Privacy Policy
In short
- minumeeting keeps your meetings — recordings, transcripts, summaries and notes — on your device. Recording, on-device transcription, search, export and backup work without sending meeting content to us.
- There are no accounts, no ads, no analytics and no tracking.
- Cloud AI is optional. Smart mode sends meeting text — and, if you choose cloud transcription, meeting audio — to our AI service on Cloudflare only after you agree; it is processed in memory and not stored. My own key sends meeting text from your device directly to the AI provider you choose, under your own account with them.
- You can delete your data at any time — see Delete your data.
1. Who we are
minumeeting is developed and provided by Tibrcode Software Development ("we", "us"), Abu Dhabi, United Arab Emirates — email: support@tibrcode.com.
We are the controller of the personal data that we receive, as described in sections 5 and 9. For any privacy question, write to support@tibrcode.com with the subject "Privacy".
2. What this policy covers
This policy covers the minumeeting apps for Android and iOS, the web app at https://minumeeting.com, the pages of minumeeting.com, and the optional minumeeting AI service ("Smart mode").
It does not cover services of others that you choose to use with minumeeting — for example the AI provider of your own key, your email or cloud-storage app, your browser's speech service, or the app stores. Their own privacy policies apply.
3. On your device first
minumeeting is a local-first app. Your meetings are stored in the app's private storage on your device — in the web app, in your browser's storage for minumeeting.com. Recording, transcription with the built-in engine, the automatic analysis after each recording, search, export and backup all run on your device.
We have no copy of, and no access to, what is stored on your device. That data is under your control: you decide what to keep, export, share or delete. If you use minumeeting at work or for an organisation, the organisation may be responsible under data-protection law for the personal data in your meetings (see the Terms of Use).
Data leaves your device only in the situations listed in section 5. Most of them happen only when you choose a feature that needs it.
4. What is stored on your device
| Data | What it includes | When it is created |
|---|---|---|
| Meetings | Title, date and time, duration, language, the participants you enter (names, roles), bookmarks, agenda or template, status, and — if you confirmed it — the time you confirmed everyone’s consent to the recording | When you record or import a meeting |
| Transcripts | The text of each line with its time and the speaker's label or name | While you record or import |
| Audio | The recording of each meeting and of voice notes. During a recording, pieces of about 10 seconds are saved so that a crash does not lose the meeting; they are removed once the recording is saved | While you record |
| AI results | Summaries, key points, action items (owner, deadline), decisions, risks, open questions, chapters, title suggestions, formal minutes, follow-up emails, next meeting agendas and translations — each with the source that produced it | When the automatic analysis runs or when you generate them |
| Notebook and glossary | Text notes, voice notes, drawings; glossary terms and definitions | When you create them |
| Voiceprints (optional) | A numeric voice profile (MFCC features) with the name you give it, used to suggest speaker names in later meetings. Never sent anywhere and not included in backups | Only if you record a voice sample in Settings |
| Settings and consent records | Language, recording language and dialect, engines, microphone options, the letterhead for minutes and reports (organisation name, department, contact line, footer text and logo); the AI mode you chose and the date and time of each consent you gave or withdrew | When you change settings |
| Smart-mode data | A random install ID, a session token valid for 24 hours, the last service configuration and your remaining free allowance | Only if you use Smart mode |
| "Ask your meetings" index | Numeric vectors (embeddings) of transcript passages and references to the lines — no text | Only if you ask a question in Smart mode |
| Your own API keys | The keys of the providers you set up | Only if you save a key |
| Downloaded engines | The on-device transcription model and, if you use them, translation models and the optional on-device language model | On first use |
| Temporary files | Export and backup files waiting for the share sheet in the apps (deleted after about 10 minutes or at the next start); the web app's own files, cached for offline use | When you export; when the web app loads |
How long: until you delete them, or until you delete the app or clear its data (see Delete your data). In the web app, the browser may clear site data when the device runs out of space unless it has granted minumeeting persistent storage; the app asks for it and Settings shows the result.
