Privacy Policy

Who runs Corder

Corder is a Mac application and the marketing site at getcorder.com, built and operated by a small independent team. Contact for any privacy question, data subject access request, or complaint: hello@getcorder.com. We aim to reply within 5 business days.

What data, where it lives

Corder has two surfaces with separate data flows. The tables below describe each in plain language.

1. The Mac app

The macOS application records audio that plays through your speakers and microphone, transcribes it, and saves a transcript + summary. What happens to that data depends on whether you are signed in, and on your tier.

Without an account

• Recordings, transcripts and the application database live only on your Mac, under ~/Library/Application Support/Corder/.
• Transcription runs on your Mac with a local Whisper model (a one-time 1.5 GB download). Nothing about your meetings leaves the machine. The app only talks to the network to download the model, to check for updates, and to send the diagnostics described below if you leave them on.
• Without an account the app keeps two recordings at a time; delete one to record another.
• When Corder detects a call it keeps a few seconds of audio from before you press Record (pre-roll). That buffer stays on this Mac, becomes part of the recording only if you start one, and is discarded otherwise.

With an account (Free, Pro and Max)

• Audio stays on your Mac. The transcript text, speaker labels, titles, summaries, chapters and meeting metadata are also stored in your Corder account, in a Supabase Postgres database hosted in the EU (Ireland), encrypted at rest and in transit. This is what makes titles, summaries, chapters and sharing work, and it keeps your library if you reinstall. Deleting a meeting in the app deletes it there too.
• Titles, summaries and chapters are generated from the transcript text by Google Gemini, called through our Cloudflare Worker. The audio is never sent for this. We do not store the prompt or the completion anywhere except your meeting record.
• On the Free tier transcription still runs on your Mac. Two exceptions send the audio of that one recording to our cloud transcription provider instead, up to 2 hours of audio a month: when the on-device model is not ready or cannot run on your Mac, and when your Mac decodes far slower than real time. The audio chunks are used to make the transcript and discarded right after.

Sharing a meeting (optional, any tier with an account)

• Nothing is shared until you click Share on a specific meeting. There is no automatic sharing.
• Share creates a private link with an unguessable address. Anyone you send it to can open that meeting in a browser and see its transcript, summary and audio. To make the audio playable in the browser, a compressed copy of it is uploaded to storage in your account at that moment.
• The link works for 30 days, then stops working. Sharing the same meeting again refreshes the link for another 30 days. The uploaded audio copy is removed by a nightly cleanup once the link has expired, 30 days after the last share.

Pro and Max tiers (cloud transcription)

• Audio chunks are uploaded from your Mac to our Cloudflare Worker for transcription. The Worker hands each chunk to Groq (running Whisper large-v3-turbo); when Groq is rate limited the chunk goes to Cloudflare Workers AI (the same model), and as a last resort to OpenAI (whisper-1). We wait for the transcript and discard the audio chunk immediately afterwards; nothing is queued or kept on our side.
• The finished transcript text is sent to OpenAI (gpt-4o-mini) once to tidy punctuation, names and terms. Only text, never audio.
• Usage is metered in hours of audio sent, counting both sides of a call (25 hours a month on Pro, 250 on Max). The meter is a running total, not a copy of the audio.

2. The marketing site (getcorder.com)

The site is a static export hosted on GitHub Pages. It loads up to three third-party analytics scripts. None of these see anything that happens inside the Mac app.

• Microsoft Clarity for heatmaps and session replays. Clarity does not record keystrokes; form inputs are masked. Data lives on Microsoft Azure in the United States.
• Plausible Analytics for aggregate pageview and event counts. Plausible is cookie-less and runs on EU servers. No personal data is collected.
• X (Twitter) Conversion Pixel when a paid ad campaign is live. Used for conversion attribution. You can opt out via X privacy settings.

Sub-processors

We use the following third-party services to operate Corder. Each is covered by the Data Processing Agreement that the provider publishes under its standard terms (for example, Supabase DPA).

