Privacy

While a call is running, audio from your microphone and from your computer’s own output is streamed to a speech-to-text provider and transcribed. The audio is discarded as soon as the text comes back. No recording is written to disk, on your machine or on ours, and there is no setting that turns recording on.

The transcript of a call, the answers produced during it and the debrief afterwards are stored on your computer, in MoPilot’s application-support folder. Keep transcripts, in Settings › General › Your data, controls how long they are kept; expired calls are deleted the next time the app launches.

A copy is also kept on your account, so that a call can be restored on another Mac. Back up calls, directly under Keep transcripts in the same group, turns that off; it is on unless you turn it off. What is copied is the transcript, the answers, the note and any material you added to the call — never the audio, which is transcribed and discarded and is never written down anywhere. Your Keep transcripts setting applies to that copy too: it is sent with the backup, and a call past its window is deleted from our side whether or not the Mac it came from is ever opened again. You can also delete a single call from the app.

We use those copies to restore a machine, to keep a record of what the product was asked and answered, and to measure how well it did it — which means people who work here can read them. They are not used to train models. If that is more than you want, the switch above is the answer, and the app works exactly the same with it off.

None of this is the same as saying the text never went anywhere else. It came back from the speech-to-text provider that produced it, and while a call is running the most recent lines are sent with each question as the context for answering it. What that leaves on our servers, and for how long, is the section below.

A write-up can be published at a link from the app’s own menu. What travels to that LINK is the write-up and the notes you typed beside it — never the transcript, never the answers given during the call, and never a screenshot. The route that receives it has nowhere to put those, which is a property of the route and not a promise about the rest of the product: the backup described above is a separate copy, on your account rather than at a link, and anybody holding a shared link sees none of it.

The link is unguessable and is not indexed by search engines, but anyone holding it can open the page: treat it like any other link you send. Someone who is not signed in sees the title and the first section; the rest, and your own typed notes, need an account. Unsharing takes the page down — the link then says the note was taken back rather than pretending it never existed.

Answering is a server-side proxy — the provider keys are ours and never leave our servers, which is what lets the app work without you holding an API key. We keep operational metadata such as the model, timing, byte and token counts so that billing, abuse and reliability can be investigated. It does not contain the words or pixels you sent.

Separately, you may explicitly consent in Account settings to a versioned, optional diagnostic record containing:

• the question as sent, and the conversation turns sent with it as context;
• the answer as returned;
• which model answered, how long it took and how many tokens it cost;
• any screenshot attached to the question, stored privately and served only through an access-controlled route — never from a URL that works on its own.

Sensitive diagnostic content is encrypted and kept for no more than 30 days. Only authorised staff who have recently reauthenticated can reveal it, and every reveal writes an immutable access record. Emergency server switches can stop text or screenshot capture independently without changing your choice.

Consent is optional and declining it does not stop normal use. Withdrawing it stops new sensitive capture immediately and schedules existing text and pixels for scrubbing while retaining non-sensitive operational metadata. Deleting your account removes all account-bound diagnostic content and its private screenshot objects.

Thirty days is this record’s window and not the backup’s. A call copied to your account is kept for as long as your own Keep transcripts setting says, which is forever unless you change it. They are two separate stores with two separate schedules, and deleting an account removes both.

The context sent with a question is what you gave the app: the material on the session, the recent transcript of the call in progress and, where you asked for it, a capture of your screen. It is not read from anywhere else on your computer.

To sign in we store your email address and, if you use a password, a hash of it — never the password itself. Signing in with Google stores the Google account identifier and the email it reports, nothing further. We also keep the plan you are on, the devices you have linked, and counters for how much note taking and AI assist you have used, which is what the meters in the app are reading.

Connecting a calendar is optional and off until you ask for it. If you connect Google Calendar we request one permission, View events on all your calendars (calendar.events.readonly) — read-only. MoPilot cannot create, edit, move or delete anything on your calendar, and does not ask to. Microsoft calendars use the equivalent read-only permission.

