Privacy policy

Earkeep transcribes your meetings locally, on your device. Your audio is processed only in memory and is never written to disk and never uploaded anywhere. Your transcripts are saved as plain files on your own computer, under your control. There's no account, no cloud storage of your meeting data, and no telemetry that sends your meetings, transcripts, or usage patterns to us.

Three things reach a server, and none of them is your meetings: our own licensing service at earkeep.com (which starts your trial and checks your license), Creem (our merchant of record, who handles your purchase and issues your license key), and our own self-hosted, cookieless website analytics. A fourth reaches Google, and only if you say yes: we advertise, and we would like to know which ads lead to a download. All four are described in detail below, with nothing left vague.

Audio. While Earkeep is running, it processes microphone and system audio only in memory, to run local transcription. That audio is never written to disk in any form, and it is never sent to Earkeep, to us, or to any third party. There is no server that receives your audio, no API call that carries it, and no upload step of any kind.

Transcription. Transcription runs entirely on your device, using Whisper or Parakeet models running locally with Apple Silicon hardware acceleration. Earkeep does not call out to any transcription APIs to do this work.

Storage. Transcripts are saved as plain files on your device, in a location you control. You can open them, search them, back them up, or feed them to any tool you choose. We don't have a copy. There is no Earkeep server that stores, syncs, or backs up your meeting transcripts.

Deletion. Because the files are yours and there is no copy anywhere else, deleting is immediate and complete. In the app you can purge a selected stretch of a day, delete a saved meeting together with its transcript, or remove a whole day; you can also just delete the files yourself. Nothing is written in place of what you removed, there is no recycle bin, and nothing has to be reconciled against a server, because there is no server. It also means there is no undo.

Stopping capture. Earkeep runs continuously while it is open, and you can stop it: pause from the transcript for a set time or until you resume, or mark an event on a connected calendar so capture stops for the length of that meeting. Pausing releases the microphone and the system audio stream instead of discarding what they hear, which is why your operating system's own recording indicator goes dark while it lasts. Neither pausing nor deleting is logged anywhere: a stretch you paused reads afterwards like a stretch where nobody spoke.

No account required. Using Earkeep, including the full 14-day trial, requires no email address, no sign-up, and no cloud account of any kind.

Other people's privacy is yours to look after. This policy covers what we do with data, and the answer for your meetings is that we never receive any. It cannot cover what you owe the people you record. Earkeep announces itself to nobody: no bot joins the call and no banner appears on anyone else's screen, so unless you tell the room, nobody in it knows. Many places require you to say so beforehand and some require everyone's agreement, not just yours. Earkeep asks you to acknowledge this when you first run it, and repeats it under the transcript, but acknowledging it is not the same as it being handled. Telling people you're recording covers what to say and how to stop; the terms set out the responsibility itself.

Calendar connections. If you connect Google Calendar, Apple Calendar, Microsoft Outlook, or an ICS calendar URL so Earkeep can start and end meeting spans automatically, that connection is read-only and is used only to read event titles, start and end times, and the handful of facts that tell Earkeep whether an event counts (all-day, cancelled, declined, and whether anyone besides you is on it). The app on your device talks to the provider directly: no Earkeep server sits in the middle, receives your events, or keeps a copy of them. Earkeep never writes to your calendar, never creates, edits, or deletes events, and never asks for your mail, contacts, files, or anything else in your account. The Google connection is described in full in the next section.

In-app agents and MCP. Earkeep lets you run other local agent apps (Claude Code, Codex, Cursor Agent, Gemini CLI, and others) directly against your meeting history, and exposes an MCP server so external tools can read your meetings too. These are integrations you choose to use and configure yourself; whatever data leaves your machine through them is governed by the privacy policy of whichever agent or tool you've connected, not by Earkeep. Earkeep itself doesn't relay your meeting data anywhere on its own.

Connecting Google Calendar is optional. If you do connect it, here is exactly what Earkeep asks for and what happens to it.

The one scope we request. Earkeep requests a single OAuth scope, https://www.googleapis.com/auth/calendar.readonly. It is read-only, and it is the narrowest scope that lets the app do the one job you connected it for: know when your meetings start and end, so a span on your timeline can be created and named without you doing it by hand. Earkeep requests no other Google scope, and a read-only scope cannot modify anything in your account even if it tried.

What we do with the data. Event titles and times are read by the app on your device, matched against your timeline, and used to create and label meeting spans. That is the whole purpose, and it is the only purpose.

