Launch-stage notice: Autopen 2.0 is an early cloud service. Its backend uses durable managed storage, but its operating controls remain under validation and the Service is not approved for regulated workloads. Record and upload content only when you have authority to do so and its sensitivity is appropriate for the safeguards described here.
Who we are and what this policy covers
Autopen is operated by Quiet Eye Group ("Autopen," "we," "us," or "our"). This policy explains how we process personal information through getautopen.com, the Autopen iOS, Android, Windows, and macOS applications, our application programming interfaces, support, and related services (collectively, the "Service"). It does not govern a third-party service that you use under that provider's own account or terms.
How the Service works
Autopen 2.0 requires an account and cloud processing. Meeting audio is uploaded to Autopen and sent to a speech-to-text provider. Transcript text, your instructions, and relevant note-style information are then sent to a note-generation provider. Transcripts, notes, styles, and account data are stored by the Autopen service to synchronize across your devices. Autopen is not end-to-end encrypted because the Service must process content to transcribe, generate, edit, and synchronize it.
Information we collect
- Account and identity information: email address; name or profile information returned by Apple, Google, or an organization identity provider; provider and internal identifiers; sign-in method; verification and multifactor status; organization, domain, membership, and role; sessions; plan; and account state.
- Customer Content: meeting audio; transcripts; speaker labels and corrections; generated and edited notes; note styles, instructions, and examples; vocabulary; meeting titles; folders; flags; and files or exports you request.
- Device, usage, and security information: device and request identifiers, platform, device name, app version, IP-derived network information, timestamps, feature and processing usage, job status, error codes, authentication events, and security or audit signals.
- Local desktop call detection: if you leave this optional setting enabled, the Windows and Mac apps inspect visible window titles and application names on your device to recognize supported Teams, Zoom, Webex, and Google Meet calls. Source titles and application names are discarded after each scan, are not stored or sent to Autopen, and recording never starts until you choose it.
- Communications: information you include in support, privacy, security, feedback, or other messages to us. Please do not send Customer Content, passwords, access tokens, or other secrets in a support message.
We collect this information from you and your devices, from the sign-in provider you select, from an organization that manages your account, and from the service providers that process requests for us.
How we use information
We use information to provide, authenticate, transcribe, generate, edit, organize, synchronize, export, maintain, and support the Service; administer accounts and organizations; protect users and the Service; prevent fraud and abuse; debug and improve reliability; measure usage and enforce plan limits; communicate with you; comply with law; and establish, exercise, or defend legal claims.
We do not sell personal information or Customer Content, and we do not share it for cross-context behavioral advertising. Autopen does not use Customer Content to train an Autopen model.
Service providers and disclosures
We disclose only the information needed for providers to perform services for us. Our current service stack includes:
- WorkOS: identity, authentication, account management, authentication lifecycle emails such as email verification and password reset, multifactor authentication, and organization SSO. WorkOS receives identity, sign-in, session, and organization information—not meeting audio or note content.
- Apple and Google: optional social sign-in. The provider you choose receives an authentication request and returns identity information under its own privacy terms. Autopen does not give Apple or Google your meeting audio, transcript, or notes merely because you use that provider to sign in.
- Netlify: public website hosting and access-controlled desktop beta delivery. Netlify processes web request information and, for invited desktop testers, an email address and account identifier in signed session data plus release files and metadata. The beta flow uses strictly necessary, short-lived Secure and HttpOnly cookies.
- Railway: API hosting and service operations. Requests and the information needed to process them pass through Railway-hosted infrastructure.
- AssemblyAI: speech-to-text processing. AssemblyAI receives uploaded audio and may receive language or vocabulary context, then returns transcription results. Autopen's account-wide Model Improvement Program opt-out is enabled.
- OpenAI API: note generation. OpenAI receives transcript text, note-style instructions, and related context needed to generate a note. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer affirmatively opts in. Autopen sends stateless Responses API requests with provider response storage and GPT-5.6 prompt caching disabled.
AssemblyAI no-training controls: Effective August 5, 2026, Autopen has enabled AssemblyAI's account-wide Model Improvement Program opt-out. Under that control, AssemblyAI states that it will not use Customer Data to train its AI or machine-learning models or to perform benchmarking, and will not use de-identified data to train those models. The control applies to future requests across the account, including pre-recorded and streaming APIs and current or future account keys. Autopen has also set AssemblyAI's asynchronous audio and transcript time-to-live to one day, and the Autopen server requests deletion of each provider transcript immediately after retrieving the result. Certain operational, security, and billing metadata may be retained under provider terms.
