Privacy Policy

Recording and consent

The App uses the microphone only in the following situations, each of which you start yourself: (1) during a recording you start by tapping Record; (2) while recording a voice sample in “Register a Speaker’s Voice” in Settings (up to 6 seconds); (3) while you talk with Hime through “Ask Hime about this recording.” Merely opening the App never uses the microphone or starts continuous recording. Follow local law and notify or obtain consent from participants when required.

Data stored on your device

Audio, transcripts, speaker names, summaries, tasks, highlights, photo notes, coarse region names, and edited titles are stored in the App's protected container. Recovery manifests include time, audio route, size, and SHA-256 integrity data. Local data remains until you delete it.

Data sent for AI processing

Only if you allow AI analysis, when you use AI features with AVR Pro or with your own API keys (the personal key option; see “Personal API keys”), the following data is sent through our (NextCode’s) AI relay server (the HIME API, running in Vercel’s Tokyo region), encrypted with TLS, to OpenAI (United States) or Google (Gemini API, United States). [Data sent to OpenAI] (1) Real-time conversation (when OpenAI is selected): audio during recording (throughout recording in HIME Live; in Privacy mode, after the device detects “Hime”), plus the meeting summary, recent statements, and vocabulary terms. With “Ask Hime about this recording,” that recording’s summary, the end of its transcript, vocabulary terms, and the audio of what you say. (2) Official transcription: audio of the whole meeting (including some segments extracted to check accuracy), your vocabulary list, and the voice samples and registered names of all registered speakers (see “Registered speaker voices”). (3) Summaries: the transcript including speaker names and times, plus the selected template and any custom instructions. (4) Ask Hime about all recordings: your question and, for up to 30 recordings, their titles (including region names) and transcripts including speaker names and times. (5) Chinese text correction: some statements from the official transcript and your vocabulary list. [Data sent to Google (Gemini API)] (6) Real-time conversation (when Gemini Live is selected in Settings): the same data as in (1), sent to Google instead of OpenAI. (7) Cross-checking official transcription: if you have registered a Gemini API key in the personal key option, official transcription of a recording of 30 minutes or less (during accuracy-priority reanalysis, or when no speaker voices are registered) sends the audio of the whole meeting and the language setting to Google, compares the result with OpenAI’s, and adopts one of them (the one closer to the expected number of speakers, if you have set it). The audio is uploaded temporarily to Google’s file storage and deleted at our request when processing ends. Registered speaker voice samples are not sent to Google. (8) Meeting Replay: when you use “Meeting Replay” in a recording’s details, speaker names, the text of statements (the transcript), and the language setting are sent to Google to create synthesized speech with a voice for each speaker. In the personal key option, data is sent to Google with your own Gemini API key. As of September 14, 2026, we do not offer Gemini usage with our own key. Before we start offering it, we will update this policy. This data includes the voices and statements of people who took part in the recording. If you do not allow AI analysis, or use neither AVR Pro nor the personal key option, only recording, playback, editing, search, export, and on-device transcription (supported languages) are available, and nothing is sent to an external AI. On-device transcription (Apple speech recognition) is processed only on the device, and audio is not sent to Apple’s servers. In languages that on-device speech recognition does not support, the recording is saved but no on-device transcription is performed.

Registered speaker voices

You may optionally register voice samples (2–6 seconds per person, up to 4 people) and names for yourself or meeting participants. Because voice samples are used to tell speakers apart by the characteristics of their voices, they are biometric-related information that can identify a person (depending on local law, they may be treated as biometric information or voiceprints).

• Storage: Stored in this iPhone’s protected container and excluded from iCloud backup and encrypted sync.

• Transmission: Each time official transcription runs in AVR Pro or the personal key option with AI analysis allowed, the voice samples and registered names of all registered speakers are sent with TLS through the HIME API (Vercel, Tokyo region) to OpenAI (United States) and used to identify speakers by their registered names. Samples are sent even for people who did not take part in that recording. Speaker identification is performed by OpenAI’s model while it processes the official transcription; we (the App and the HIME API) do not create, receive, or store numerical representations of voice characteristics. The HIME API handles voice samples only during processing and does not store them in databases, audio storage, or logs. They are not sent to Google (Gemini API).

• Retention period: One year from the date of last use (the later of the date of registration and the date last used for official transcription).

• Destruction: Voice samples more than one year past that date are not sent and are deleted from this iPhone the next time you open the App. Before then, you can delete them speaker by speaker from “Register a Speaker’s Voice” in Settings. They are also deleted when you use “Permanently delete all recordings” and when you delete the App.