We do not store your events. Your agenda is fetched from the provider at the moment the app asks for it, passed straight through, and never written to our database or cached. What we do keep is the connection itself: an encrypted refresh token, the permissions the provider says it actually granted, and the address of the connected account so the app can show you which calendar is attached. From each event the app reads the title, the start and end time, the organiser’s name, how many people are invited — a count, never the guest list — and the meeting link, so the agenda can show the call and join it.

If you start a call from an agenda row, that event’s title becomes the name of the session, and a session’s name is part of the context sent to the model that answers your questions — as described above. No other calendar information is sent to a model provider. Calendar data is never used to train or improve any model, generalised or otherwise, is never sold, never transferred for advertising, and is never used for any purpose other than showing you your agenda inside the app.

MoPilot’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time from Settings › Calendar. Disconnecting revokes the grant with Google first and deletes our copy of the token second — in that order, so a revocation that fails leaves the connection visible for you to try again rather than leaving us holding a token you can no longer see. You can also revoke it from your Google account’s permissions page.

MoPilot answers your questions with a large language model, reads a screenshot with a vision model, and turns speech into text with a speech-to-text model. Today the answering and vision models are Microsoft Azure OpenAI Service, running in our own Azure subscription, and speech-to-text is Deepgram Nova-3, reached through the OpenRouter gateway. If we change providers, this paragraph changes with them.

Nothing we send is used to train a model. Azure OpenAI is used under terms that do not permit Microsoft to use what we send it to train or improve any model, our OpenRouter account has model training and prompt logging turned off, and we do not train models of our own on your calls, transcripts, screenshots or calendar.

Data received from Google Workspace APIs barely reaches a model at all. The only Workspace information that can is a calendar event’s title, and only when you start a call from an agenda row so that the title becomes the name of the session — the session name travels with the question, as described under Calendar above. Nothing else from your calendar is sent to a model provider, and no Workspace data — raw, aggregated, anonymised or derived — is transferred to any third party for the purpose of creating, training or improving foundational or generalised artificial-intelligence or machine-learning models.

MoPilot’s use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Subscriptions are handled by Stripe. Card numbers are entered on Stripe’s own pages and are never sent to, or stored by, us. We keep the Stripe customer and subscription identifiers, the plan, and the dates the period runs between.

If the app crashes it can send a report containing the stack of the crash, the version and the platform. It carries no transcript, no answer and no screenshot. The toggle is in Settings › General › Your data, beside the retention row above, and turning it off stops the reports at source.

The site uses Google Analytics to count visits. Pages that carry a secret in their URL — a password reset link, a device-link challenge — have those values stripped before anything is reported, so the token never reaches the analytics endpoint. The site sets one cookie of its own to remember the language you chose, and a session cookie once you sign in.

The processors we rely on, and what each one sees: Vercel (hosting, and the private store the screenshots above live in), Neon (the database), Stripe (payments), Resend (transactional email), Google (sign-in, analytics and, if you connect one, Google Calendar), Microsoft (Azure OpenAI, which answers your questions and reads your screenshots; and, if you connect an Outlook calendar, the calendar itself), OpenRouter (the gateway your audio reaches speech-to-text through) and Deepgram (the speech-to-text model itself). The two model providers are the ones configured today; AI and machine learning above says what they may and may not do with what they receive. We do not sell personal information, and we do not use your calls to train models.

You can ask for a copy of what we hold about you, ask for it to be corrected, or ask for your account and its data to be deleted. Write to support@mopilot.ai and we will act within 30 days. Deleting your account removes the account record, the usage counters, the linked devices, the request records described above and every call backed up to your account; the copy on your own computer is yours to delete from it, and deleting the app removes it.

MoPilot listens to calls you are on. Whether you may transcribe a conversation without telling the other participants depends on where you and they are, and in a number of places consent from everyone is required. That obligation is yours, not ours, and the fact that the other people on the call may never see MoPilot does not change it.