Legal

Privacy Policy

Published by Flowwi (legal notice) · contact: tristan@flowwi.fr · last updated: 31 August 2026

Keeti is a local-first macOS application. Your recordings, transcripts and meeting notes stay on your Mac, and Keeti asks you for no account. The rule this whole page unfolds is simple: we can count what the app does, never see what you said. Keeti sends us anonymous usage measurements, described precisely in Usage measurement; your content never reaches us, and there is nowhere in the format it could fit.

What Keeti handles, and where

Data	Where it lives	What leaves your Mac
Meeting audio	Local only	Never. The file is deleted automatically according to your retention setting (30 days by default).
Transcript (text)	Local, in files that belong to you	The text is sent to the AI provider you choose, with your key, to write the notes.
Meeting notes and action items	Local	Only if you configure an outgoing webhook, or query them through an agent connected over MCP.
Google Calendar and contact data	Local, in the meeting files (see the dedicated section)	Never sent to us. Confirmed attendee names and email addresses may be included in the text sent to your AI provider.
Voiceprints	Local, encrypted (see the dedicated section)	Never.
API keys, secrets, tokens	macOS Keychain (encrypted by the system)	Never transmitted to Flowwi. Used only to call the services you configured yourself.

What leaves your Mac, and only if you turn it on

Writing the notes (your key): the text of the transcript is sent, with your own API key, to the AI provider you select (Anthropic Claude, OpenAI, Mistral or Google Gemini). The audio is never sent. That provider acts as a processor and handles the data under its own policy, which we encourage you to read.
Outgoing webhook (optional): if you configure one, the notes and action items are sent to the URL you provide, over HTTPS, signed with HMAC if you set a secret. The destination is your choice.
AI agents over MCP (optional): the MCP server runs locally. It makes your meetings queryable by an agent you connect. Keeti exposes nothing on the network.
Google account connection (optional): read-only, directly between your Mac and Google (section below).
Updates: Keeti fetches a public file hosted on GitHub Pages to find out whether a newer version exists. That request carries no account or content data.
Speech recognition models: on first launch, Keeti downloads the models that then run locally (about 480 MB, from Hugging Face). Nothing is sent in that direction: it is a download.

Flowwi receives, stores and has access to none of this content.

Usage measurement (telemetry)

Since version 1.9, Keeti sends us anonymous usage events, so that we can see where the product fails people: how many installations reach their first meeting notes, where the others stop, which errors happen, on what kind of machine. This is how the product gets better, and this section says exactly what it carries.

What is sent

A random installation identifier: a number drawn at install time, derived from nothing (not your hardware, not your account, not your name), replaced by a new one after 13 months.
Categories and counts, never text: app and macOS version, Mac model (for example “Mac14,12”), onboarding steps reached, number of recordings, meeting duration ranges and speaker counts, error categories, which features are enabled, and crash summaries reduced to numbers (signal, stack depth, and which processing phase the app was in).

The measurement is on by default and there is no in-app switch: that is the deal this page makes explicit — we count precisely because the format above cannot carry anything about you.

What is never sent, by construction

No meeting title, no attendee name or email address, no transcript, no notes, no audio, no file name, no API key, no webhook address. This is not a promise held by a filter: the event format has no free-text field. There is nowhere to put your content, and our server rejects any message that does not match that closed format.

Where it goes, and how long it stays

To a server we run, hosted in France. No analytics company, no third-party SDK, no advertising network is involved, and nothing is ever shared or resold.
These measurements are used for this purpose alone and are never cross-referenced with anything else, including the email list of this site.
Events are deleted after 25 months; only aggregate statistics remain. Your IP address is neither stored nor logged by that service.
On a company-managed Mac, your IT can disable the measurement entirely with the ManagedTelemetryEnabled configuration key.

This design follows the French regulator's (CNIL) framework for consent-exempt audience measurement: strictly anonymous statistics, produced for the publisher's sole use.

Google user data

Connecting a Google account is optional and Keeti works without it. Every permission Keeti requests is read-only, each one can be declined on its own at the consent screen, and the access happens directly between your Mac and Google (OAuth 2.0 with PKCE, loopback on 127.0.0.1). No Keeti server is involved.

What we access, and why

Scope	Google data accessed	Why
`calendar.events.readonly`	Title, times, guests (names and email addresses) and recurrence identifier of your upcoming events	Pre-fill the meeting title, the attendee list and the number of speakers; offer to record a meeting that is starting. The speaker count is what lets the on-device engine separate voices correctly.
`directory.readonly`	Display name and email addresses of a person in your Google Workspace organisation's directory	Turn a colleague's email address into their full name, so the notes credit a person rather than an inbox.
`contacts.readonly`	Display name and email addresses of a contact you saved	The same lookup, for clients and partners outside your organisation.
`contacts.other.readonly`	Display name and email addresses of a person you have corresponded with without saving them as a contact	The same lookup again. In practice this covers most external attendees.

How we use it

The three lookup scopes do one single job: turning an email address into a name. Keeti queries one address at a time, at the moment a meeting arrives with an attendee it cannot name.
Keeti never exports your address book, never synchronises your contacts, and never enumerates your organisation's directory.
A result is kept only if one of the person's email addresses matches exactly the one asked for. A near match is discarded: a missing name is better than the wrong one.
Decline all three and Keeti keeps the email address as it is, with no error and no repeated prompt.
Google data is used only to provide the meeting-preparation feature described here. It is never used for advertising, never sold, never shared with a data broker, and never used to train or improve any machine learning or artificial intelligence model.
The content of your events is not sent to the AI provider. Only the names and email addresses of the attendees you confirmed may be included in the text sent for writing, so that the notes attribute what was said to the right person.

