Privacy Policy

Published by Flowwi (legal notice) · contact: tristan@flowwi.fr · last updated: 28 October 2026

Keeti is a macOS application built around one rule: the audio of your meetings never leaves your Mac. Recordings, transcripts and meeting notes stay on your Mac. To write the notes, only the text of the transcript goes out: through our relay if you use a Keeti account, or straight to your AI provider if you use your own key. Our relay passes that text on and keeps none of it. This page says exactly what is processed, where, and what we store.

What Keeti handles, and where

Your Keeti account and the relay

The Free and Pro plans and the Licence use a Keeti account. You sign in with your email address, confirmed by a code, or with Google. On a Mac managed by an organisation, that organisation may configure Keeti without a Keeti account.

What our relay stores

• Your email address, which identifies your account and receives your sign-in codes.
• Your organisation (for one person, it is created from your email address): its plan, its monthly allowance and, if you subscribe, the Stripe customer and subscription identifiers and the status of the subscription.
• Your signed-in Macs: for each, a random installation identifier (derived from nothing about your hardware or your identity), a hashed secret, and whether it was signed out.
• A usage record for each note written through the relay: date, AI model, amount of text processed (tokens), cost, duration and result. It is what counts your monthly allowance. It contains no text.
• Sign-in codes, stored hashed, valid for 10 minutes and deleted once used. Expired codes are removed afterwards.
• Billing event identifiers received from Stripe, without their content, kept 30 days.
• If you buy a Licence: the purchase record (email address and amount) and the signed licence document.

What the relay does not store

The text of your transcripts and the notes written from it pass through the relay in memory: they are not written to a database, a file or a log. When a note is written successfully, the relay logs nothing about it beyond the usage record above. It never receives any audio.

How long, and where

• Account data is kept for as long as your account exists. To delete your account, write to tristan@flowwi.fr: we delete your organisation, its Macs and its usage records.
• You can sign a Mac out at any time from Keeti's settings.
• The relay and its database run on a server we administer, hosted in France.

Who else processes what

Each of these services handles the data under its own policy, which we encourage you to read. Link is the merchant of record for purchases: it handles your payment and your receipt as a seller in its own right.

What leaves your Mac only if you turn it on

1. Outgoing webhook: if you configure one, the notes and action items are sent to the URL you provide, over HTTPS, signed with HMAC if you set a secret. The destination is your choice.
2. AI assistants over MCP: Keeti's MCP server runs locally and exposes nothing on the network. If you connect it to the Claude app or Claude Code, the meetings Claude reads to answer you are sent to Anthropic under your own Claude account, when you ask.
3. Google account connection: read-only, directly between your Mac and Google (section below).

Usage measurement (telemetry)

Since version 1.9, Keeti sends us anonymous usage events, so that we can see where the product fails people: how many installations reach their first meeting notes, where the others stop, which errors happen, on what kind of machine. This is how the product gets better, and this section says exactly what it carries.

What is sent

• A random installation identifier: a number drawn at install time, derived from nothing (not your hardware, not your account, not your name), replaced by a new one after 13 months. It is separate from the identifier your Keeti account uses.
• Categories and counts, never text: app and macOS version, Mac model (for example “Mac14,12”), onboarding steps reached, number of recordings, meeting duration ranges and speaker counts, whether a recording was a video call, how many dictations, how each one ended (pasted, cancelled, nothing heard…), their length and delay ranges and the kind of app you dictate into (mail, chat, browser…), error categories, which features are enabled, how the notes are written (Keeti account, own key or company configuration), and crash summaries reduced to numbers.

The measurement is on by default and there is no in-app switch. That is the deal this page makes explicit: we count precisely because the format above cannot carry anything about you.

What is never sent, by construction

No meeting title, no attendee name or email address, no transcript, no notes, no audio, no file name, no dictated text, never the name of the app you dictate into, no API key, no webhook address, and neither an account identifier nor an email address. This is not a promise held by a filter: the event format has no free-text field, and our server rejects any message that does not match that closed format. These measurements are never linked to your Keeti account.

Where it goes, and how long it stays

• To a server we run, hosted in France. No analytics company, no third-party SDK, no advertising network is involved, and nothing is ever shared or resold.
• Events are deleted after 25 months; only aggregate statistics remain. Your IP address is neither stored nor logged by that service.
• On a company-managed Mac, your IT can disable the measurement entirely with the ManagedTelemetryEnabled configuration key.

This design follows the French regulator's (CNIL) framework for consent-exempt audience measurement: strictly anonymous statistics, produced for the publisher's sole use.

Google user data

Connecting a Google account is optional and Keeti works without it. There are two distinct uses.

Signing in to Keeti with Google

If you choose Continue with Google to open your Keeti account, Keeti asks Google only for your identity (openid and your email address). Google gives the app a signed token, which our relay verifies. The relay keeps only your verified email address, exactly as if you had signed in with an email code. Nothing else from your Google account is read or stored for sign-in.

Preparing meetings from your calendar

If you connect your calendar, every permission Keeti requests is read-only, each one can be declined on its own at the consent screen, and the access happens directly between your Mac and Google (OAuth 2.0 with PKCE, loopback on 127.0.0.1). No Keeti server is involved in reading your calendar or your contacts.

What we access, and why

How we use it

• The three lookup scopes do one single job: turning an email address into a name. Keeti queries one address at a time, at the moment a meeting arrives with an attendee it cannot name.
• Keeti never exports your address book, never synchronises your contacts, and never enumerates your organisation's directory.
• A result is kept only if one of the person's email addresses matches exactly the one asked for. A near match is discarded: a missing name is better than the wrong one.
• Decline all three and Keeti keeps the email address as it is, with no error and no repeated prompt.
• Google data is used only to provide the features described here. It is never used for advertising, never sold, never shared with a data broker, and never used to train or improve any machine learning or artificial intelligence model.
• The content of your events is not sent to the AI provider. Only the names and email addresses of the attendees you confirmed may be included in the text sent for writing, so that the notes attribute what was said to the right person.

