Gappd privacy policy

1. Who operates Gappd

Gappd is operated by Kristian Gosvig. Send questions and privacy requests to leasemobil@gmail.com.

2. Data processed on your Mac

When you choose to record a meeting, Gappd can process microphone audio, system audio, transcript text, speaker information, meeting titles, summaries, decisions, and action items. If you turn on Screen video, it also records the window or display that you choose. It also stores app settings and local model configuration.

The default Local AI provider processes transcript text on your Mac. Meeting content and settings are stored in local app files and a local SQLite database. Meeting notes are optional; without a notes provider, Gappd makes transcripts only.

3. Optional Installed agent providers

If you choose an Installed agent (Codex, Claude Code, or Pi) to make Meeting notes, Gappd runs that command-line tool on your Mac with the account that you already signed in to. Gappd sends it the Meeting transcript text, with each line marked by a generic speaker label such as “You” or “Speaker 1”. Gappd never sends it the names of People, even when you have named a speaker, and never sends Google Calendar or Google Contacts data. (Versions before 0.1.28 sent the speaker names shown in the transcript.) Codex sends this text to OpenAI, Claude Code sends it to Anthropic, and Pi sends it to the model provider that you selected in Pi, which can include a provider added by your Pi extensions. Recorded audio and Screen video stay on your Mac.

Gappd runs the agent without tools, in an empty folder, with a minimal environment. The provider’s account tier, retention, and training controls depend on your agreement with that provider and its settings; Gappd does not control them. Check that provider’s data controls before you send sensitive Meeting content. Local AI does not send transcript text to a model provider.

Local AI runs an open-weight model entirely on your Mac. Its input and output never leave your Mac and are never shared with the model’s publisher. It gets the same transcript text with generic speaker labels.

4. macOS permissions

Gappd requests microphone, screen and system audio recording, and speech recognition permissions for recording and transcription. You can revoke these permissions in macOS System Settings at any time.

5. Network connections

Gappd can use the network to check for and download app updates, download local model files, open support links, run an Installed agent that you choose for Meeting notes, and upload Meeting text when you turn on Cloud sync. Calendar-enabled versions connect to Google only after you choose to connect an account. Versions released before 6 October 2026 contacted Gappd’s authorization relay for that connection. The relay was shut down on 20 October 2026, so those versions must be updated to keep using Google Calendar. The app does not include advertising or behavioral analytics. The website sets no cookies and loads no analytics, advertising, or other third-party scripts or fonts.

Gappd advertises the website with Google Ads. When you arrive from a Google ad, the page address includes a Google ad click identifier (gclid, gbraid, or wbraid). If you then click a download button, the page passes that identifier to Gappd’s web server, which sends it with the download time to Google Ads so Gappd can count the download as an ad conversion. Google Ads matches it to the ad click. The web server does not store the identifier and does not send your IP address, browser details, or any meeting content with it, and the website does not keep the identifier in cookies or browser storage. Downloads that do not start from a Google ad are not sent to Google Ads.

Gappd’s web server also counts page views and download clicks, without a script or cookies. For each one it records the time, the page, the name of the website that linked to it, campaign tags in the page address (such as utm_source), whether the visit started from a Google ad, your operating system (for example, macOS), and a visitor ID. The visitor ID is calculated from your IP address and browser details together with a random value that changes every day and is never stored, so it cannot be linked to you or across days. Your IP address and full browser details are not stored. Known bots are not counted. These records are kept in a database hosted by Railway.

6. Optional Google Calendar and Google Contacts

When you choose to connect a Google Calendar connection, Gappd opens Google in your system browser. It requests https://www.googleapis.com/auth/calendar.events.owned.readonly and reads only the connected account’s primary calendar. This permission reads event details but cannot edit or delete events. Availability-only access cannot supply the event titles, times, and invitees needed for these features. Calendar access never starts a recording.

Gappd processes the connected account identifier and email plus event identifiers, titles, start and end times, all-day status, event status, location, organizer, and invitee details. It shows your schedule, suggests Calendar events that overlap a Meeting, and suggests invitees when you label speakers. A suggestion never confirms attendance or identifies a speaker.

When you add Contacts access to a connected Google account, Gappd also requests https://www.googleapis.com/auth/contacts.readonly. When you click Import Google contacts on the People page, Gappd reads the primary name and email of each saved contact that has an email, and saves the contacts that are not already People in the local database on your Mac. It reads no other contact fields and does not read “Other contacts”. It never creates, changes, or deletes Google contacts. Imported People let you name speakers and match Calendar invitees.

Google authorization tokens and cached Calendar data are encrypted and stored in Gappd’s local app data on your Mac. They are not exposed to the renderer. The static website service does not receive Google tokens, Calendar data, or meeting content.

Gappd exchanges and refreshes Google authorization tokens directly between your Mac and Google. No Gappd server receives Google tokens or Calendar data. Versions released before 6 October 2026 used a separate authorization relay hosted by Railway to add Gappd’s Google credential during token exchange and refresh. Authorization codes, PKCE verifiers, and Google tokens passed through that relay transiently and were not stored there. Its private Redis state held only installation public keys, revocation state, expiring replay protection, and rate counters. Gappd shut down the relay on 20 October 2026 and deleted its service and its copy of Gappd’s Google credential; its Redis storage is permanently deleted by 22 October 2026.

