← Parley

Privacy Policy

Last updated: 15 July 2026 · Applies to the Parley Android app and the Parley web interface, operated by Applicair ("we", "us").

The short version

• On the Android app, your audio never leaves your phone. Recordings are stored, transcribed and speaker-separated on your device; no server of ours receives that audio. The web app is different: a call you choose to record in the browser is sent over an encrypted connection to our backend to be transcribed, processed in memory, and not retained. Recording in the browser is optional and clearly labelled.
• You choose what syncs. If you sign in, your notes (transcripts, summaries, action items, folders) sync to your private cloud space so you can read them on other devices. Nobody else can read them.
• You can delete everything, any time, with one button inside the app ("Delete all my data").

1. Who is responsible

For the content of your recordings you are the data controller: you decide what to record and you are responsible for informing participants where the law requires it (the app reminds you of this at first launch). For account and sync data described below, Applicair (Netherlands) is the controller. Contact: admin@parleynotes.com.

2. What stays on your device

• Audio recordings: captured, compressed and stored only in the app's private storage on your phone. Never uploaded.
• Speech-to-text and speaker separation: performed entirely on-device by locally downloaded AI models.
• Your voice profile (optional): if you enable speaker recognition, a mathematical voiceprint of your own voice is created on-device from a sample you record. This is biometric data and is strictly opt-in; you can delete it in Settings at any time. Parley does not create or store voiceprints of anyone else: other speakers are labelled from the conversation itself (for example when someone is addressed by name), which involves no biometric processing.

3. What we process in the cloud

• Account: if you sign in with Google we receive your name, e-mail address and account identifier (via Firebase Authentication). We use these only to create and secure your account and to keep your synced notes tied to you; see section 5 for the full details.
• Notes sync: transcripts, summaries, action items, folders and settings are stored in Google Cloud Firestore (EU region, europe-west1) under your account, protected by per-user security rules: only your authenticated account can read or write your data.
• AI summaries: when a recording is summarized, the text transcript (for Android recordings, never the audio) is sent over an encrypted connection to our backend on Google Cloud Run (EU region), which generates the summary using a large-language-model service and returns it. For recordings made in the web app, the audio itself is sent to be transcribed first. In both cases the data is processed in memory to fulfil the request and is not retained by our backend.
• Crash and error reports: technical logs (never audio, never transcripts) that help us fix bugs.

4. Optional integrations

Each integration is off until you connect it, and each can be disconnected in Settings:

• Gmail: with your permission (Google's "send e-mail on your behalf" scope), Parley can e-mail a summary from your own address. We never read your inbox; the app requests send-only access.
• Google Calendar / Outlook Calendar: with your permission, Parley creates events in your calendar and, when you explicitly ask it to check your availability for a time slot you propose, reads the events in that narrow time window. It never browses your calendar beyond what you ask for.
• Google Meet: with your permission, Parley fetches the transcripts of your own Google Meet calls (conference records where transcription was enabled) so they appear as meetings in your notes.
• Microsoft Teams: with your permission, Parley fetches transcripts of your own Teams calls to file them as meetings. Access tokens are stored on your device, not on our servers.

5. How Parley uses Google user data

Parley's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements.

Specifically, for each Google permission you can grant:

• Sign in with Google (basic profile). What we access: your name, e-mail address and Google account identifier. How we use it: to create and secure your Parley account and to keep your synced notes private to you. Storage: held by Firebase Authentication for as long as your account exists; removed when you delete your account or use "Delete all my data". Sharing: none.
• Send e-mail on your behalf (gmail.send). What we access: nothing; this scope only allows sending. How we use it: to send the e-mail you composed and confirmed in the app, from your own address. Storage: the message content is handed to Gmail for delivery and is not stored by us. Sharing: none.
• Calendar events (calendar.events). What we access: events you ask Parley to create, and the events inside a specific time window when you ask it to check your availability. How we use it: to create the event you approved and to tell you whether a proposed slot is free. Storage: availability results are used transiently to answer your request and are not retained. Sharing: none.
• Google Meet conference records (meetings.space.readonly). What we access: the conference records and transcripts of meetings you attended, from your own account. How we use it: to import those transcripts as meetings in your notes and to generate your summaries. Storage: imported transcripts and their summaries are stored in your private, per-user cloud space exactly like your other notes; you can delete them at any time. Sharing: none.

