Security

Encrypted everywhere

Everything between the apps, our server and our providers travels over encrypted connections (HTTPS/TLS). Your account data, notes and meeting recordings are encrypted at rest.

Your data is walled off

Every account's data is locked to that account at the database level, so one account can never read another's, even through a bug in an app. Meeting photos are stored privately and shown only through short-lived links.

We keep as little as possible

• Dictation recordings are never stored. Meeting recordings are deleted as soon as they're transcribed.
• Dictation history stays on your device unless you turn on sync.
• Our server logs contain no dictation, transcripts or notes, and they aren't stored.
• Where a provider lets us delete its copy, we delete it as soon as we have the result; the others delete theirs on their own, generally within days.

Deleting means deleted

When you delete something, its content is wiped from your account immediately. Deleting your account removes everything tied to it, and our encrypted backups age out within 30 days. If deletion can't finish, the app tells you instead of pretending it worked.

Backups only we can open

Daily backups are encrypted before they leave our database, with a key held offline. They are kept for 30 days, then deleted automatically.

Secrets stay on the server

The keys to our AI and payment providers live only on our server. They are never built into the apps, so they can't be pulled out of a download.

Safe sign-in

You sign in with Google, Apple or a one-time code sent to your email. We never handle passwords. Signing out on one device doesn't sign you out everywhere.

AI assistants only with your permission

Connecting an assistant like Claude or ChatGPT uses a standard secure sign-in, where you approve the connection yourself. It can only read your notes unless you also allow small changes, and it can never delete anything. You can see every connected assistant, and whether it can make changes, and disconnect any of them at any time; it loses access immediately.

No tracking in the apps

The apps contain no analytics, advertising or tracking code. On Android, the optional accessibility feature never reads password fields and never sends the contents of your screen anywhere.

Providers held to the same standard

We use a small number of well-established providers for speech recognition, AI text processing, hosting and payments. The ones that handle your voice and text don't train their AI on it, and they process it only to provide their service to us.

Found a problem?

If you think you've found a security issue, please email support@thecktgroup.com. We'll look into it quickly and let you know what we find.