Protection on your device: your data is protected by your device's own security — screen lock, device encryption and the browser's protection of site data. minumeeting does not add a separate passphrase encryption to meetings. Your API keys are kept in secure storage backed by the Android Keystore on Android and in the iOS Keychain (this device only, never synced to iCloud). In the web app they are kept in your browser's storage on this device, which is less secure; the app tells you so. Backup files you export contain all your meetings, including audio, unencrypted — keep them somewhere safe.
Device backups: on Android, minumeeting's data is excluded from Google's cloud backup; on Android 12 and later a direct phone-to-phone transfer can copy it to your new phone. On iOS, the app's data is excluded from iCloud and computer backups. To move your meetings to another device, use the backup file in Settings → Data & Privacy.
5. When data leaves your device
5.1 Downloading the on-device engines
The first time you use on-device transcription — and, if you choose them, on-device translation or the on-device language model — the app downloads the model files from Hugging Face (huggingface.co); the engine's own program is part of the app. These requests contain no meeting content. As with any download, Hugging Face sees your IP address and standard browser or app information. The files are then cached on your device so the engines work offline.
5.2 Smart mode — our AI service on Cloudflare (optional)
Smart mode is off on a new install. It runs only after you turn it on and agree on the consent screen, which names Cloudflare, Inc. and asks separately for meeting text and meeting audio.
- What is sent: only for the feature you run, the meeting text it needs — transcript lines with speaker names and times, the meeting title and date, and the participant names. For translation, the text to translate. For read-aloud, the text to read (Arabic always uses your device's voice). For "Ask your meetings", passages of your meetings' transcripts (speaker name and text, sent once to build the search index that is stored on your device) and your question.
- Audio (cloud transcription): only if you choose "Smart — Cloudflare" as the transcription method in Settings and allowed meeting audio on the consent screen. While you record, the app sends the meeting audio in short pieces (8 to 25 seconds, cut at pauses in speech; silence is not sent) as uncompressed audio, with the meeting language, the dialect you chose, the terms of your glossary and the end of the previous piece's text for continuity. A Whisper model on Workers AI transcribes each piece and the text returns to your device; the audio is processed in memory and discarded — we do not store it. If a piece cannot be sent — no internet, the weekly allowance used up, the service paused, or your consent withdrawn — it is transcribed on your device instead. The meeting page says when a transcript was made in the cloud.
- How it is processed: our server runs on Cloudflare Workers and uses AI models on Cloudflare Workers AI. Your content is processed in memory to produce the result, returned to your device and then discarded. We do not store it and we do not log it. Cloudflare states that Workers AI does not retain inputs or outputs after the request and does not use them to train AI models. We do not use your content to train models either.
- What our server records: one log line per request with technical metadata only — request ID, endpoint, status, response time, feature, model, estimated compute units, allowance counters, error code, the app platform and version, and for transcription the length and size of the audio piece and its language. No meeting content, no IP address and no install ID. These logs are kept for up to 7 days.
- Free allowance: at your first Smart-mode use, the app creates a random install ID that is not linked to your identity. Our server never stores it as such: it converts it with a keyed hash and keeps only that hash with your usage counts (for example "12 requests today"). The counts are deleted automatically 8 days after your last use. The session token the app receives is valid for 24 hours.
- Human check (Cloudflare Turnstile): before the first Smart-mode use, and whenever a new session is needed, Cloudflare Turnstile checks that you are a person, usually without a click. Turnstile processes signals such as your IP address, TLS fingerprint, browser user agent and the site it runs on. Cloudflare acts as our processor for this check and, under its Turnstile Privacy Addendum, also uses these signals as an independent controller to improve Turnstile. Our server sends the Turnstile token and your IP address to Cloudflare's verification service and limits how many sessions can be created from one network per minute and per day. For the daily limit it keeps only a keyed hash of the network (your IPv4 address, or the first half of an IPv6 address) with a count, deleted automatically 8 days after the last use; we do not store IP addresses. In the Android and iOS apps, the check runs in a page loaded from https://minumeeting.com/verify.
- Your choice: you can withdraw consent for text or audio at any time in Settings → AI engine, or switch back to "On this device only". Everything keeps working on your device.
