Privacy is a data flow.
Here is ours.

You should not need to interpret a privacy slogan to understand where a meeting goes. The processing choices below have different boundaries.

When you use local models

The desktop app stores recordings, transcripts and notes on your device. Local speech and summary models process those files on the device. You do not need to send your meeting to a cloud AI service or create a cloud account for that workflow.

With local models, speech recognition (the built-in Parakeet engine, or Qwen3-ASR through the optional speech worker) and note writing run on your computer, and the recording, transcript and notes are stored there; no account or cloud connection is needed to record.

Model downloads and software setup still need a network connection. Local storage is not the same as automatic encryption of your entire computer: protect your operating-system account, storage and backups.

When you choose an external provider

The selected content is sent to the provider you configure. Its terms, retention and regional processing rules apply. Use local models when a conversation must not leave your device.

A personal Privatemode connection uses its official local proxy to verify and encrypt requests on your device. Other providers have different processing boundaries. Overtalk does not label every cloud connection end-to-end encrypted.

What is different from cloud meeting tools?

With Overtalk's local models, a cloud service does not need to hold your recording, transcript or generated notes. That is a data-flow difference, not a claim that every cloud service trains on your conversations.

Granola documents cloud storage of notes and transcripts and does not retain meeting audio after transcription. Overtalk can retain the original audio on your device so you can replay the passage behind a decision. Granola's security documentation.

Fathom documents a required Google or Outlook calendar connection. Overtalk's local recording and import workflow does not require calendar access. Fathom's privacy policy.

Other privacy-focused apps also offer local transcription, summaries and speaker tools. Overtalk's focus is source review: every note keeps the passage it came from, with project context and optional voice memory. We do not claim those broad features are exclusive to Overtalk.

Privatemode's specific protections

The official proxy checks the remote environment through attestation, then encrypts prompts on the device. Privatemode processes them in hardware-isolated confidential-computing environments in the EU. Its documentation states that prompts and responses are not retained after the request and are not used for training.

Some routing and usage fields remain visible. Operational metadata may be kept for up to 90 days; per-key token usage is retained for billing. Hardware, genuine client software and verified reference values remain part of the security assumptions. Provider trust and retention · Security assumptions.

Is Overtalk GDPR compliant?

No tool makes a deployment GDPR compliant by itself, and Overtalk does not claim to. With local models, the recording, transcript and notes are processed and stored on your computer, so neither Overtalk nor an AI provider receives them. You still need a lawful basis, must tell participants before recording, and handle retention and requests yourself; if you connect your own Privatemode account, Privatemode's terms and data processing agreement apply to what you send. How to tell people you're recording.

Local processing, optional connections and review controls can support responsible data handling. Privatemode provides EU inference and a published data-processing agreement. These do not automatically establish GDPR compliance for every Overtalk deployment: lawful basis, permissions, retention, rights and applicable agreements still depend on your use.

We do not currently claim HIPAA compliance for Overtalk or its planned hosted service. Healthcare use requires reviewing the deployment, operating safeguards and applicable business-associate agreements before sending protected health information. HHS requires appropriate agreements even for cloud processors that cannot decrypt the data. HHS guidance.

Connected tools

Calendar and workspace connections are always optional. They use only the permissions you grant, and every outgoing ticket or document change waits for your review. Connecting an account is a separate choice from recording a meeting.

Automatic filing runs on your computer, from your library and calendar. A brief's talking points are written by the notes model you chose in Settings, the same route your meeting notes take, and a ticket's status is read from the tool it was sent to.

Private AI summaries (planned)

An optional subscription is planned for 200+ hours of meeting summaries a month with advanced private AI models. When you turn them on, Overtalk runs Privatemode's own proxy on your computer. Overtalk downloads it from Privatemode and checks it against pinned hashes; it is not modified or bundled. The proxy verifies Privatemode's servers by remote attestation and encrypts each request on your device with a Privatemode key issued for your subscription. Overtalk's service issues that key; it never receives meeting text or summaries. Transcription stays on your computer. The route is never used unless you turn it on, and it is not on sale yet.

The account service is designed to retain account and payment references, plan periods and which key is issued to which account, not meeting content. Payment checkout is handled by Stripe. Privatemode processes the summaries as a sub-processor under its own terms. Those services require their own published terms before launch.

This website

This is the privacy notice for overtalk.io under Articles 13 and 14 GDPR. The sections above describe the app, which runs on your computer.

Controller

Email: hello@overtalk.io. No data protection officer has been appointed, as none is legally required for a business of this size.

Hosting and server logs

The site is hosted on Cloudflare Workers and delivered through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you open a page, your browser sends Cloudflare the technical data it needs to deliver it and to protect the site against attacks and abuse: your device's IP address, the date and time, the page or file requested, the referring page if your browser sends one, your browser and operating system, and the amount of data transferred.

The legal basis is a legitimate interest in running the site securely and reliably (Art. 6 (1) (f) GDPR). I see aggregated request statistics only, not visitor logs. Cloudflare keeps logs for a limited period for security and deletes them under its privacy policy. Cloudflare operates data centres worldwide, including in the USA; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, and its data processing addendum includes the EU standard contractual clauses.

Email

Email sent to hello@overtalk.io is forwarded to my mailbox by Cloudflare Email Routing. I process your address and message to reply: under Art. 6 (1) (b) GDPR when it concerns a possible or existing contract, otherwise under my legitimate interest in answering correspondence (Art. 6 (1) (f) GDPR). I delete messages once the conversation is concluded, unless German commercial or tax law requires me to keep them (six or ten years).

Contact form

The contact form sends your email address, your message and, if you give one, your name to a Cloudflare Worker on this site, which emails them to my mailbox through Cloudflare Email Routing. The site stores none of it. The legal basis and deletion are the same as for email. To stop the form being flooded, Cloudflare counts messages from your IP address over one minute (Art. 6 (1) (f) GDPR); the email I receive does not include your IP address.

No cookies or tracking

This site has no advertising trackers, analytics scripts, third-party fonts or embedded videos. It sets no cookies of its own and stores nothing in your browser, so it shows no consent banner. Its interactive demo uses the site's own files and never asks for your microphone or camera. Cloudflare may set strictly necessary security cookies while protecting the site. Opening an external link gives that destination its own connection.

Your rights

You have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). Email hello@overtalk.io to use them. You can also complain to a data protection authority (Art. 77 GDPR); the one responsible for me is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany. No automated decision-making or profiling takes place.

Your responsibilities and controls

Get appropriate permission to record. Check generated content. Choose retention, deletion and backup practices appropriate to the people and information involved. Product features alone do not certify an organization as compliant with a law or regulation.

See the repository's app privacy policy and privacy operations guide for the current implementation.