Privacy Policy

Recap is a meeting-notes service operated by the 3P team at app.recapth.com. Anyone can create an account with an email and password or with a Google account; a new account gets its own personal team on the free plan. Company teams are set up by 3P, and their owners and admins add members.

Using Recap is also governed by our Terms of Service.

• Google account: if you sign in with Google, the email, name and profile picture Google provides at sign-in (openid email profile), used to identify you in the app.
• Email account: if you sign up with an email, your email address, your name and a password. The password is stored only as a one-way hash, never in plain text, and the email is verified before the account can be used.
• Google Calendar: if you connect your calendar, Recap reads your calendar list and the events of your primary calendar, and creates, edits or deletes events when you ask it to. Events are shown live from Google and are not stored, except meetings created in Recap or whose title starts with your team’s prefix (default [Recap]); of those only the title, times and Google Meet link are kept. The Google refresh token is encrypted at rest and deleted when you disconnect.
• Meeting audio: audio comes from the note-taking bot or from audio files a member uploads. When a member switches the bot on, a bot named “Recap Notetaker by 3P” joins that Google Meet and records audio only; participants see the bot in the participant list and the host must admit it. Audio is stored in that team’s space only.
• Meeting participants: for meetings the bot joins, Recap keeps the display names of the participants, when each joined and left, and when each spoke. Recap also keeps, for every team, the meeting chat, the transcript made from Google Meet’s captions, and the bot’s timeline and logs for that meeting. This data is kept with the meeting’s audio and deleted together with it, under the retention rules below. Only team owners and admins can see the list of participants in the app.
• Sign-in security data: to protect accounts we record sign-in attempts with the IP address and device and browser details. We use them to limit repeated failed attempts and, for email accounts, to ask you to confirm a sign-in from a new browser or a new network with a code sent by email (Google runs its own checks for accounts that sign in with Google). A new network means a new IP range: a different IPv4 /24 (the first 24 bits of the address) or IPv6 /64. These sign-in security records are kept for 90 days.
• Usage data: projects, board cards, to-dos and the server logs needed to run and secure the service.

To provide what you ask for: showing your calendar, sending the bot, keeping your team’s recordings and recaps for as long as the rules below say, and keeping the service secure. We do not sell data or show ads.

Improving Recap: meeting audio and corrected transcripts are used to train and improve Recap’s own transcription and meeting-summary models only for teams whose owner turns this on; it is off by default, and the bot tells participants when it is on. Only authorised 3P staff can access this data; we do not sell it or let third parties train their models on it. If a team turns this off, is deleted or asks us, its data is removed from the training data; models already trained are not retrained, and later training excludes it. Data obtained through Google APIs (your Google account and Google Calendar) is never used to develop, improve or train any AI or machine-learning model.

Recap’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google user data is used only for user-facing features of the app, is not transferred to third parties except as needed to provide the service, is not used for advertising, and is not read by humans unless you consent, it is needed for security, or the law requires it.

Data lives in a PostgreSQL database (Supabase) and object storage (Cloudflare R2) over encrypted connections; the application servers are in Thailand behind Cloudflare. The recording bot runs on Attendee software we host ourselves. Account emails (verification, sign-in codes, password reset and invitations) are sent through Resend. The sign-up page and the “forgot password” page use Cloudflare Turnstile to tell people from bots; Cloudflare sees your IP address and browser signals there, and the page that sets a new password loads no third-party script. Each team’s data is separated from other teams’.

• Encryption in transit: every connection (browser to app, app to database, app to file storage, app to Google) uses TLS, and the database connection verifies the server certificate (verify-full).
• Encryption at rest: Google refresh tokens are encrypted with AES-256-GCM before they are stored, under a key kept outside the database. The database (Supabase) and file storage (Cloudflare R2) also encrypt all data at rest.
• Least privilege: the app connects to the database with a restricted role that cannot change the schema or manage database users. Every row belongs to a team, and every request is checked against the signed-in user’s team and role.
• Sessions: sign-in uses a random opaque token in an HttpOnly, Secure, SameSite cookie. Sessions expire after 30 days of inactivity and after 90 days at most, and are revoked immediately on sign-out.
• Passwords and sign-in: passwords are hashed with a slow one-way algorithm. Failed sign-ins are limited per email and per IP address, with a temporary lock-out. For email accounts, a sign-in from a new browser or a new network (IP range) must be confirmed with a code sent by email; Google accounts rely on Google’s own checks. A password is reset through an emailed link that expires.
• Files: recordings are never public. Downloads use signed links that expire after 15 minutes and are issued only to members allowed to see that meeting.
• Internal access: the operator console sits behind a separate login (Cloudflare Access) and shows metadata only, never meeting audio, transcripts or calendar contents. Every console action is written to an append-only audit log. Secrets are kept in a secrets manager (Infisical), not in code.
• Integrity: messages from the recording bot are verified with an HMAC signature before they are accepted.
• Incidents: if we learn of a breach affecting your data, we notify the affected users and the authorities as Thailand’s Personal Data Protection Act (PDPA) requires.

Audio and transcripts are kept for the retention period of your team’s plan; when that period ends they are deleted, and purged for good within 30 days. Summaries, reports, the board and your team’s knowledge are kept for the life of your team unless you delete them. Anything you delete is purged for good after 30 days (database rows and files). When a team is deleted, all its data is purged after 30 days. Unfinished uploads are deleted after 72 hours. You can disconnect Google Calendar at any time on the settings page or revoke access at myaccount.google.com/permissions. To delete your account and all its data, contact us below.