Account data

If you create an account on getcorder.com we store: your email address, your display name (which you choose, can edit anytime, and defaults to the local part of your email), an opaque internal user id, your subscription status, and the meetings you recorded while signed in (transcript text, titles, summaries, speaker labels and metadata; the audio only when you share a meeting, see Sharing a meeting above). In the Mac app you sign in with email and password or with Google; on getcorder.com with Google or a one-time sign-in link sent to your email. We use your email for those links, receipts, and any optional product-update emails you opt into in your account preferences. We do not sell, rent, or share this data with anyone outside the sub-processors named above.

Data retention

• Audio chunks at our cloud transcription tier: discarded immediately after the transcript is produced, at most within 48 hours.
• Transcripts, summaries, meeting metadata in Supabase: kept as long as your account is active. You can delete any meeting from the app, which cascades to delete the row, the linked storage object, and all derived data.
• Audio copy uploaded when you share a meeting: kept until the share link expires, 30 days after the last share, then removed by a nightly cleanup.
• Account row, after you click Delete account: deletion happens from inside the Mac app (Profile menu → Delete account, confirmation prompt). The app immediately removes every row tied to your user id (meetings cascade to speakers, segments, summaries, recording metadata) and deletes the recording files stored under your user id; shared audio copies expire with their links. Deleting the account from the Mac app does not cancel a paid subscription yet: cancel it first under Manage subscription, or delete the account from your account page on getcorder.com, which cancels the subscription as well. Your email is unsubscribed from every list. A residual empty auth row may remain in our identity provider (Supabase auth.users) until a scheduled cleanup removes it; that row contains no personal data after the deletion above.
• Billing records (Paddle): retained by Paddle for 7 years to meet tax law in their jurisdictions.
• Web analytics (Clarity, Plausible, X pixel): Clarity 90 days, Plausible 24 months, X pixel 540 days per the providers' defaults.

Diagnostics

• Corder sends anonymous reliability diagnostics: counts of recordings, whether a recording lost the other side on Bluetooth, app and macOS version, and similar aggregate numbers. No recordings, transcripts, titles, speaker names, or audio are ever included, and your email is sent only as a one-way hash. You can turn diagnostics off in Settings.

What we do not do

• No selling, sharing, or licensing your audio, transcripts, summaries, or any derived data.
• No training of any AI model on your data by us. The providers we forward chunks to (Groq, Cloudflare Workers AI and OpenAI for transcription, Google Gemini for summaries) receive only what is needed for that one job under their API terms, and we grant none of them any right to train on it.
• No advertising profiles built from your meetings.
• No third-party bot is added to your calls. The other participants see nothing different in their attendee list.

Your rights under GDPR / UK GDPR / CCPA

You have the right to:

• Access your data. Email hello@getcorder.com with the subject "Data export request" and we will send a machine-readable copy within 30 days.
• Correct inaccurate data. Most fields (name, email, notification prefs) are editable directly in /account; for the rest, email us.
• Delete your data (right to be forgotten). Open the Corder Mac app, click your profile in the top-right, then Delete account. The app removes every meeting + storage object tied to your account immediately. Individual meetings can also be deleted one-by-one from the Library.
• Port your data to another service. Same export request channel as Access; the export is JSON for the database and a folder of files for any cloud-synced audio + transcripts.
• Restrict processing or object to processing. Email us with the specific scope you want restricted.
• Complain to your local supervisory authority. For EU residents the right of complaint is in your country's data protection authority. For California residents, see your rights under the CCPA at oag.ca.gov.

Cookies on this website

Strictly necessary: none. The site does not require any cookie to function.

Analytics: Microsoft Clarity sets a first-party cookie for session continuity. Plausible is cookie-less. The X pixel sets a third-party cookie when loaded. You can block these via browser settings or a tracker blocker; the site still works without them.

Children

Corder is not directed at children under 16. We do not knowingly collect data from minors. If you believe a child has created an account or sent us data, email hello@getcorder.com and we will delete it.

Changes

We will date the next revision at the top of this page and note material changes. For questions, write to hello@getcorder.com.