Privacy

The controller is Grisha, personally, until a company takes over before any paid use. Ownflow is not a company yet. The address for notices is in the aviso legal. Grisha accepted the tester notice text, version 2026-11-02.1, on 2 Nov 2026.

To ask for access, correction, a copy, deletion, or help, use the support page. The support address will be a mailbox on ownflow.ai. This notice doesn't name it. The app doesn't send email or chat messages on its own. Don't put a recording, a transcript, a screenshot, or a password in the message. Say what broke, and the app version if you have it.

The controller accepted the tester notice text, version 2026-11-02.1, on 2 Nov 2026. You tell the other people on the call yourself. The app won't tell them.

• Sign you in with Google and keep your tester account.
• Dictate on your Mac, including when the cloud is unavailable.
• Send dictation text for cleanup, and selected text for rewrite, when you are online.
• Record a call you start, transcribe it, and draft notes.
• Answer a question about a window on your screen. That uses a vision model.
• Count usage so the beta can stay on the current free plans.
• Let you ask for help without attaching the contents of a dictation or a meeting.
• You can ask for an invite by giving an email address on the Ownflow website. A tester can also suggest someone by email, up to three people. Ownflow stores the address, whether it came from the website or a tester, and when it was asked. Ownflow does not email that person. Grisha decides who is invited. A request is deleted when Grisha invites or declines it, or after 90 days, whichever comes first. The address is not used for anything else. A tester's suggestions are included in that tester's data export and are removed when that tester's account is deleted. The website form and the suggestion control stay off until Ownflow publishes this text and turns the feature on.

The first tester group is expected to have every current feature, including meetings. Screen questions use Groq qwen/qwen3.8-27b. When you ask, the app sends a screenshot of the front window you chose, with your question. It does not send the whole display. Work calls are out. Use it for your own calls and calls with friends. You tell anyone else on the call that you are recording. The app shows you a recording indicator and lets you pause, stop and discard, or drop the other person's channel. It does not notify them.

Data	On your Mac	In the cloud
DataDictation audio and the dictation text	On your MacYes. Recognition runs on the Mac.	In the cloudThe text is sent for cleanup when you are online. The saved dictation row stores timing, length, language and the app that received the paste. It does not store the words.
DataRewrite text	On your MacThe selection is on the Mac.	In the cloudThe text is sent to produce the rewrite. It is not a stored transcript.
DataMeeting audio	On your MacYes. An encrypted spool. A segment is deleted on the Mac after its transcript is saved.	In the cloudPassed through for transcription. Not stored as an audio file.
DataTranscripts, notes, titles, dictionary	On your MacYou can keep local history.	In the cloudYes, in the project database, tied to your account.
DataScreen question	On your MacThe screenshot is the front window, kept in memory for the request. The Mac code does not write it to disk.	In the cloudThe image and the question are sent to Groq for that ask. The server holds them in memory for the request. It does not write them to disk, to Storage, or to the database, and it does not log them. A usage row stores token counts and the model id, not the image or the question.
DataGoogle sign-in	On your MacThe session is kept in the Mac keychain.	In the cloudGoogle receives the sign-in (openid, email, profile). The beta project stores the account.
DataUsage and diagnostic events	On your MacUsage events are not stored on the Mac.	In the cloudCounts, timings and error events. Event details are numbers, not the contents of a meeting.

Regions below are what the provider pages said on 1 Nov 2026, plus the region this project is configured to use. They aren't a claim that every vendor is inside the EU, and they aren't a claim that no vendor trains on data.

Supabase Pte. Ltd.

Role Database, sign-in storage, and the API. Also Ownflow's model storage, the second source of the speech models, used without an account too.

Region This project is in Frankfurt (eu-central-1). The Supabase DPA (version dated 1 June 2026) says data is stored and primarily processed in a region the customer directs, and that Supabase may still process it where a subprocessor or the law requires. The subprocessor list of 12 Oct 2026 names US hosting companies, including Amazon Web Services, Google and Cloudflare.

Training and retention The terms fetched 1 Nov 2026 say Supabase won't use customer data to train a model without prior written consent. The free plan has no daily hosted backup. Nightly dumps run on the operator's Mac. See the retention table.

Deepgram

Role Turns meeting audio into text. Ownflow calls api.eu.deepgram.com with mip_opt_out=true.

Region Deepgram's current data page says that EU host stays in the EU and doesn't fall back to another region. The specific EU country can change. Deepgram's privacy policy, last updated 26 Oct 2021, still says it stores data on servers in the US. Both sentences are on Deepgram's site. A short-lived token doesn't itself force the EU host or the opt-out; the app sets both.