For all Google user data: we do not sell it; we do not transfer it to third parties except as necessary to provide the features you asked for (see the AI section below), to comply with the law, or as part of a merger or acquisition with prior notice to you; no human at Applicair reads it except with your explicit permission for support, for security purposes, or where required by law; and we never use it for advertising.

6. How we protect your data

• Encryption in transit: every connection between the app, our backend, Google and Microsoft uses HTTPS/TLS.
• Encryption at rest: your synced notes live in Google Cloud Firestore and are encrypted at rest by Google Cloud's storage encryption; our backend runs in the EU (europe-west1).
• Per-user isolation: Firestore security rules ensure only your authenticated account can read or write your data; there is no shared or public access path.
• Short-lived tokens, no stored credentials: Google integrations use Google Identity Services on your device. Parley receives short-lived access tokens minted on the phone; it stores no refresh tokens, no passwords and no client secrets, and your Google tokens never touch our servers. Microsoft tokens are stored only on your device.
• Least scope: we request the narrowest Google permissions that make each feature work (send-only for Gmail; events-only for Calendar; read-only for Meet) and nothing else.
• Sensitive data stays local: on Android, audio recordings and your optional voiceprint are held in the app's private, sandboxed storage and never leave the device (your voiceprint backs up to your own account space when you sign in, so voice recognition follows your account to a new phone). Web recordings are transcribed in the cloud as described above and are otherwise kept in your browser's local storage.
• Deletion controls: you can delete any meeting, disconnect any integration (which revokes its Google grant), or erase everything with "Delete all my data", locally and in the cloud.
• Incident response: if a breach affecting your personal data ever occurs, we will notify you and the competent authority as required by the GDPR (Art. 33 and 34).

7. AI processing and machine-learning models

Your data is never used to train AI. No Google user data (raw, aggregated, anonymised or derived, including anything obtained through the Gmail, Calendar or Google Meet APIs) is ever used by us, or transferred to any third party, to create, train or improve machine-learning or artificial-intelligence models of any kind (foundational, generalised or otherwise).

• On-device (self-hosted, offline) models: speech-to-text, speaker separation and optional voice recognition run entirely on your phone using locally downloaded models that we operate in this self-hosted, offline capacity. The audio and text they process are handled locally and are never transmitted back to the model providers, and are never used for training or any secondary purpose.
• Cloud summarization and assistant: to generate summaries and answer your questions, the text transcript (for Android recordings, never the audio; for web recordings, the audio is transcribed first) is sent over an encrypted connection to our backend, which calls Google's Gemini API as a paid service. Google acts as our processor here. Under the Gemini API's terms for paid services, Google does not use these prompts or responses to train or improve its models. Our backend runs in the EU (europe-west1) and stores your notes there; processing by the Gemini API itself may take place in other Google regions, including outside the EEA, under Google's data processing terms and their standard contractual safeguards. Our backend processes requests in memory and does not retain them.
• No other AI providers: we do not send your data to any other third-party AI or ML service.

8. Legal bases (GDPR)

We process account and sync data to provide the service you request (Art. 6(1)(b) GDPR). Optional features (voice profiles under Art. 9(2)(a), integrations, crash reporting) rely on your explicit consent (Art. 6(1)(a)), which you can withdraw at any time in the app.

9. Retention and deletion

Your data is kept until you delete it. In the app: delete individual meetings, disconnect integrations, remove voice profiles, or use Settings → Delete all my data, which erases local storage and your cloud space. You can also e-mail us to request deletion of your account data.

10. What we never do

• We never upload, listen to, or analyse your audio on a server.
• We never sell or share your data with third parties for advertising.
• We never use your data (including Google user data) to train AI or ML models, ours or anyone else's.
• We show no ads and use no third-party ad or tracking SDKs.

11. Your rights

Under the GDPR you have the right to access, rectify, export and erase your personal data, to restrict or object to processing, and to lodge a complaint with your supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens). Most of these you can exercise directly in the app; for anything else, contact admin@parleynotes.com.

12. Changes

If we change this policy we will update this page and, for material changes, notify you in the app before they take effect.