonymous server reliability diagnostics
• Recall.ai — when you use a meeting bot to record a supported meeting
• Cleanvoice — when you choose audio enhancement
• Google and Microsoft — when you connect a calendar
• Notion, Linear, and Trello — when you connect an export destination
• Resend — for service email
• Firebase Cloud Messaging — for push notifications

Each provider has its own privacy policy and data handling practices. We only share the minimum data necessary to provide our services.

5. Data Retention & Security

Audio captured through direct recording is stored privately for saved-meeting playback and is automatically removed after 7 days on Free or 90 days on Pro and Team; Enterprise retention is custom. Account deletion removes it sooner. Transcripts and summaries remain associated with your account until you delete them or the account-deletion lifecycle removes them. Service usage data may be retained for security, reliability, and analytics.

Meeting content is private by default. If you explicitly create a share link, access is scoped to that link's token and any link controls you configure.

Day Recap (Android)

Day Recap is off until you turn it on. While it runs, the Android app records the room around you, including other people speaking, and shows a persistent notification you can use to pause, stop or show a recording notice. Audio is cut into five-minute pieces, and a piece without enough speech is deleted on the device and never uploaded. Day Recap is only for US states that do not require every person's consent to record. You confirm your state when you start, and each upload is checked against your network location. If that location is outside the United States or in an all-party consent state, recording pauses and the audio from that stretch is discarded. We keep the state your network location indicated with each upload as a compliance record. You are responsible for telling the people around you that you are recording.

Day Recap audio is transcribed and then deleted within 24 hours of upload, on every plan. Audio that never finishes uploading is deleted on the same schedule, and on the phone when you next start a day. While recording you can delete the last 15 minutes at any time. Once the recap is made, the day's transcript and summary live only in that meeting, which stays in your account until you delete it. Day Recap does not create voiceprints or identify speakers by name; speakers are labelled by number.

We implement industry-standard security measures including encryption in transit (TLS 1.3), encryption at rest, and secure authentication. All API communications occur over HTTPS.

6. Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt out of marketing communications

7. Cookies

We use essential cookies for authentication and session management. If you choose whether to allow optional product analytics, a cookie stores only your choice for up to 180 days. It does not contain an analytics visitor ID. Change your choice or revoke permission at any time using Analytics privacy at the top of this page or in Settings → Data & Privacy. Do Not Track and Global Privacy Control signals override a saved analytics permission.

8. Optional product analytics

With your permission, we count visits to six named public pages, clicks on selected public buttons, and a small set of completed account, first saved Takeaway, and subscription actions. These counts help us see which parts of the product are used. They include only people who opted in and events our app successfully sent, so they are not complete usage or unique-user totals.

We send event names and fixed categories to PostHog through our server. We do not send names, email addresses, account or meeting IDs, audio, transcripts, summaries, form contents, page URLs, query strings, referrers, or visitor IP addresses to PostHog. We do not use analytics identity tracking, sessions, replay, or automatic click capture. Revoking permission stops future analytics and cancels pending account events, though an event already sent cannot be recalled.

Reliability diagnostics

Sanitized browser error reports follow your analytics choice and browser privacy signals. Anonymous server and background-job diagnostics help us find operational failures. Request diagnostics honor explicit analytics opt-outs and browser privacy signals; background jobs have no browser session. Reports contain an error category, application code locations, a route pattern, runtime, environment, and release version. Raw exception messages, private URLs, customer content, account identifiers, and request data are excluded. Source maps are uploaded privately to PostHog to resolve code locations. Session replay and console capture stay off. Error counts may be reduced by privacy choices, duplicate suppression, outages, and ingestion limits; they are not affected-user counts.

9. Children's Privacy

Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes via email or a prominent notice on our website. Your continued use after changes constitutes acceptance.

11. Contact Us

If you have questions about this privacy policy or your data, contact us at:

privacy@thetakeaway.ai