5.3 My own key — your AI provider (optional)
If you add your own API key for OpenAI, Anthropic, Google Gemini, Groq or OpenRouter and agree on the consent screen for that provider, the app sends the meeting text needed for the feature you run (as described in 5.2) directly from your device to that provider, with your key. For "Ask your meetings", it sends your question and the passages found on your device. With an OpenAI key, read-aloud sends the text to OpenAI and receives audio. "Test key" asks the provider for its list of models.
We never receive your key or this content. The provider processes it under your own agreement and account with them and under its privacy policy; it is not our processor, and any charges are billed to your account. Consent is asked for each provider and can be withdrawn in Settings → AI engine.
5.4 Reports about AI results
Every AI result has a "Report" button. A report contains the feature and the reason you choose, your optional comment, the generated text (up to 4,000 characters) only if you keep "include" ticked, and technical details: request ID, model, app platform and version, and language. It is sent only after you tick the consent box, through our service on Cloudflare, and is stored for 90 days, then deleted automatically. No install ID and no IP address is stored with it. We use reports to find and prevent harmful or wrong output.
Sending a report from the app needs a Smart-mode session, so it may involve the Turnstile check described in 5.2. You can also report by email.
5.5 Web Speech in the web app (optional)
In the web app you can choose "Web Speech" as the transcription engine in Settings. Your browser then sends your microphone audio to its own speech service (for example Google's, in Chrome); the browser vendor handles it under its own privacy policy, and we never receive it. The app warns you when you choose it. This engine is not used in the Android and iOS apps.
5.6 Reading aloud with your device's voice
On-device read-aloud uses the speech voices of your operating system or browser. Most voices work on the device, but some browsers offer online voices — for example some "Google" voices in Chrome or "Online (Natural)" voices in Microsoft Edge — that send the text to the browser vendor to create the speech. minumeeting always chooses a voice that works on your device when there is one for the language; when the only voice for that language is an online voice, the app tells you so and reads nothing unless you agree.
5.7 Exporting, sharing and backups
When you export (PDF, Word, Markdown, JSON or subtitles), share, copy, email or back up, the file or text goes only where you send it — for example your email app, a messaging app or your cloud storage. We do not receive it.
5.8 Feedback and support
"Send feedback" opens your email app with a message that already contains technical details — app version and build, platform, operating system, browser and app language — and no meeting content; you can change it before sending. When you write to us, we receive your email address, your message and anything you attach, and use them only to answer you and to keep a record of the request. We keep this correspondence for as long as needed to handle your request, and then for up to 24 months unless the law requires longer.
5.9 Website and web-app hosting (Vercel)
minumeeting.com and the web app are hosted by Vercel Inc. When you open them, Vercel processes standard technical data — IP address, the requested address, date and time, browser user agent and referring page — to deliver the pages and protect the service, and keeps it in its logs for a short period. We do not use Vercel Analytics, any other analytics, advertising cookies or trackers.
5.10 App stores
When you download minumeeting from Google Play or the App Store, Google or Apple process your data under their own policies. They may give us aggregated statistics (such as the number of installs) and, if you chose in your device settings to share diagnostics with app developers, crash reports. We use them only to keep the app working.
5.11 Update check in the Android and iOS apps
So that you hear about new versions — and about a version that can no longer be used — the Android and iOS apps ask our service on Cloudflare which versions are current: when they start and when you return to them, at most once a day. The request contains no meeting content, no install ID and no session token; our server records only one technical log line (endpoint, status, response time — no IP address), kept for up to 7 days. If a newer version exists, the app tells you: on Android, Google Play downloads and installs it inside the app; on iOS, the App Store page opens. The web app does not send this request: it learns about new versions from minumeeting.com itself (section 5.9).
5.12 Crash reports (optional)
Crash reports are off unless you turn them on in Settings → Crash reports, or press "Send the crash report" on the screen the app shows after a crash. A report contains only: the type of event (a crash or an error); the error's name and its message with every quoted text, web or email address, number of three or more digits and every non-Latin character removed, so that no meeting text can be in it; positions in the app's own code files (file name, line and column); the page name without identifiers (for example /meetingdetail); the app version and build; the platform; the browser and its major version; and the interface language. It contains no meeting content, no install ID and no session token. It goes to our service on Cloudflare, which keeps it only as one log line for up to 7 days; no IP address is stored with it. To limit abuse, our server counts reports per network per day with a keyed hash of the network, deleted 8 days after the last use. The app sends at most five reports a day, and the same fault once a day.