What we never do with it. Google Calendar data is never transferred to Earkeep's servers, never sold, never shared with any third party, never used for advertising or for any credit or lending purpose, never used to train, retrain, or improve any machine-learning or AI model, and never read by a human at Earkeep. We could not read it if we wanted to: it is on your device and never reaches us.

How the credentials are protected. The connection uses the OAuth 2.0 authorization code flow with PKCE, in your real browser, redirecting to a loopback address on your own machine, with the state parameter verified on return. Earkeep never sees or handles your Google password. The short-lived access token lives only in memory and expires; the refresh token is stored in your operating system's own credential store (Keychain on macOS, Credential Manager on Windows) under the service name earkeep. It is never written to a configuration file, never written in plain text anywhere, and never transmitted to us or to anyone but Google.

What is cached on your device, and for how long. So the app can still show your day when a provider is unreachable, Earkeep keeps a small local cache file of the events it last fetched, covering only a rolling window of 7 days either side of today. It lives in Earkeep's own application data folder on your device, and days that fall outside that window are deleted automatically, both whenever the cache is written and once a day while the app runs. No other copy of your calendar data exists.

Revoking access, and deleting the data. Settings → Calendar → Disconnect deletes the refresh token from your credential store immediately, and the app stops fetching from that point. You can also revoke Earkeep's access at any time from your Google Account at myaccount.google.com/permissions, which is authoritative regardless of what any app has stored. Cached events roll off on their own as the 7-day window moves, so within a week of disconnecting nothing is left; deleting Earkeep's application data folder removes them at once.

Limited Use. Earkeep's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The Microsoft Outlook connection works the same way, with the read-only Calendars.Read Microsoft Graph scope and the same keychain storage. An ICS URL is stored in the same credential store, not in a config file, because a private ICS link is itself a secret.

Security procedures are in place to protect the confidentiality of your data, and we use encryption to protect it. Concretely:

• The strongest protection is not holding the data. Your audio is processed only in memory and never written to disk. Your transcripts stay in files on your own device. Your calendar events are fetched by the app straight from the provider. None of these ever reach a server we run, so there is no central store of meeting content to breach, subpoena, or leak.
• Encryption in transit. Every network call Earkeep makes is over HTTPS with TLS: to Google and Microsoft for calendar events and token refreshes, to your ICS feed, and to our own licensing service. The website is served over HTTPS only.
• Secrets encrypted at rest, in the OS credential store. Calendar refresh tokens and ICS URLs are held by your operating system's own credential store (Keychain, Credential Manager), which is encrypted at rest and access-controlled by the OS, not in a file an unrelated program could read.
• Encryption and hashing on the licensing service. Hardware fingerprints, license keys, and request IP addresses are stored only as peppered HMAC-SHA-256 hashes, which we cannot reverse. The one value we must be able to read back, the license key needed to re-validate with our merchant of record, is encrypted with AES-256-GCM. The pepper and the encryption key live only in the server's environment, so the database file and its off-site replica carry no usable secrets on their own.
• Access control. The licensing service runs on infrastructure we operate, reachable only over key-based SSH by the maintainers who run it. There is no admin console, no support portal, and no third-party dashboard with a view into the database. Backups replicate to object storage that is encrypted at rest and private.
• Data minimization by design. The licensing service stores one row per device: a hashed fingerprint, a trial start date, platform and app version, and when it last checked in. There is no account, no name, no email, no profile, and nothing about your meetings.
• Retention and deletion. Calendar data on your device is capped at the rolling 7-day cache described above and pruned automatically. Licensing rows are kept while the trial or license is live, plus a short activation history so we can answer you if you write in. Support email is kept only as long as needed to resolve your request. Anything on your device is deleted the moment you delete the files or uninstall the app, because your device is the only place it lives.
• If something ever went wrong. In the event of a security incident affecting data we hold, we will notify affected users and the relevant supervisory authority as required by law. The scope of what such an incident could touch is bounded by the list above, and does not include your meetings.

Earkeep is sold through creem.io, which acts as the merchant of record for every purchase. That means Creem, not Earkeep, is the party that actually processes your payment and is responsible for the data involved in doing so.

When you buy Earkeep, Creem's hosted checkout collects and processes:

• Your email address (to send your license key and receipt)
• Your payment details (processed by Creem and its payment processors; Earkeep never sees or stores your card details)
• Billing information needed for tax/VAT compliance, where applicable

Creem then issues a license key by email. That key, and the fact that it's associated with a license instance on your device, is what Earkeep itself stores and checks.

