Private by default

We never read your transcripts

Your notes are private to your account. We don't pool them with anyone else's, we don't read them, and they're not used to improve Nod or train a model.

The rest of this page is how that's enforced rather than just promised. The security page documents all of it in more detail if you want the specifics.

What happens to your audio

Nod captures the audio your Mac is already playing, through native macOS APIs. No bot dials into the call, so nobody sees a new participant. An on-device model then cuts that stream into complete utterances of roughly five seconds.

Each chunk is sent over an encrypted connection to a transcription service, and Nod releases the bytes when the text comes back. Nod never writes or retains an audio recording. Groq may retain transient error or abuse logs for up to 30 days unless Zero Data Retention is enabled.

Your audio does leave your Mac. Capture and voice detection happen on-device, but transcription and summarization don't. They run on hosted inference providers, and Whisper transcription in particular runs on infrastructure outside the EU, under EU-U.S. Data Privacy Framework adequacy and standard contractual clauses. Nod is local capture with cloud inference, not a fully offline note taker. If your requirement is that nothing may ever leave the machine, you want a different architecture, and the honest options are covered in on-device Mac note takers.

What we can promise is that no provider trains on the data and Nod creates no retained recording. OpenRouter routes use Zero Data Retention; Groq's limited logging exception is disclosed above and on the security page.

Where your notes live

What gets saved is the transcript and the notes built from it, and those stay in the EU.

• Supabase Postgres in Ireland (AWS eu-west-1), with auth and server-side functions in the EU too
• TLS 1.2+ on every connection (TLS 1.3 by default; TLS 1.1 and below are rejected), AES-256 at rest
• Row-Level Security on every table, so the app can only serve you your own rows
• No training on your data, by us or by the providers we route through, and "may train on request data" routes disabled
• No provider API key on your Mac; calls go through our own EU proxy, authenticated as you

Nothing is shared unless you share it

Your meetings are visible to you and nobody else by default. Joining an organization changes nothing about that: there is no shared inbox, no admin view of your recordings, and no colleague, manager, or admin quietly holding a copy.

The exceptions are the ones you trigger yourself. When you turn a summary into a share link, anyone holding that link can read it, which is what a share link is for; the link covers one meeting's summary, never the transcript or your other meetings, and you can revoke it whenever you want. When you share a folder or a single finished meeting with a team, the people on that team can read its summary, transcript and action items until you remove the share, which ends their access immediately. It's worth saying out loud, because "private by default" is a claim about the default and not about what you're allowed to do next. What a team gets from that, and what it never gets, is on team context.

Your data is yours to take back

All of this is self-serve from inside the app. You don't have to email us or wait on a support ticket.

• Export everything as one machine-readable JSON file, from Settings → Privacy → Export my data (GDPR Articles 15 and 20)
• Export any meeting as a plain Markdown file that Obsidian or any editor reads
• Delete a meeting and it goes to a trash that's permanently purged 30 days later
• Delete your account and it cascades across every table holding your data: meetings, transcripts, summaries, chats, embeddings
• Any live subscription is cancelled when you delete, so you're never billed after leaving

What we don't have yet

No SOC 2. It's planned, but the audit hasn't started, so there is no report to send you today. We'd rather say that than put an "in progress" badge in the footer and hope nobody asks who the auditor is. SOC 2 also isn't the thing that keeps your audio from being stored; the controls above are, and you can check those today. A GDPR DPA is available on request.

No SSO or SAML. Sign-in is Google OAuth, with OpenID, email, and profile scopes only, so Nod never gets read access to your Gmail, Calendar, Drive, or contacts.

No bring-your-own-key in the app today. If you need it, say so: dmytro@hellonod.app.

Nod is built and run by its founder, Dmytro Barabash, not a company with a security department. That's a real limit, and it's why the claims on this page are written so you can check them. Start with the security page and the privacy policy.

Frequently asked questions