Privacy Policy
Last updated: 2026-07-14 · Beta
1. Data We Collect
Email, name (from Google), meeting audio·transcripts·summaries, usage stats. If you connect a Google integration, we process only the data that feature needs (see section 4).
2. Where Data Is Stored
Local-first on your device (SQLite). When cloud sync is enabled, data is stored in Supabase (Seoul region, ap-northeast-2), isolated per user.
3. Never Shared or Sold · No Staff Access to Meeting Content
Meeting and email data is never shared or sold for advertising, marketing, or analytics. It is entrusted only to the sub-processors in section 4, and only as far as running the service requires. **Our staff do not read your meeting audio, transcripts, summaries, or meeting titles.** The admin console does not display meeting content — only what support needs: the meeting's id, time, length, whether it succeeded, and why it failed. Titles are hidden too: an AI writes them from the meeting, so a title is a summary of the content. Three exceptions only: (a) you explicitly ask us to, in a support request; (b) the law requires it; (c) statistics from which no individual can be identified.
4. Sub-processors (PIPA Art. 26)
We entrust the processing of personal data to the companies below in order to run the service. We announce any change to this list before it takes effect. · Supabase, Inc. — servers, data storage, authentication (Seoul region, ap-northeast-2) · Anthropic, PBC — meeting summaries, document generation, agent replies · OpenAI, L.L.C. — speech-to-text (Whisper), image generation · Deepgram, Inc. — live speech-to-text · Google LLC — sign-in (OAuth), image generation (Gemini), and — only if you turn them on — Gmail send, Calendar, Drive · Vercel Inc. — web hosting · Resend (Plus Five Five, Inc.) — email delivery · PostHog, Inc. — product analytics · Functional Software, Inc. (Sentry) — error monitoring · Payple Inc. — payments (payments are currently disabled)
5. Cross-Border Transfers (PIPA Art. 28-8)
Supabase, the primary store for your meeting data, is in the Seoul (ap-northeast-2) region, so the original meeting data stays in Korea. Some data is transferred abroad for the processing below. [recipient / country / items / purpose / when & how / retention] · Anthropic, PBC (US, privacy@anthropic.com) — transcript text / summaries and documents / HTTPS API call when you use the feature / deleted after processing, not used for training · OpenAI, L.L.C. (US, dsar@openai.com) — audio and summary text / transcription and image generation / HTTPS API call when you use the feature / deleted after processing, not used for training · Deepgram, Inc. (US, privacy@deepgram.com) — audio / live transcription / HTTPS stream while recording / deleted after processing, not used for training · Google LLC (US, dpo-google@google.com) — email and summary text / sign-in, image generation, and (if connected) Gmail, Calendar, Drive / HTTPS API call when you use the feature / deleted after processing · Vercel Inc. (US, privacy@vercel.com) — access logs and request data / web hosting / when you use the web app / up to 30 days · Resend (US, support@resend.com) — email address and name / sending you email / when we send an email / for as long as the delivery record is kept · PostHog, Inc. (US, privacy@posthog.com) — anonymised usage logs / product analytics / while you use the app / 12 months · Functional Software, Inc. (US, compliance@sentry.io) — error logs and device info / diagnosing errors / when an error occurs / 90 days [Refusing the transfer] Write to hello@joshua.site if you do not want your data transferred abroad. These transfers are required to transcribe and summarise — the core of the product — so refusing means you cannot use those features, and you may ask us to delete your account instead. Deletion of data already processed follows sections 8 and 9.
6. Google Integration Data (optional)
Every Google integration is optional — Micky works fully without connecting any of them. We request the minimum scope a feature needs, and only at the moment you turn that feature on. · gmail.send — sends a follow-up email drafted from your meeting summary. Only a message you have reviewed and clicked Send on is sent. Micky does not read your mailbox. · calendar.events — shows your upcoming meetings, and creates only the follow-up events you confirm. · drive.file — saves a meeting note you explicitly export to your own Drive. Micky cannot access any file it did not create. · Google data is never used for advertising or sold, and is never used to train AI models. · No human reads this data, except (a) with your explicit consent, (b) for security or legal compliance, or (c) in aggregated/anonymized form. · You can disconnect any integration at any time in Settings. Micky's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. Generative AI (AI Framework Act Art. 31)
Micky runs on generative AI. Summaries, notes, mindmaps, summary images, decks, reports and email drafts are all AI-generated and can be wrong — check the original meeting before you act on anything that matters. Anything you export carries a note that it was AI-generated.
8. Right to Delete
Each note and email-knowledge item can be deleted immediately — local audio and cloud copies are removed irrecoverably. Full account deletion requests to hello@joshua.site are processed within 7 days.
9. Retention
Until you delete it. Inactive accounts are cleaned up 12 months after a notice email.
10. Data Protection Officer (PIPA Art. 30, 31)
For questions, complaints or redress about how we handle personal data, contact us — we answer without delay. · Data Protection Officer: Jaeho Jung (Head of Product) · Contact: jhjung@joshua.site You may also contact the Korean authorities: · Privacy Infringement Report Centre (privacy.kisa.or.kr / 118) · Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
11. Changes
Material changes are announced in-app and by email before they take effect. A new sub-processor or transfer destination is announced at least 30 days in advance.