Gappd does not sell Google data, use it for advertising, or use it to train its own models. Google user data is never sent to an AI model provider and is never used to create, train, or improve AI or machine-learning models, by Gappd or by a service that Gappd sends data to. If you name a speaker with a Calendar invitee or an imported contact, Gappd shows that name only on your Mac. In all text that it sends to an Installed agent or to Gappd Cloud, Gappd uses the generic speaker label (“You”, “Speaker 1”) instead. A Meeting that is still named after its Calendar event is uploaded with a generic title, such as “Meeting · Mon 9:08 AM”. Gappd never sends Calendar event data or Google Contacts data to an Installed agent or to Gappd Cloud. Gappd’s use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements.

7. Sharing and sale

Gappd does not sell meeting or Google user data or use it for advertising. It does not share Meeting content with the operator in the default local configuration. Google authorization tokens go directly between your Mac and Google. The relay used by earlier versions, shut down on 20 October 2026, handled credentials transiently and did not receive event content. When you separately enable Cloud sync and give upload consent, Gappd sends Meeting text (title, summary, generic speaker labels, and transcript turns; not People names, audio, Screen video, or Google data) to Gappd Cloud on Railway. Authorized AI clients you connect can read those cloud copies. Cloud copies uploaded by Gappd versions before 0.1.28 can contain speaker names until they are replaced or expire after 30 days. Meeting transcript text reaches a remote AI provider only when you choose an Installed agent for Meeting notes. Ad click identifiers and download times from visits that start with a Google ad go to Google Ads, as described in section 5. Data is otherwise disclosed only when required by law.

8. Retention and deletion

Local meeting data remains on your Mac until you delete the meeting or remove the app data. Deleting a meeting in Gappd removes its local summary, transcript, segments, speaker labels, audio files, and managed Screen video. If the meeting was synced, Gappd also asks Gappd Cloud to delete its cloud copy; while you are offline or not signed in, that request waits on your Mac. A video that you exported stays where you saved it. Copies in device backups are controlled by your backup provider and settings.

Google tokens, account details, and cached events remain encrypted on your Mac. Disconnecting an account attempts to revoke its Google authorization and removes that account’s tokens and Calendar cache; it does not delete recorded Meetings or People already imported from Google Contacts. Imported People stay in the local database on your Mac until you remove Gappd’s app data. Cloud Meeting copies expire after 30 days; turning Cloud sync off stops local uploads but does not itself delete an existing cloud copy. You can request separate deletion of a cloud copy or account data. The relay’s records for earlier versions (installation public keys, replay protection, and rate counters) are deleted with its storage by 22 October 2026.

Page view and download records are deleted after 13 months. The web server does not store ad click identifiers; if a send to Google Ads fails, it tries again for about an hour and then discards the identifier. Conversions in Google Ads are kept under Google’s own retention terms.

9. Security and data protection

Gappd protects Google user data and Meeting data with these measures:

• Least access. Gappd requests only read-only Google permissions. It reads only the primary calendar of the connected account, and only the name and email of saved Google contacts. It cannot change or delete Google data.
• Encryption in transit. Gappd connects to Google, Gappd Cloud, and its update and model download servers only over HTTPS (TLS). Google sign-in uses PKCE and a one-time loopback address on your Mac.
• Encryption at rest. Google authorization tokens, cached Calendar events, and saved Calendar links are encrypted with macOS secure storage (a key protected by your macOS Keychain). If secure storage is unavailable, Gappd does not save them; there is no plaintext fallback.
• Local access control. Meetings, transcripts, and imported People are stored in Gappd’s data folder on your Mac, which only your macOS user account can read. We recommend that you turn on FileVault to encrypt your whole disk.
• Process isolation. Google tokens stay in Gappd’s main process and are never exposed to the app’s window. An Installed agent runs without tools, in an empty folder, with a minimal environment, and gets only transcript text with generic speaker labels.
• No server access. No Gappd server receives Google tokens, Calendar data, or Contacts data, and the operator has no access to them.
• Cloud isolation. Gappd Cloud accepts only HTTPS requests with a valid sign-in token. Database row-level security returns each Meeting copy only to its owner. AI clients get read-only access. Cloud logs never contain tokens or Meeting text.

You are responsible for protecting access to your Mac, local backups, and any optional provider account. Report a security problem to leasemobil@gmail.com.

10. Your choices and requests

You can stop recording, delete meetings, disconnect a Google account, revoke Gappd in your Google Account permissions, change or turn off the Meeting notes provider, turn off Cloud sync, revoke macOS permissions, or uninstall Gappd. To download without ad conversion measurement, open getgappd.com directly instead of through an ad, or download from GitHub Releases. Contact leasemobil@gmail.com with privacy questions or requests.

11. Children

Gappd is a professional productivity tool and is not directed to children under 13.

12. Changes to this policy

This policy will be updated when Gappd’s data practices change. The effective date identifies the current version. Material changes will be disclosed before new data use begins.