• Consent: We do not provide a way to obtain consent directly from the people whose voices are registered. Before registering another person’s voice, explain the purpose and where it is sent, and obtain that person’s consent.

Cloud retention and encrypted sync

The HIME API places audio chunks for official transcription in private temporary storage (Vercel Blob) and deletes them when processing ends, whether it succeeds or fails. Chunks for which transcription did not run are also deleted automatically within 3 hours. Only when optional Device/Web/Desktop encrypted sync is enabled, the App encrypts transcripts, summaries, speaker names, tasks, notes, coarse locations, titles, audio, and photos with AES-256-GCM before storing ciphertext in Supabase. Only the content is encrypted. The following information needed to manage sync is stored in Supabase without encryption: an ID for each recording, update and deletion times, the data format version, the random value used for encryption (nonce), and, for each audio or photo chunk, its ID, number, size, storage path, and storage time. When you first sync, a sync account is also created with Supabase’s authentication service. It records an identifier and an authentication value calculated from the sync code (the authentication value is stored as a hash; neither is the sync code itself), the install ID of the device that started sync, the creation time, and the time of the most recent sync request. The install ID is linked to device verification records and purchase status (product ID, original transaction ID, and expiration date). Another iPhone using the same sync code can synchronize this data in both directions. The sync code and decryption key never reach the server, so we cannot decrypt the encrypted content. Ciphertext remains until you use “Permanently delete cloud ciphertext” in Settings; uninstalling the App alone does not delete it. Requests to OpenAI that support a storage setting (real-time conversation, summaries, questions, and Chinese text correction) set store: false. Even with store: false, OpenAI’s retention for abuse monitoring (up to 30 days) still applies (see section 3 of “Transfers to third parties in foreign countries”).

Location

At recording start, location may be converted to a prefecture, city, or similar coarse name for automatic naming. Exact latitude and longitude are not retained. Recording works without location access. To convert it to a region name, the latitude and longitude of the approximate location obtained at recording start are each rounded to two decimal places (about 1 kilometer) before they are sent to Apple’s geocoding service. Unrounded coordinates are not sent. Location coordinates are not sent to our servers.

Personal API keys

If you choose the personal key option, your own OpenAI API key and Gemini API key are stored in this iPhone’s Keychain (with a setting that keeps them on this device only). When you save a key, the device sends it directly to OpenAI or Google to check the connection (no recording content is sent). When you use AI features, the key is sent with TLS to the HIME API (Vercel, Tokyo region), which uses it to make requests to OpenAI or Google. Keys are not stored in HIME databases, audio storage, or logs. In production, the server also requires device verification with App Attest for requests in the personal key option (device verification records are stored in Supabase). Requests processed with your own key do not use the AVR Pro allowance (requests processed with our key do). Charges apply to your own OpenAI or Google account. How the data you send is handled (retention period, human review, and use for training or product improvement) follows your contracts with OpenAI and Google and your account settings. With a key for Gemini’s Unpaid Services, Google uses the content to improve its products and people may read it (see section 3 of “Transfers to third parties in foreign countries”). You can delete keys in Settings at any time.

Deletion

You can permanently delete audio, transcripts, summaries, tasks, and photo notes from a recording or delete all recordings in Settings. Trash can be restored until Permanent Delete is used. Temporary cloud audio is deleted automatically. “Permanently delete cloud ciphertext” in “Manage sync code” in Settings permanently deletes synced ciphertext, sync management information, and the sync account, and also deletes the sync code from this device. Uninstalling the App removes local data and settings. However, the sync code (the key used to decrypt the ciphertext) is stored in the device’s Keychain, so it is not deleted when you uninstall the App. To stop syncing on this device, use “Delete the synchronization code from this device” in “Manage sync code” before uninstalling the App. To also delete the cloud ciphertext, use “Permanently delete cloud ciphertext” instead. Uninstalling the App alone does not delete the cloud ciphertext. Registered speaker voice samples can be deleted speaker by speaker in Settings and are also deleted by “Permanently delete all recordings.” Samples more than one year past their last use are deleted automatically. Personal API keys are also stored in the device’s Keychain, so they are not deleted when you uninstall the App. To remove a key, delete it in the personal API key area of Settings before uninstalling the App.

Tracking and security

We do not use advertising tracking, behavioral tracking, or sell data to advertisers. iOS data protection is used while allowing user-started recording to continue on the lock screen. Secrets and full transcripts are not written to diagnostic logs.