6. What we do not do
- We do not require an account, a sign-in, an email address or a phone number.
- We do not show advertising, and we do not sell personal data or share it for advertising.
- We do not use analytics or tracking tools, and we do not use tracking cookies.
- We do not use your meetings to train AI models.
- We do not make automated decisions that have legal or similarly significant effects on you.
7. Cookies and similar technologies
minumeeting does not use cookies for tracking or advertising. The app stores data on your device only so that it works: your meetings and settings (IndexedDB), display preferences such as the interface language and theme, a few technical flags such as the storage status, and a local log of the app's last errors for diagnostics that is never sent anywhere (local storage), and its own files for offline use (cache storage). This storage is strictly necessary for the service you ask for, so we do not show a cookie banner. When Cloudflare Turnstile runs, it may use what is strictly necessary to tell people from bots, as described in Cloudflare's policy.
8. Legal bases
For people in the EEA, the UK and places with similar laws:
| Processing | Legal basis |
|---|---|
| Smart-mode content and reports | Your consent, which you can withdraw at any time (Art. 6(1)(a) GDPR). If a meeting contains special categories of data, your explicit consent (Art. 9(2)(a)) |
| Install ID and usage counts, rate limits, the Turnstile check, server metadata logs | Our legitimate interests in protecting the free service from abuse and keeping it secure and working (Art. 6(1)(f)) |
| Feedback and support emails | Steps you ask us to take, and our legitimate interest in answering you (Art. 6(1)(b) and (f)) |
| Website hosting logs | Our legitimate interest in delivering and securing the website (Art. 6(1)(f)) |
| Compliance with the law and legal claims | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)) |
Where other laws — for example the personal data protection laws of the UAE or Saudi Arabia — require consent or another basis, we rely on the corresponding basis in that law.
9. Who receives data
| Recipient | Role | What | More information |
|---|---|---|---|
| Cloudflare, Inc. (USA) | Our processor: hosting of our AI service, Workers AI, storage of reports and usage counts, logs, the Turnstile check, the apps' update check. Independent controller for improving Turnstile | Smart-mode requests, reports, usage counts, Turnstile signals, update-check requests and crash reports (no content) | cloudflare.com/privacypolicy |
| Vercel Inc. (USA) | Our processor: hosting of minumeeting.com, the web app and the /verify page | Website and web-app requests | vercel.com/legal/privacy-policy |
| Hugging Face, Inc. | Independent provider of the model downloads | Download requests, no content | huggingface.co/privacy |
| Your own AI provider: OpenAI; Anthropic, PBC; Google LLC; Groq, Inc.; OpenRouter, Inc. | Independent, under your own agreement with them | What you send in My own key mode | The provider's privacy policy |
| Your browser vendor | Independent | Web Speech audio; text sent to online voices | The vendor's privacy policy |
| Google, Apple | Independent | App-store data | Their privacy policies |
| Our email service provider | Our processor | Emails you send us | — |
| Authorities, courts, professional advisers | Only when the law requires it, or to establish, exercise or defend legal claims | What is required | — |
| A successor | If our business or the app is transferred, under this policy | What is needed | — |
We require our processors to protect personal data at least as well as this policy describes.
10. International transfers
We are based in the United Arab Emirates. Cloudflare runs our AI service on its global network, so a Smart-mode request may be processed in a Cloudflare data centre outside your country. Vercel and our other providers may also process data outside your country, including in the United States. Where the law requires it, these transfers are protected by appropriate safeguards — for example the European Commission's Standard Contractual Clauses (with the UK addendum) in our providers' data processing terms, or adequacy decisions — and, for the UAE and Saudi Arabia, by the transfer conditions of their personal data protection laws.