Training and retention Deepgram's default is to keep audio and transcripts for model improvement. The opt-out flag is how Ownflow turns that off per request. Opted-out audio is described as kept only while the request is processed. Usage logs are still kept, and Deepgram says those logs are retrievable for 90 days. Deepgram's subprocessor page lists audio processors including Amazon Web Services, Oracle, Cloudflare, OpenAI and Anthropic.

Groq

Role Cleanup, rewrite, meeting notes, and screen questions. A screen question sends the screenshot and the question. The vision model is qwen/qwen3.8-27b. Cleanup, rewrite and notes tests use openai/gpt-oss-20b. That name isn't evidence that OpenAI sees the text.

Region Groq's data page says retained customer data is in Google Cloud buckets in the United States. The DPA allows processing in the US and other countries, with standard contractual clauses as the stated transfer tool.

Training and retention The services agreement, last modified 22 June 2026, says Groq may not train or fine-tune on inputs or outputs unless the customer allows it. When zero data retention is on, it stops Groq from logging inputs and outputs for reliability and abuse checks.

Google

Role Sign-in only, for this beta. Scopes are openid, email and profile. The Google app is in Testing, for at most 100 test users, on GCP project ownflow-513418.

Region Not pinned to Frankfurt by Ownflow.

Training and retention Not restated here. Google isn't the model provider.

GitHub

Role Hosts the app downloads, the update feed and the first copy of the speech models, in Ownflow's public ownflow-releases repository. Also used without an account.

Region Not pinned to Frankfurt by Ownflow.

Training and retention GitHub receives the download requests, with your IP address. It gets no dictation, account or meeting data from Ownflow.

The evidence, with the page addresses, is in the processor register that ships next to this file in the Ownflow source. Provider lists change. The provider pages were read on 1 Nov 2026. The 2 Nov changes are the vision model, zero data retention, the Mac backups, and account export and deletion.

Data	Intended period	Today
DataTranscript text	Intended period90 days, or sooner if you delete the meeting.	TodayThe daily job deletes transcript text at 90 days.
DataGenerated notes	Intended period12 months.	TodayThe daily job deletes them at 12 months.
DataTyped notes and the meeting title	Intended periodUntil the meeting is deleted.	TodayThe daily job leaves them.
DataDictation text	Intended periodOn the Mac only.	TodayThe database row has no dictation text.
DataUsage rows	Intended period12 months.	TodayThe daily job does not delete them yet.
DataContent-free logs and app events	Intended period30 days.	TodayThe daily job does not delete them yet. Event payloads are numbers.
DataDictionary	Intended periodUntil you delete the term or the account.	TodayThe daily job does not delete terms.
DataScreen image and question	Intended periodNot kept.	TodaySent to Groq for that ask. Not stored by Ownflow.
DataInvite requests and suggestions	Intended period90 days.	TodayA daily job deletes requests older than 90 days. A salted hash of the website visitor's IP address is kept so repeated requests can be limited. The hash is not the IP address itself. The active database drops it within about two hours. Decided addresses are deleted when Grisha decides.
DataDatabase backups	Intended periodSeven days on the operator's Mac.	TodaySupabase does not take a daily backup of a free project. A launchd job on the operator's Mac runs at 03:15 local. It dumps the public, private, and auth schemas with pg_dump. The files sit in the operator's home folder (ownflow-backups). Files older than seven days are deleted. A dump is restored only into a local database, never into the live project. Before that restore is treated as usable, it runs private.replay_account_deletions(), so a deleted account is not brought back. If a deletion record still has an export file path, the restore is not treated as usable. Storage files are not inside a database dump.

You can ask for access, correction, deletion, restriction, a copy, and to object. You can also complain to a supervisory authority. The practical path today:

• You can delete a meeting in the app. Stop-and-discard drops that recording.
• Full account export and full account deletion are in the app, in Settings, on the connection screen. Export downloads your account. Deletion asks you to type delete and to sign in with Google again. A backup can still hold the database copy for up to seven days. A restore replays deletions, as the row above says. Other Macs are not wiped from the Mac where you delete.
• You can still ask for help through the support page. The operator can help.
• Other people on a call are not users of Ownflow. They ask you, the person who recorded. You can pause, stop and discard, or delete their channel.

• It doesn't authorise work calls.
• It doesn't make the app announce a recording.
• There isn't a hidden mode. The panel steps aside when the screen is captured. It isn't invisible.
• It doesn't accept Supabase, Deepgram or Groq terms or DPAs on the controller's behalf.
• It doesn't claim the service is EU-only.
• It doesn't add an analytics product. Diagnostic detail is versions, error codes and timings, not contents.

Source version 2026-11-04.2. The controller accepted the tester notice text, version 2026-11-02.1, on 2 Nov 2026. Provider pages were read on 1 Nov 2026.

This isn't a company privacy policy, and it isn't legal advice.