OpenAI data controls: Autopen's integration sets store=false, disables implicit prompt caching, and does not use provider-hosted files, conversations, background mode, web search, MCP, or other hosted tools for note generation. These application settings do not by themselves eliminate OpenAI's separate abuse-monitoring logs. Unless and until Autopen documents an approved Zero Data Retention or Modified Abuse Monitoring configuration for the exact production project, OpenAI states that such logs may contain customer content and may be retained for up to 30 days by default, subject to documented legal and safety exceptions. Autopen does not currently claim Zero Data Retention.
We may also disclose information when you direct us to do so, to professional advisers under confidentiality obligations, in connection with a merger, financing, acquisition, reorganization, or sale of assets, or where reasonably necessary to comply with law, protect rights and safety, and investigate fraud or misuse.
Storage and retention
Autopen's current production-configured backend uses managed PostgreSQL, Redis, and a private object store on Railway in its U.S. East region. Meeting records and account data are durable application records rather than restart-only memory. Staged audio is encrypted by Autopen with AES-256-GCM before it is placed in private object storage. Identity records can remain at WorkOS, and providers may retain information under their terms and the controls described above, including OpenAI's default abuse-monitoring period unless a stronger account control is approved and verified. The public website is hosted on Netlify and uses no Autopen advertising or analytics cookies; protected desktop beta access uses strictly necessary session cookies.
Staged audio is designed to be deleted after a terminal transcription attempt, including a failed attempt; incomplete uploads have a short expiry. Transcripts, notes, styles, and account data remain until deleted or until an applicable retention rule expires them. Personal meeting deletion is designed to move an item to Trash for 14 days before permanent deletion. A managed organization may set different Trash, transcript, notes, and offline-cache retention. Permanent and account deletion remove applicable data from active systems, subject to provider processing, bounded backup expiry, security records, legal obligations, and dispute preservation. Backup restoration, backup-expiry, key-rotation, deletion, and operating-control evidence remain active reliability priorities and prerequisites for any future regulated-workload claim.
Security
We use administrative, technical, and organizational safeguards appropriate to the nature of the Service, including encrypted transport, restricted credentials, access controls, application-layer encryption for staged audio, and data-minimizing telemetry. No transmission or storage method is completely secure. Availability, recovery, deletion, monitoring, and independent security validation continue to mature, and the Service is not approved for regulated workloads.
Managed organizations and devices
If an organization provides or manages your account, its authorized administrators may manage membership, require SSO or app lock, restrict features such as export, set retention rules, revoke sessions, view enrolled-device and aggregate-usage information, request deletion of local app data, and delete organization-controlled data. Ordinary organization administrators are not provided a feature for opening a member's private transcript or notes, but an organization may control the account and its lifecycle. Remote deletion is completed only after an app reconnects and acknowledges the command; an offline device cannot be represented as erased.
Your choices and privacy rights
You can choose a sign-in provider, correct transcript text, export permitted content, delete meetings, permanently delete Trash items, delete all meetings, and delete a personal account from the iOS or Android app. The public account-deletion guide gives the exact in-app path, describes what deletion covers, and explains the managed-account process. A managed account is handled through its organization so that access and deletion can be administered and audited.
Depending on where you live, you may have rights to know, access, correct, delete, or obtain a portable copy of personal information; restrict or object to certain processing; or withdraw consent where consent is the basis for processing. You may also have a right to appeal a denial. To make a request, email info@quieteyegroup.com. We may verify your identity and may be unable to delete information that we must keep by law or that an organization controls on your behalf. You may authorize an agent where applicable law permits it.
International processing and legal bases
Autopen's current Railway application services are configured in the U.S. East region. Autopen and its other providers may process information in the United States and other countries whose laws may differ from those where you live. Before enterprise or regulated-workload use, we will publish the final provider regions and applicable transfer safeguards. Where a legal basis is required, we process information as necessary to provide the Service and perform a contract, for legitimate interests such as security and reliability, with consent where requested, and to comply with legal obligations.
Recording responsibility
Recording, wiretap, biometric, employment, confidentiality, and privacy laws vary by location and context. You are responsible for determining whether you may record and process a meeting, notifying all participants, and obtaining any required consent. Autopen may provide reminders but cannot determine which laws or contractual duties apply to you.
Children
Autopen is a workplace product and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided information, contact us so we can investigate and delete it where appropriate.
Changes and contact
We may update this policy as the Service, providers, or law changes. We will post the new effective date and provide any additional notice required by law. We will materially review this policy as the mobile beta expands and whenever our providers, storage, retention, or processing purposes materially change.
Privacy, security, or data-rights questions: info@quieteyegroup.com. Also see the Terms of Use.