Privacy Policy

Recordings are encrypted on your device with keys only you hold, and what syncs to our cloud for storage is ciphertext we cannot read (end-to-end encryption). To generate a transcript or summary, the relevant audio or text is sent to our AI providers for that step, so it is readable by them for processing — it is not part of the encrypted storage. Recordings stay on your device unless you enable cloud sync, and you can turn Cloud AI processing off entirely so nothing leaves the device.

Your audio, transcripts, and summaries are not used to train AI models. The AI providers we use (Anthropic and OpenAI, with Microsoft Azure as a backup for speech recognition) do not train on data sent through their APIs under their standing API policies — not a setting we toggle per request. They may retain API data briefly (typically up to about 30 days) for abuse monitoring before deleting it; we do not have a separate zero-retention agreement with them, which is why we state this retention window rather than claiming your data is “never stored anywhere”.

• Account information — such as your email address, used to create your account and sign you in.
• Your content — recordings and the transcripts, summaries, and notes generated from them. Stored content is end-to-end encrypted; when Cloud AI processing is on, the relevant audio or text is sent to our AI providers for that step.
• Usage & diagnostics — minimal, largely aggregated technical data (e.g., crash and reliability signals) to keep the app working.
• Purchase status — your subscription/credit status. Payments are processed by the Apple App Store or Google Play; we do not receive or store your card details.

We do not sell your personal information.

We use your data only to run and protect the service you ask for. For users in regions with a legal-basis requirement (e.g., the EEA/UK), we rely on:

• Performance of a contract — creating your account, syncing and storing your content, and producing the transcripts and summaries you request.
• Consent — enabling Cloud AI processing (sending audio or text off your device) and the resulting cross-border transfer. You can withdraw consent at any time by turning Cloud AI processing off or deleting your account.
• Legitimate interests — securing the service, preventing abuse, and keeping the app reliable through minimal diagnostics.
• Legal obligation — complying with applicable law and responding to valid legal requests.

We share data only with service providers (processors) that help us run Recnovo, under contracts that limit them to our instructions:

• Supabase, Inc. — authentication, database, and encrypted storage (United States).
• Amazon Web Services, Inc. — custody and management of encryption keys (KMS key escrow) (United States).
• Anthropic, PBC — Claude AI for summaries, organized notes, translations, answers, and study materials (slides and quizzes) (United States).
• OpenAI, L.L.C. — speech recognition (transcription), search embeddings, AI chat responses, and backup AI processing (United States).
• Microsoft Corporation — Azure OpenAI, backup processing for speech recognition and embeddings (United States).
• Apple / Google — app distribution and in-app purchase billing. The store processes your payment; we receive only your purchase status.

We do not sell personal information and do not share it for cross-context behavioral advertising. We may disclose data if required by law or to protect rights and safety.

• Recordings, transcripts, and summaries — kept until you delete them or your account (stored as encrypted ciphertext). A cloud copy may be removed if its storage fee goes unpaid for 6 consecutive months, after advance notices and a 30-day grace period (see the Terms) — data on your own devices is unaffected.
• Account information — kept for the life of your account and deleted when you delete your account.
• AI provider API data — retained by the provider for up to about 30 days for abuse monitoring, then deleted; never used to train models.
• Diagnostics — short-lived and largely aggregated.

We may retain limited data longer where the law requires it (for example, tax or dispute records).

We protect your data with end-to-end encryption for stored recordings, TLS with strict certificate validation in transit, encryption at rest, and access controls. No system is perfectly secure, but security is a first principle of how Recnovo is built.

Wherever you live, you can access, correct, export, or delete your data — including your entire account — from within the app, and you can turn Cloud AI processing off at any time. Depending on your region, you may also have the right to object to or restrict certain processing, withdraw consent, and lodge a complaint with a regulator. To make a request, use the in-app controls or email hello@recnovo.com. We respond within the timeframes required by applicable law and may need to verify your identity first. We will not discriminate against you for exercising these rights.

Recnovo is not directed to children under 16 (or the minimum age of digital consent in your region), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the product and the law evolve. We will post the revised version here with a new “Last updated” date and, for material changes, provide reasonable notice.

For any privacy question or request, email hello@recnovo.com. The data controller is Recnovo Inc. (주식회사 레크노보), Room Ga-846, 8F, 191, Dongbaekjungang-ro, Giheung-gu, Yongin-si, Gyeonggi-do, 17006, South Korea, represented by Junmee You, Representative Director.