How we protect it

• Calendar and contact data never reach infrastructure we operate. They are read on your Mac and written only into your own meeting files. The only Google data our relay ever receives is the verified email address of Continue with Google.
• Encryption in transit. Every call to a Google API, and to our relay, is made over HTTPS (TLS). The calendar authorisation flow uses OAuth 2.0 with PKCE on a local loopback address, so the authorisation code cannot be intercepted by another application.
• Encryption at rest. The Google refresh token is stored in the macOS Keychain, encrypted by the operating system and protected by the user's session. It is never written to a plain file, never logged, and never leaves the device.
• Access control. Data read from Google is held in the app's memory for the duration of the lookup, and any name kept afterwards is written into your own meeting files, under your macOS user account, protected by the system's file permissions and by full-disk encryption if you have FileVault enabled.
• Data minimisation. Keeti requests the narrowest scopes that make the features work, all of them read-only. It cannot create, modify or delete anything in your Google account.
• No content in logs. The application's diagnostic logs record counters only, for example how many addresses were looked up and how many resolved. They never contain an email address, a name, or any event content.
• Signed, notarised distribution. Keeti is distributed signed with an Apple Developer ID and notarised by Apple, and its updates are signed with EdDSA, so a tampered build cannot be installed in its place.

Retention and deletion

• Keeti keeps no copy of your calendar or contact data. What persists is only what ends up in your own meeting files: the meeting title, and the names and email addresses of the attendees. Those files are yours, on your disk, and you can delete them at any time.
• Disconnecting deletes the token. In Settings, Integrations, Google, choose Disconnect: Keeti deletes the refresh token from the Keychain and forgets the set of permissions you had granted. Nothing further can be read from your Google account.
• You can also revoke access on Google's side at any time, from myaccount.google.com/permissions.
• The email address kept by Continue with Google is part of your Keeti account, and is deleted with it.

Limited Use

Keeti's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: Google data is used only to provide the features described above, is not used for advertising, is not sold, and is not accessible to any human being, unless you explicitly consent to share it as part of a support request.

Voiceprints

Keeti can learn your voice in order to recognise you from one meeting to the next and attribute what was said correctly. A voiceprint is biometric data under Article 9 of the GDPR: it gets heightened protection.

• Enrolment is voluntary. Keeti works without it. You start it yourself, by reading a few sentences.
• Voiceprints stay on your Mac, in an encrypted store (AES-GCM) kept in the application's support folder. They are never transmitted, not to Flowwi, not to our relay, not to the AI provider, not to anyone.
• A voiceprint is not a recording: it is a numerical vector from which neither the voice nor the content of what was said can be reconstructed.
• Third parties are not enrolled by default. Remembering other attendees' voices is an option that ships turned off. If you turn it on, it is on you to obtain their explicit consent: without it, that processing is unlawful.
• “Forget everything” really deletes the voiceprints from disk, at any time, from the settings.

Legal framework

• Your meetings: the data controller is you, or your organisation. You decide what to record, who appears in the notes, and how the notes get written. When a note is written through your Keeti account, Flowwi passes the text to Anthropic on your behalf, for that purpose only.
• Your Keeti account, usage records, purchases, the usage measurement and the site: the data controller is Flowwi (identified in the legal notice). The legal basis is the performance of our contract with you for the account and purchases, and our legitimate interest for the anonymous usage measurement.
• Your rights (access, rectification, erasure, portability, objection): for your Keeti account, write to tristan@flowwi.fr. For your meeting files, which are on your Mac, you exercise them directly. The usage measurement cannot be linked back to you, by design, so there is no individual record we could retrieve or erase (GDPR art. 11). For data processed by Google, Link, Stripe or an AI provider you use with your own key, you can also address them directly.
• Complaints: you can lodge a complaint with the French supervisory authority, the CNIL.
• Transfers outside the EU: our relay, its database and the usage measurement are in France, and sign-in emails leave from Resend's European region. When a note is written through your Keeti account, the text is transferred to Anthropic, which is established in the United States. If you use your own key with a provider established outside the European Union, that transfer follows from your choice and from your contract with them. Payments are handled by Link and Stripe under their own safeguards.

Security

In summary: secrets and tokens on your Mac stored in the macOS Keychain · network calls over HTTPS · Google calendar access over PKCE with a local loopback · sign-in codes and device secrets stored hashed on our relay, with short-lived access tokens · webhooks signed with HMAC · voiceprints encrypted with AES-GCM · updates signed with EdDSA. Keeti is distributed signed with an Apple Developer ID and notarised by Apple. Our relay holds no meeting content, so there is no central store of meetings to protect.

This site

Everything above describes the application and its relay. The site you are reading does not track you: no cookies, no analytics, no trackers. Fonts are served from this domain, so reading this page sends a request to nobody else.

• If you ask us to email you the download link: your address is used only to send that one email. It is added to no list and is not stored: to stop the same address receiving the link twice, we keep a one-way fingerprint of it for 24 hours, then delete it.
• Technical logs: our host keeps, for a short time and for security and availability purposes, the usual records of a web server (IP address, page requested, date). We do not exploit them. The site is hosted in France, on a server we administer.

Changes

This policy may change along with the application. The date of the last update is at the top of the page. A change that widened what leaves your Mac, or what we store, would be announced in the release notes.

A question about your data? Write to tristan@flowwi.fr.