Privacy Policy

Your account. You sign in with Google or Apple. We store the name, email address, and profile photo they share with us, plus the handle you pick. We do not see or store a password.

Your phone number (optional). To place phone calls or let friends find you by number, you can verify your phone number, and we store it. You can skip this entirely.

Your contacts (optional). If you grant contacts access, matching happens by hashing phone numbers on your device and sending only the hashes. Your contacts’ names and numbers do not leave your phone.

Your calendar (optional). If you connect Google Calendar, Vertebrae reads your upcoming events, read-only, through the Google Calendar API (the calendar.events.readonly scope): event titles, times, attendee names and email addresses, their replies to the invite, and the invite description. Vertebrae uses this data for four things. First, meeting detection and note titling, which happen entirely on your device: the app notices a meeting is starting and names the note after the event. Second, naming the speakers in a note: the attendees’ names are matched against the transcript to suggest who said what. Third, if a note is summarized, the event’s title, attendees, and agenda are included as context so the summary can refer to people by name. Fourth, to show which attendees also use Vertebrae, the app sends our servers a one-way hash of each attendee’s email address, never the address itself. Speaker naming and summaries run on a self-hosted, open-weights AI model on infrastructure we operate, inside a hardware-attested confidential-computing environment, reached over an end-to-end encrypted connection. Calendar data sent there is processed in memory and is not stored. Calendar data is never sent to a third-party AI service, and no Google user data is ever used to train AI or machine-learning models, by us, by the model’s original provider, or by anyone else.

How calendar data is protected. All requests to Google use encrypted connections (TLS). Your Google tokens are stored in the macOS Keychain. Fetched events are cached on your device for at most 12 hours and the cache is deleted when you disconnect the calendar. Event details that become part of a note, like its title and attendees, stay in the note on your device, and sync between your devices only end-to-end encrypted so our servers cannot read them. The one exception is AI Connections: notes you record on the Mac app, unless you record them incognito, are also kept on our servers in plaintext, including their title and attendees, so an AI agent you connect can read them (see Connecting an AI agent). We never sell Google user data, never share it with third parties other than an AI agent you connect yourself, and never use it for advertising. You can disconnect the calendar in Vertebrae at any time and revoke Vertebrae’s access in your Google account settings. Vertebrae’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your company directory (optional). If your organization connects its employee directory, we sync its people’s names, email addresses, titles, departments, managers, and photos to our servers through WorkOS, so the Mac app can put names to colleagues. Members of the organization who use Vertebrae can see that list. Disconnecting the directory deletes our copy.

• Calls between Vertebrae users are end-to-end encrypted. Each call uses a fresh key that exists only on the participants’ devices; the audio and that key pass through our servers only in encrypted form we cannot decrypt.
• Outbound phone calls to regular phone numbers travel over the phone network, which no one can end-to-end encrypt. We encrypt the Vertebrae leg and hand the call to our telephony carrier for the rest. Phone calls are outbound only: iOS does not give apps access to the audio of an ordinary incoming call, so we cannot transcribe inbound calls for as long as that remains the case.
• On iPhone, transcription runs entirely on your device, in real time. The speech-to-text model runs on your phone’s own chip, and your call audio is never sent to a transcription server.
• On the Mac, notes are transcribed by Meta’s Muse Voice Transcribe service. The audio streams through our servers to Meta as you record, and the transcript comes back the same way. Our servers pass it along in memory and never store or log it. Notes you record incognito are transcribed on the Mac itself, and their audio never leaves it.
• We retain no audio: nothing is recorded, and once a call or note ends the audio is gone.
• If you turn on voice recognition on the Mac, the voiceprints it learns from the people you name stay on that Mac. They are never uploaded or synced, and you can delete them all in Settings.
• Your conversation records, including transcripts and summaries, are stored on your device. They leave it in a form we can read only as described under Shared notes and Connecting an AI agent.
• Summaries are generated inside a hardware-attested trusted execution environment. Your device verifies a signed attestation of the exact environment before sending anything, over an end-to-end encrypted channel, and the environment neither stores nor logs your transcript. We publish the attested measurements so you can check them yourself.

We cannot read your conversations, with three exceptions: notes you publish (see Shared notes); transcripts kept readable for AI Connections (see Connecting an AI agent): notes you record on the Mac app, unless you record them incognito, and iPhone calls if you turn AI Connections on in the iPhone app; and the audio of those same Mac notes, which passes through our servers on its way to Meta for transcription (see Your conversations). Apart from those, we hold no call audio, no transcripts, and no summaries. We do not have your contact book. We hold only the public key from each of your devices; the private key does not leave your device.

We store what is needed to operate the service: authentication tokens, your devices’ public keys, push notification tokens, and call records (who called whom, when, for how long, and for phone calls the number dialed). Push notifications carry only names and handles. Our servers keep operational logs of events like sign-ins and call setup; these can include identifiers such as your email or phone number, not conversation content.

We run no third-party analytics or crash reporting. Diagnostics stay in an on-device log that is scrubbed of personal information and is shared only if you paste it into a bug report yourself.

Publishing a note link is one of two deliberate exceptions to the encrypted model above. For a note to be readable by anyone you send the link to, it has to be readable by our servers too, so when you publish a note it is decrypted and its summary and transcript are stored on our servers in plaintext. While a note is published, it is readable by us and by anyone who has the link. The link is the only thing controlling access: anyone who has it can read the note, use the AI features on the note page (which run on our own inference servers), or connect an agent through the note’s MCP endpoint. You choose how long a link lives, including keeping it up indefinitely; published notes are deleted when they expire, and all of your published notes are deleted if you delete your account.

AI Connections is the second deliberate exception. It lets an AI agent you already use — Claude, Codex, Cursor — read your meetings and calls through a connector. For an agent to read them, we have to be able to hand them over, so the transcripts and summaries of the notes you record on the Mac app are stored on our servers in plaintext rather than encrypted, whether or not you have connected an agent. That copy is readable by us. Audio is never included — only the text.

Notes you record incognito on the Mac are never uploaded, and stay on that Mac. iPhone calls are not uploaded either unless you turn AI Connections on in the iPhone app; turning it off again deletes them from our servers and disconnects every agent. Deleting a note deletes its copy from our servers.

Each agent you connect is approved by you, one at a time, from inside the app: the agent shows a pairing code, you enter it, and only then can it read anything. Connected agents are listed in the app and you can disconnect any of them at any time, which takes effect immediately. An agent can only read; it cannot change or delete anything. We do not control what the agent you connect does with what it reads — that is between you and whoever makes it.

Deleting your account deletes this copy along with everything else.

We do not sell, rent, or monetize your personal data or your content. We do not use your conversations to train AI models, and outside of notes you publish and AI Connections, we do not have your conversations in the first place.

We use Google and Apple for sign-in, Apple and Expo to deliver push notifications, and Twilio to verify phone numbers and to connect calls to the phone network (Twilio sees the numbers you dial and the audio of the phone-network leg). Meta transcribes notes on the Mac and receives their audio, except notes you record incognito. WorkOS syncs company directories for organizations that connect one. Each processes only what its job requires, under its own privacy policy. Our servers and attested inference run on infrastructure we control in Google Cloud and Microsoft Azure.

Write to us at support@vertebrae.ai.