What leaves the machine. What doesn't.

The microphone is used only while you are recording, and only after you start a recording yourself. Recordings are stored on your phone until you delete them.

The camera is used for one purpose: reading the pairing code your computer displays. Nothing is stored and no image leaves the phone.

When your phone and your computer are on the same network, the recording goes directly from one to the other. No server is involved and nothing reaches the internet.

When your phone is not on that network, the recording travels through our relay so that it is not lost. Before it leaves your phone it is encrypted end to end, using keys that were exchanged directly between your phone and your computer when you paired them. We do not have those keys and cannot decrypt what we forward. Your computer decrypts it.

Even though we cannot read the contents, operating a relay means we can see certain technical information:

• an opaque routing identifier that tells us which mailbox to put the data in. It is not linked to your name, your email or your device.
• the size of each transfer, and when it happened
• the IP address the request came from, which may be retained in server access logs
• if you turn on notifications, the Apple push token for your phone, so we can tell your phone that a transcript is waiting. It is stored until you unpair.

We cannot see who you are, who was in your meeting, or anything that was said.

There is one exception we disclose rather than gloss over: if your computer is running a version of LocalTranscript that is too old to understand our current encrypted format, the technical description accompanying a recording (your device's label, the length and size of the recording, timestamps, the marks you placed, and the language setting) is sent in a readable form, because an older computer cannot parse the sealed format. The audio itself is still encrypted. Keeping your computer app up to date avoids this entirely.

If you allow notifications, we send your phone a signal when a transcript is ready. That signal contains no part of your meeting: no text, no title, no identifier. If you decline, the app checks for results on its own instead, and everything still works.

The iPhone app contains no analytics, no crash reporting, no advertising identifier and no tracking of any kind. There is no account, so there is nothing for us to build a profile against. We do not sell or share data with anyone, because we do not have any to sell.

• Turning the companion off on your computer stops it accepting recordings.
• Unpairing on the phone removes the connection and deletes the stored push token for that pairing.
• Deleting a recording on the phone deletes it from the phone. Anything already delivered to your computer lives there, under your control.
• Deleting the app removes every recording it holds.