Legal
Privacy Policy
1. What thatsaid does
thatsaid is a macOS and iOS app that records conversations you choose to capture, transcribes them on your device, and creates titles and summaries. You can optionally turn on Cloud Sync to sync transcripts and summaries across your devices, and optionally let AI agents (for example Gemini, Claude, ChatGPT or another MCP client) read your transcripts through our MCP server at mcp.thatsaid.app.
2. Data we handle
| Category | Examples | Where it lives |
|---|---|---|
| Audio recordings | Microphone audio of conversations you record | Your device only. Audio is never uploaded, including when Cloud Sync is on. |
| Transcripts, titles, summaries | Text produced from recordings | Your device; our servers only if Cloud Sync is on |
| Account data | Email, hashed password, two-factor settings | Our servers (Cloud Sync and agent access only) |
| Agent connection data | Connected agent name, tokens (stored hashed), granted scopes, access log of which agent read which transcript and when | Our servers |
In Local-only mode, recordings and transcripts never leave your device and we receive none of them. We do not collect your location, contacts or advertising identifiers.
3. How we use data
Only to: (a) record, transcribe, title and summarize your conversations; (b) sync transcripts and summaries between your devices when you enable Cloud Sync; (c) answer requests from AI agents you have connected, within the scopes you granted; (d) secure accounts, prevent abuse and fix bugs; and (e) comply with law.
We do not sell or rent your data or share it for money or other consideration; use it for advertising or ad targeting; use your recordings or transcripts to train AI models; or let our staff read your content, except at your request for support, when required by law, or to investigate abuse or security issues.
4. AI agent access (MCP)
- An agent can read your data only after you connect it.
- Access is read-only: agents can search and read transcripts, titles and summaries. Audio is not exposed. Agents cannot edit, delete or start recordings.
- Each agent gets its own access. Revoke any agent in Settings → Agent Access; access stops immediately. The access log shows which agent read what, and when.
- Once an agent reads a transcript, that content is also handled by the agent’s provider under its privacy policy. Deleting a transcript from thatsaid does not delete copies an agent already retrieved.
- We return only the data needed to answer each request.
5. Recordings of other people
Recordings capture other people’s voices and words. You are responsible for getting the consent the law requires before recording (see our Terms, §4). We process other people’s data only on your instructions. If you believe you were recorded through thatsaid and want the recording deleted, contact [email protected]; we will route the request to the account holder and, where the law requires and we hold the data, act on it.
6. Sharing and processors
We share data only with: (a) AI agents you connect (§4); (b) the service providers below, which run our infrastructure under contracts limiting use to providing the Service; (c) authorities when legally required, after notifying you where allowed; and (d) a successor in a merger or acquisition, bound by this policy, with notice to you.
| Processor | Purpose | Data |
|---|---|---|
| Supabase | Account sign-in and Cloud Sync storage | Account data, synced transcripts and summaries, agent connection data |
| Cloudflare | Network delivery and the MCP endpoint at mcp.thatsaid.app | Requests in transit, agent connection data |
We use no other processors.
7. Retention and deletion
- On your device: kept until you delete it.
- In the cloud: synced transcripts and summaries are kept until you delete them. When you delete a transcript, or your account, it is purged from our servers within 30 days.
- Account deletion: request it by emailing [email protected]; it revokes all agent access immediately and purges your cloud data within 30 days.
- We may keep minimal records where the law requires.
Step-by-step instructions: Delete your data.
8. Security
All data is encrypted in transit (HTTPS) and cloud data is encrypted at rest. Accounts use email, password and two-factor authentication. Agent tokens are stored hashed, scoped read-only, revocable, and logged. No system is perfectly secure; we will notify you and regulators of breaches as the law requires.
9. Children
thatsaid is not directed to children under 13 (16 in the EEA/UK), and we do not knowingly allow them to create accounts. If you believe a child created an account, contact us and we will delete it.
10. Your rights
Everyone: you can access, export, correct and delete your data in the app or by emailing [email protected]. We respond within 30 days (45 under the CCPA).
California: rights to know, delete and correct, to opt out of sale or sharing (we do not sell or share for advertising), to limit use of sensitive personal information (we use it only to provide the Service), and to non-discrimination. Authorized agents may submit requests with proof.
Other US states: similar rights, plus appeal by replying to our decision.
EEA/UK: we are controller for account data and processor for content you record. Legal bases: contract (providing the Service) and legitimate interests (security). You may access, rectify, erase, restrict, port and object, and complain to your supervisory authority.
11. Changes
We will post changes here with a new “Last updated” date and notify you in the app or by email before material changes take effect.
12. Contact
Maxxon Ventures LLC, 2501 Chatham Rd, Ste N, Springfield, IL 62704 · [email protected]