Service providers

We use OpenAI (United States) and Google’s Gemini API (United States; for real-time conversation when Gemini Live is selected, cross-checking official transcription, and Meeting Replay) for AI processing; Vercel (Tokyo region), provided by Vercel Inc. (United States), for API execution; Vercel Blob for temporary audio storage during official transcription; and Supabase (Tokyo region) to store device verification records, purchase status, AI usage records, and data for optional encrypted sync (ciphertext, sync management information, and the sync account). We use Apple’s geocoding service to convert locations to region names. For provision to OpenAI, Google, Vercel, and Supabase, see “Transfers to third parties in foreign countries.” Each service’s own privacy policy also applies.

Transfers to third parties in foreign countries

1. Recipients and countries

• OpenAI (United States of America): the data described in items (1) to (5) of “Data sent for AI processing” and in “Registered speaker voices.” AI processing does not necessarily take place in Japan.

• Google (Gemini API; Google LLC in the United States of America or another Google legal entity that Google’s terms name as the contracting party): the data described in items (6) to (8) of “Data sent for AI processing.” Google states that data may be stored transiently or cached in any country in which Google or its agents maintain facilities, so the country where it is processed cannot be identified. Section 2 describes the system of the United States of America, where Google LLC is located.

• Vercel Inc. (United States of America): as the infrastructure for our AI relay server (Tokyo region) and for temporary audio storage during official transcription (Vercel Blob), it handles the data above while it is being processed (data sent to OpenAI and Google, and API keys in the personal key option), as well as communications for device verification and purchase status checks.

• Supabase (we are still confirming the legal entity that is our contracting party and its country): stores device verification records (install ID), purchase status, AI usage records, and data for optional encrypted sync (ciphertext of the content, unencrypted sync management information, and the sync account; see “Cloud retention and encrypted sync”). Data is stored in the Tokyo region. Once the country is confirmed, we will add the country name and its privacy system to this section.

2. The personal information protection system of the United States of America

(Source: Personal Information Protection Commission of Japan, “Survey on Systems for the Protection of Personal Information in Foreign Countries.” Information as of October 2021, updated January 25, 2022.)

• There is no comprehensive federal law on the protection of personal information. Personal information is protected by sector-specific federal laws, such as the Electronic Communications Privacy Act, the Gramm-Leach-Bliley Act (financial sector), and the Health Insurance Portability and Accountability Act (healthcare sector), and by state laws.

• The United States has participated in the APEC Cross-Border Privacy Rules (CBPR) system since July 25, 2012.

• The survey does not identify any system that requires personal information to be stored within the country, or any system that requires businesses to cooperate with government information-gathering activities, that may significantly affect individuals’ rights and interests. However, businesses in the United States may also be required by law to provide information, for example for criminal investigations.

• We check at least once a year for changes to the system made after this survey and reflect them in this section.

Reference: https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/

3. Measures taken by the recipients (in light of the eight OECD Privacy Guidelines principles)

[OpenAI]

① Collection limitation: OpenAI receives only the data we send and does not collect it directly from individuals (when a key is saved in the personal key option, the device sends only the key directly to OpenAI to check the connection).

② Data quality: Individuals can review and correct errors in transcripts and summaries with the App’s editing features.

③ Purpose specification and ④ Use limitation: The processing we ask OpenAI to perform is limited to real-time conversation, transcription, summaries, answers to questions, and Chinese text correction. OpenAI states in its public documents that it does not use data received through its API to train or improve models unless the customer chooses to share it.

⑤ Security safeguards: Communications between our AI relay server and OpenAI are encrypted with TLS.

⑥ Openness: OpenAI states in its public documents how long API data is retained, whether it is used for training, and where it is located.

⑦ Individual participation: We accept requests for disclosure, correction, deletion, suspension of use, and similar actions concerning data sent through us.

[Measures not taken, or not yet confirmed by us]

• OpenAI states in its public documents that, to monitor abuse, it retains logs of requests such as real-time conversation, summaries, and questions for up to 30 days and that people may review them (requests for official transcription are stated to be outside this retention). We do not hold approval to exclude our data from these logs (Zero Data Retention or Modified Abuse Monitoring). Data for real-time conversation, summaries, questions, and Chinese text correction processed with our key (including the voices and statements of people who took part in a recording) may therefore be retained for up to 30 days and reviewed by people.

• In the personal key option, the contract with OpenAI and the handling of data (retention, human review, and whether data is shared for training) follow the contract and settings of the user’s own OpenAI account. We cannot check them.

