Privacy Policy

Last updated: 27 October 2026

About this policy

This policy describes how MeetSimpler handles information when you use the app and account services. Privacy contact: meetsimpler@gmail.com. Policy version: 2026-10-12.

Account information

Supabase Auth processes the email and password you supply, or Google/GitHub sign-in information. The app does not persist your password. Supabase manages authentication credentials. The Windows app stores a refresh credential and access permit encrypted for your Windows account using DPAPI. Google or GitHub sign-in may provide Supabase with a name, profile photo and provider identifier; MeetSimpler's access service stores account UID and email, not your profile photo.

Devices and connection data

The app derives a device identifier locally from the Windows installation GUID and current user security identifier (SID). Only the derived UUID is sent to the server; the underlying Windows identifiers are not sent. Reinstalling Windows or recreating the Windows user changes this identifier; deleting app account data does not. At access renewal, the server stores the identifier, account association, first/last seen timestamps, last IP address and accepted terms version/timestamp. Each successful online access check, including sign-in and renewal, also records the account UID, installation identifier and server timestamp in a private authentication history. Offline checks do not contact the server or add history. This history does not contain passwords, authentication tokens or IP addresses. The identifier is used for offline permits and possible future subscription device limits. Your IP is used for security, abuse prevention and access administration; it is not a precise location measurement.

Local meetings and optional AI

Meeting recordings, transcripts, summaries, chat history and speech-generation work are saved locally. Ollama and its downloaded models use separate storage. Cloud AI sends only the request content you enable to the configured provider; local AI and specialist local translation run on your PC.

MeetSimpler's account-renewal service does not receive these files. Configured cloud AI requests can transmit your prompts, selected transcript/context, attachments and other requested inputs to your chosen provider. Provider retention and training practices depend on that provider and your settings. Model downloads contact the model hosting services. You control the content selected and must have authority to process other participants' information.

Website and browser sign-in

The website loads release details from its hosted update feed and links to GitHub for downloads. The Supabase JavaScript SDK is served by this website. GitHub Pages, Supabase, Google/GitHub sign-in and cloud infrastructure may collect service logs or essential authentication identifiers under their policies. MeetSimpler adds no advertising analytics. The account page keeps your sign-in session in browser local storage so you remain signed in across visits. Logging out of that browser clears its stored session. Email confirmation and Google/GitHub sign-in return to the account page. Desktop browser pairing uses a separate PKCE flow, temporary tab session storage, and an expiring one-time pairing request. Browser credentials are cleared after handoff without revoking the desktop session. That request temporarily contains authentication tokens only on the server; it expires after five minutes and is deleted upon successful desktop exchange. Expired exchanges are rejected immediately. Scheduled cleanup removes expired pairing and rate-limit records every five minutes.

Purposes and legal bases

We process account and device data to provide the requested account/access service, secure it, prevent misuse, handle support, and meet legal obligations. Where relevant, contractual necessity or legitimate interests support essential processing; consent is obtained where required. Acceptance of Terms is not consent for advertising. No marketing mailing list is enabled by registration. Your privacy rights depend on the laws that apply to you.

Sharing and transfers

Service providers include Supabase, Google and GitHub for authentication, Postgres and Edge Functions; GitHub for hosting/downloads; and providers you configure for AI and model downloads. Service providers may process data in different locations under their applicable privacy policies. We do not sell account data. Disclosures may also occur when lawfully required or necessary to protect legal rights.

Retention and deletion

Account/device records and successful online authentication history are retained while the account is active for the access service. You can permanently delete your account from the account page after signing in and confirming deletion. You can also request deletion through support, subject to identity verification and applicable legal requirements. Infrastructure logs and backups follow the relevant provider's retention policies. Rate-limit records expire after ten minutes, and pairing records after five minutes. Expiry prevents further use of these records; physical removal depends on cleanup. Account deletion requests cover Supabase Auth, account/device records, successful online authentication history and pending pairing credentials. Retain information only where necessary for an identified legal or security purpose. Deleting an account does not remove files on your computer. Remove your local meeting folder and app account data separately if desired.

Your choices and rights

Email meetsimpler@gmail.com for access, correction, deletion, export, objection, restriction or withdrawal requests as applicable. We verify identity proportionately and respond within applicable legal deadlines. Required account/device processing cannot be disabled while continuing online access renewal. You may stop using the service and request account deletion. You may complain to the privacy regulator responsible for your location.

Security and incidents

Controls include HTTPS, server-verified Supabase identity, server-signed offline permits, Windows credential encryption, restricted Postgres client access using row-level security and limited token handoffs. No system guarantees absolute security. Applicable law may require notification of certain security incidents. Do not send passwords or API keys in support email.

Changes

Material changes will be announced where required. The updated policy and its revision date will be published on this page.