How we protect it

Google data never reaches infrastructure we operate. The only server we run is the anonymous usage counter described above, and its format has no field that could hold a name, an email address or an event: there is no system of ours that could leak your Google data, because none ever holds it. This is structural rather than procedural.
Encryption in transit. Every call to a Google API is made over HTTPS (TLS). The authorisation flow uses OAuth 2.0 with PKCE on a local loopback address, so the authorisation code cannot be intercepted by another application.
Encryption at rest. The Google refresh token is stored in the macOS Keychain, encrypted by the operating system and protected by the user's session. It is never written to a plain file, never logged, and never leaves the device.
Access control. Data read from Google is held in the app's memory for the duration of the lookup, and any name kept afterwards is written into your own meeting files, under your macOS user account, protected by the system's file permissions and by full-disk encryption if you have FileVault enabled.
Data minimisation. Keeti requests the narrowest scopes that make the feature work, all of them read-only. It cannot create, modify or delete anything in your Google account.
No content in logs. The application's diagnostic logs record counters only, for example how many addresses were looked up and how many resolved. They never contain an email address, a name, or any event content.
Signed, notarised distribution. Keeti is distributed signed with an Apple Developer ID and notarised by Apple, and its updates are signed with EdDSA, so a tampered build cannot be installed in its place.

Retention and deletion

Keeti keeps no copy of your calendar or contact data. What persists is only what ends up in your own meeting files: the meeting title, and the names and email addresses of the attendees. Those files are yours, on your disk, and you can delete them at any time.
Disconnecting deletes the token. In Settings, Integrations, Google, choose Disconnect: Keeti deletes the refresh token from the Keychain and forgets the set of permissions you had granted. Nothing further can be read from your Google account.
You can also revoke access on Google's side at any time, from myaccount.google.com/permissions.
Meeting audio is deleted automatically after the retention delay you set, 30 days by default.

Limited Use

Keeti's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: Google data is used only to provide the meeting-preparation feature described above, stays on your device, is not used for advertising, is not sold, and is not accessible to any human being, unless you explicitly consent to share it as part of a support request.

Voiceprints

Keeti can learn your voice in order to recognise you from one meeting to the next and attribute what was said correctly. A voiceprint is biometric data under Article 9 of the GDPR: it gets heightened protection.

Enrolment is voluntary. Keeti works without it. You start it yourself from the settings, by reading a few sentences.
Voiceprints stay on your Mac, in an encrypted store (AES-GCM) kept in the application's support folder. They are never transmitted, not to Flowwi, not to the AI provider, not to anyone.
A voiceprint is not a recording: it is a numerical vector from which neither the voice nor the content of what was said can be reconstructed.
Third parties are not enrolled by default. Remembering other attendees' voices is an option that ships turned off. If you turn it on, it is on you to obtain their explicit consent: without it, that processing is unlawful.
“Forget everything” really deletes the voiceprints from disk, at any time, from the settings.

Legal framework

Recording a conversation without the knowledge of the people in it is unlawful (Article 226-1 of the French Criminal Code, and equivalent rules in most countries).

Keeti reminds you to make the announcement when you start a recording, but the announcement and obtaining consent remain your responsibility. One sentence at the start of the meeting is usually enough.

Data controller — your meetings: that is you, or your organisation. Keeti is the tool; you decide what to record, who appears in the notes, and which AI provider the text is sent to.
Data controller — the usage measurement and the beta email list: that is Flowwi (identified in the legal notice). For the beta list you can access, correct or erase your address at any time by writing to us. For the usage measurement, the data cannot be linked back to you — that is its design — so there is no individual record we could retrieve or erase, even on request (GDPR art. 11).
Complaints: you can lodge a complaint with the French supervisory authority, the CNIL.
Retention: under your control. Audio follows the retention delay you set; transcripts and notes are files that belong to you, deletable at any time.
Your rights (access, rectification, erasure, portability): since the data is on your Mac, you exercise them directly on your own files. For data processed by an AI provider or by Google, address them directly.
Transfers outside the EU: Keeti transfers none of your content outside the EU, and the usage measurement stays in France. The technical requests the app makes (update check to GitHub, one-time model download from Hugging Face) reach those services like any web request does. If the AI provider you choose is established outside the European Union, that transfer follows from your choice and from your contract with them.

Security

The protections described in the Google section apply to everything Keeti handles. In summary: secrets and tokens stored in the macOS Keychain · network calls over HTTPS · Google sign-in over PKCE with a local loopback · webhooks signed with HMAC · voiceprints encrypted with AES-GCM · updates signed with EdDSA. Keeti is distributed signed with an Apple Developer ID and notarised by Apple. Because there is no account and your content never reaches us, there is no central store of meetings to protect, and no credential of ours that could grant access to yours.

This site

Everything above describes the application. The site you are reading is separate, and it does not track you either: no cookies, no analytics, no trackers. Fonts are served from this domain, so reading this page sends a request to nobody else.

If you leave your email address to follow the beta: it is used only to tell you about new releases, it is never resold or passed to an advertising third party, and every message carries an unsubscribe link. Legal basis: your consent, withdrawable at any time; the address is deleted when you unsubscribe, or after three years without any interaction. Write to tristan@flowwi.fr to be erased without delay.
Technical logs: our host keeps, for a short time and for security and availability purposes, the usual records of a web server (IP address, page requested, date). We do not exploit them. The site is hosted in France, on a server we administer: no browsing data leaves the European Union.

Changes

This policy may change along with the application. The date of the last update is at the top of the page. A change that widened what leaves your Mac would be announced in the release notes.

A question about your data? Write to tristan@flowwi.fr.