• We are still reviewing the clauses and documents to confirm whether our contract with OpenAI (data processing addendum) provides that OpenAI processes data only on our instructions, keeps it confidential, imposes equivalent obligations on subprocessors, notifies us of leaks and similar incidents, cooperates in responding to individuals’ requests, and deletes or returns data when the contract ends (corresponding to ③④⑦⑧), and to confirm OpenAI’s third-party certifications and audit reports (corresponding to ⑤). Until that review is complete, we do not state that these measures are in place.

[Google (Gemini API)]

① Collection limitation: Google receives only the data we send and does not collect it directly from individuals (when a key is saved in the personal key option, the device sends only the key directly to Google to check the connection).

② Data quality: Individuals can review and correct errors in transcripts with the App’s editing features.

③ Purpose specification and ④ Use limitation: The processing we ask Google to perform is limited to real-time conversation (Gemini Live), cross-checking official transcription, and speech synthesis for Meeting Replay. In the Gemini API Additional Terms of Service, Google states that for Paid Services (use through a Cloud project associated with an active billing account) it does not use prompts or responses to improve its products and processes them in accordance with the Data Processing Addendum for Products Where Google is a Data Processor.

⑤ Security safeguards: Communications between our AI relay server and Google are encrypted with TLS. Audio uploaded to Google’s file storage for cross-checking is deleted at our request when processing ends.

⑥ Openness: In the Gemini API Additional Terms of Service, Google publishes how data is used for Paid Services and for Unpaid Services.

⑦ Individual participation: We accept requests for disclosure, correction, deletion, suspension of use, and similar actions concerning data sent through us.

[Measures not taken, or not yet confirmed by us (Google)]

• Google states that for Unpaid Services (keys for projects not associated with an active billing account), it uses the content submitted and the generated responses to provide, improve, and develop Google products and services and machine learning technologies, and that human reviewers may read, annotate, and process API input and output to improve quality (Google states that it disconnects the data from the Google Account, API key, and Cloud project before reviewers see or annotate it). Google also asks users not to submit sensitive, confidential, or personal information to Unpaid Services. If your own Gemini API key in the personal key option falls under Unpaid Services, recording audio and statements (including the voices and statements of people who took part in the recording) are handled this way.

• Google states that even for Paid Services it logs prompts and responses for a limited period of time to detect and prevent violations of its Prohibited Use Policy and for required legal or regulatory disclosures. The terms do not state the length of that period.

• Google states that data may be stored transiently or cached in any country in which Google or its agents maintain facilities, so the country where it is processed cannot be identified.

• In the personal key option, the contract with Google (whether use counts as Paid or Unpaid Services and whether the Data Processing Addendum applies) is between the user and Google, and we cannot check it. As of September 14, 2026, we do not offer Gemini usage with our own key, and we have not confirmed whether a contract with Google provides for processing only on our instructions, management of subprocessors, notification of leaks and similar incidents, cooperation in responding to individuals’ requests, and deletion when the contract ends (corresponding to ③④⑦⑧), or Google’s third-party certifications (corresponding to ⑤). Until that is confirmed, we do not state that these measures are in place.

[Vercel Inc. and Supabase]

Communications from us to each company are encrypted with TLS. For encrypted sync, recording content is stored as ciphertext encrypted on the device with AES-256-GCM, and neither we nor these companies can decrypt it. However, the information needed to manage sync (recording IDs, dates and times, chunk numbers, sizes, and similar) and the sync account are stored without encryption. We accept requests from individuals. We are still checking the clauses of our contracts with each company (data processing addenda) and their audit reports. Until that check is complete, we do not state that other measures corresponding to the eight principles are in place.

4. Legal basis for provision

We provide the data after showing the content of this section in the App and obtaining the consent of the user (Article 28, Paragraph 1 of the Act on the Protection of Personal Information of Japan). Provision to OpenAI, Google, Vercel, and Supabase, and provision in the personal key option, all rely on this consent. This consent does not extend to other people who took part in a recording or to registered speakers other than the user, because we have no means of obtaining their consent directly. We ask users to tell participants where AI data is sent and to get their agreement before recording or registering them.

5. Review and contact

At least once a year, we check for changes to each company’s contracts and public documents and to each country’s system, and update this section. For questions about this section, contact info@usmc.jp.

Contact

For privacy or deletion questions, contact info@usmc.jp. Material changes will update the date on this page and may also be announced in the App.