11. How long we keep data
| Data | Kept for |
|---|---|
| Data on your device | Until you delete it |
| Smart-mode content | Not stored — discarded once the result is returned |
| Server metadata logs | Up to 7 days |
| Usage counts (hashed install ID) | Deleted 8 days after your last use |
| Daily count of new Smart-mode sessions per network (keyed hash, no IP address) | Deleted 8 days after the last use |
| Session token | Expires after 24 hours |
| Reports | 90 days |
| Crash reports (optional, no content) | One log line, up to 7 days |
| Your emails to us | As long as needed for your request, then up to 24 months |
| Hosting logs (Vercel) and Turnstile signals | The short periods set by Vercel and Cloudflare |
12. Security
- All network traffic uses HTTPS (TLS).
- A Content Security Policy limits the app to the network destinations described in this policy.
- Our AI service keeps no meeting content and no IP addresses, signs its sessions, hashes install IDs with a secret key, limits requests and daily spending, and can switch all cloud AI off at once.
- Keys you add are kept in the operating system's secure storage on Android and iOS.
- In the Android and iOS apps you can lock the app with your fingerprint, face or device screen lock (Settings → App lock). Your device's system checks it; the app never gets your fingerprint or an image of your face, and never stores or sends them.
No method is completely secure. Please protect your device with a screen lock and keep your backup files safe.
13. Your rights and choices
In the app you can choose where AI runs, withdraw consent, delete meetings, notes, glossary terms and voiceprints, delete the AI data on your device, delete all your data at once (Settings → Data & Privacy → Delete all my data), and export everything as a backup file — a copy of your data in a structured, machine-readable format. See Delete your data.
For the data we hold — reports, usage counts, server logs and your emails — you can ask us for access, correction, deletion or a copy, ask us to restrict or stop processing it, object to its processing, and withdraw your consent. Write to support@tibrcode.com.
Because minumeeting has no accounts, we often cannot tell which data relates to you. For example, we can find a report only if you give us the report number shown after you send it, and we cannot reverse a hashed install ID. We may ask for the information we need to handle your request, and no more. We answer without undue delay and within the time limit set by the applicable law (for example, one month under the GDPR).
13.1 EEA and United Kingdom
Under the GDPR and the UK GDPR you have the rights of access, rectification, erasure, restriction, data portability and objection, and the right not to be subject to decisions based solely on automated processing. You can withdraw consent at any time without affecting processing before the withdrawal. You can complain to the data protection authority where you live or work; in the UK, the Information Commissioner's Office.
13.2 California
We do not sell or share personal information, as those terms are defined in the California Consumer Privacy Act as amended by the CPRA, and we do not use it for cross-context behavioural advertising. The categories we collect are: identifiers (a hashed install ID); internet or other network activity (technical request metadata); and the content you choose to send (Smart-mode requests, processed and not stored, and reports). We collect them from you and your device for the purposes described in section 5. California residents may ask to know, delete or correct their personal information, may use an authorised agent, and will not be discriminated against for exercising these rights. We do not use or disclose sensitive personal information for purposes other than providing the service you ask for.
13.3 United Arab Emirates
Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you may ask for information about the processing of your personal data; ask for your data to be transferred; ask for its correction or erasure; ask for its processing to be restricted or stopped; and object to decisions based solely on automated processing — as provided by that law. You may withdraw your consent and complain to the UAE Data Office.
13.4 Saudi Arabia
Under the Personal Data Protection Law issued by Royal Decree No. M/19, you have the right to be informed; to access your personal data and obtain a copy in a readable format; to ask for its correction, completion or update; to ask for its destruction when it is no longer needed; and to withdraw your consent. You may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).
13.5 Elsewhere
If you live elsewhere, you may have similar rights. Contact us and we will help.
14. Children
minumeeting is not directed to children. The Terms of Use require users to be at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has sent us personal data — for example in a report or an email — contact us and we will delete it.
15. Changes to this policy
We publish every change on this page with a new version number and date. If a change is significant, we tell you in the app before it takes effect. If a change affects what you agreed to for Smart mode or My own key, the app asks for your consent again before it sends anything.
16. Contact
Tibrcode Software Development · Abu Dhabi, United Arab Emirates · support@tibrcode.com
17. Language
This policy is published in Arabic and English with the same meaning. If the two versions differ, the Arabic version prevails, to the extent permitted by the applicable law.