Privacy & retention

This page is the technical inventory. The legal privacy policy for the app and this website is at /privacy.

Abschrift's privacy model is architectural, not a policy promise. There is no Abschrift server to send anything to. This page is the complete inventory of what exists, where, and for how long.

What is stored, and where

• Notes & transcripts — Markdown files under ~/Abschrift/meetings/. Yours, readable in any editor.
• Voice fingerprints — compact numeric descriptions of a voice, not audio, in ~/Abschrift/speakers.sqlite. They power cross-meeting speaker recognition.
• Search index — ~/Abschrift/index.sqlite, a local index over your Markdown. It is never the only copy of anything.
• Raw audio — inside meetings/<id>/audio/, deleted right after successful processing by default. Opt in to keep recordings ("Keep each recording" in onboarding, "Keep recordings after processing" in Settings), and they power segment replay until the transcript's deletion date, then go with it. Audio never leaves the folder.
• Speech models — ~/Abschrift/models/, downloaded once from the public model repository, then used offline.

What can leave your Mac

• Never: audio, voice fingerprints, or your files. There is no telemetry, crash reporting, or analytics.
• Only if you configure a cloud notes provider: the meeting's transcript text. It goes directly from your Mac to your chosen provider, with your key. During import, the same provider can receive a short sample (at most the first 60 lines) to detect an unrecognized transcript format — only after you confirm the import. Each meeting records any egress in its frontmatter ("notes via anthropic") and shows the amber badge in the app.
• Local-only mode (Settings) makes cloud egress impossible at the provider layer. The block is enforced in code, not only in the UI.
• Update checks fetch a version manifest from the public releases repo. They carry no meeting data. You can turn them off in Settings.
• Pro license activation sends your license key plus an anonymous machine fingerprint to Polar. The fingerprint is a hash, never the hardware ID. This enforces the 3-Mac limit.

Retention — forgetting on schedule

• Transcripts auto-delete after a configurable number of days (default 30). Notes are kept indefinitely.
• Whole meetings can expire too, with "delete entire meetings after N days". The folder, notes, index, and app-created export copies are then deleted.
• The sweep runs on launch and periodically. It never touches meetings currently recording or processing.

The fine print

• The deletion date is fixed when a meeting is transcribed. It is written into the transcript file's own YAML frontmatter, and that stamp is what the sweep honors. Changing the retention setting applies to meetings transcribed afterwards. Retrying a meeting or generating notes later never moves an existing deletion date.
• Imported meetings (import) get their deletion date stamped at import time. The copy of the original file kept with the meeting is deleted together with the transcript. The file you dropped stays untouched wherever it lives.
• Re-transcribing a meeting (⋯ menu, when its audio was kept) replaces the transcript and notes. The deletion date restarts, counted from the re-transcription.
• Auto-export copies notes only (Pro). Transcripts and audio never leave the vault via export. Exported copies live outside the retention schedule's reach — but if the whole meeting expires, app-created export copies are removed with it.
• Failed processing is not a loophole: the sweep deletes the raw audio of meetings whose processing failed for good, after the same window as transcripts.

Deleting on demand — Clean and Purge

Settings → Maintenance offers two immediate, irreversible actions. Each requires a typed confirmation: type the word, and the button unlocks.

• Clean deletes the audio, transcript, and imported original files of every meeting right now. That's what the retention schedule would do eventually. Notes and speaker profiles stay.
• Purge deletes everything: all meetings including notes, every speaker profile and voice fingerprint, and the search index. Settings, your license, and the downloaded models stay.

Deleting everything

Quit Abschrift and delete ~/Abschrift plus the app. That's the entire footprint, aside from standard macOS permission records. There is no account to close, because there is no account.