Starting your trial. The first time Earkeep runs, it registers the device with our licensing service at earkeep.com. This happens before any purchase, and it is the one thing the app does that we ask you to know about up front. It sends a one-way hash of a hardware identifier, the platform name, and the app version. Nothing else — no email, no account, no name, and nothing from your meetings. The hash is what lets us stamp your 14-day trial once, so that reinstalling the app doesn't hand out a second one; we cannot reverse it back into an identifier for your machine, and we never share it.

License activation and validation. When you activate your license, Earkeep sends the key to that same service, which verifies it with Creem and records your device as the license's active instance. The app never contacts Creem directly — Creem's license API requires a secret key that cannot safely live inside a downloadable app, so our server holds it and makes the call. Afterwards Earkeep checks in about once a day. These checks use an offline grace period: Earkeep does not phone home every time you launch the app, and a week without internet won't interrupt your use of it. License enforcement shouldn't mean constant network chatter, and it never touches your meeting data — only the key, the device, and whether the two still go together.

What that service stores. One row per device: the hashed hardware identifier, the date your trial started, the platform and app version, and when we last heard from you. If you buy a license, it also stores the license key (encrypted), which device currently holds it, and a short history of activations and moves so we can answer you if you email us about it. Request IP addresses are used to rate-limit abuse and are stored only as a hash, never in the clear. There is no account, no profile, and nothing to log in to.

Our own website analytics is self-hosted and cookieless, and that part has not changed. Concretely:

• It sets no cookie. A session id lives in your browser's own sessionStorage for 30 minutes and is gone when you close the tab.
• It goes to us, not to a data broker. The collector runs on our own infrastructure, so these numbers are not a product anyone else is selling.
• Only aggregate data is collected: page views, referrers, rough visit counts, and which pages get clicked. None of this is tied to an individual identity, and none of it touches the app or your meetings, which run entirely separately on your device.

This is the one place a third party reaches your browser on earkeep.com, so here is the whole of it. We buy ads on Google to get this app in front of people who would use it. What we cannot tell from our own analytics is which of those ads actually led anywhere, and the only way to know is to let Google's own tag join your click on the ad to your arrival on the download page.

That tag sets one cookie, _gcl_au, in your browser, which Google uses to recognise its own ad click for up to 90 days. It is an advertising cookie and it needs your consent, which is why there is a bar at the foot of the page asking for it. We would rather ask than quietly decide for you.

What that means in practice:

• Nothing loads until you say yes. This is stricter than the usual setup. Google's script is not fetched, not executed, and not told your visit happened unless you press Allow. Most sites load the tag on every visit and merely withhold its storage; we don't.
• Saying no costs you nothing. No feature of the site, the download, the trial, or the app depends on it. The bar goes away and does not come back, and we are simply left guessing about our own ad spend, which is our problem rather than yours.
• We count downloads, not people. The only thing reported is that a download started. Google is not told who you are, what you read, or anything about the app, and the app itself has no part in this at all: it never talks to Google, and nothing on this page applies to your meetings.
• You can change your mind. The button below clears your answer and puts the question straight back. A tag already loaded on the page you are reading stays until you leave it, and clearing this site's data in your browser is what removes the cookie it set.

If you have JavaScript turned off, none of this can run at all, so the tag never loads and there is nothing to answer.

If you email [email protected] (support, license issues, feature requests, or anything else), that message and your email address are used only to have the conversation and resolve whatever you wrote in about. We don't add you to a marketing list from a support email, and we don't share your email with anyone outside of what's needed to help you.

Because transcription and storage happen locally on your device, Earkeep the company never holds a copy of your meeting audio or transcripts. There's nothing on our servers to request, correct, or delete on that front, because it was never sent to us: your device is the only place that data ever exists.

The data that does involve us is narrower and handled by named parties:

• Purchase data (email, payment, license key) is processed by Creem as merchant of record. Rights around that data (access, correction, deletion) are best exercised through Creem directly, or by emailing us and we'll help route the request.
• Support email correspondence is held only as long as needed to resolve your request. Email [email protected] if you'd like a copy of, or the deletion of, correspondence you've sent us.
• Website analytics are aggregate and not tied to an individual, so there's no per-person record to request or delete.
• The advertising cookie is only ever set if you agreed to it, and you can withdraw that agreement at any time from the section above or by clearing this site's data in your browser. What Google holds against its own ad click is Google's to answer for; their controls are at My Ad Center.

For any privacy question or request not covered above, email [email protected] and we'll sort it out directly. There's no ticketing system standing between you and an answer.

If this policy changes, we'll update the effective date and describe what changed. Because Earkeep is local-first by design, we don't expect the core promise (your audio and transcripts never leave your device) to change; if it ever did, that would be the most prominent thing on this page, not a quiet edit.

Questions about any of this go to [email protected].