Privacy Policy

Last updated: October 22, 2026

This policy explains how the sole proprietor Yukiya Matsumoto ("the Operator") handles information in the Tsugra app for iPhone, Apple Watch and Mac ("the App") and in the Operator's server it connects to ("the Server"; together, "the Service"). The Japanese version is the original; if the two differ, the Japanese version prevails.

1. Information we handle and where it goes

1-1. Stays on your device (the Operator does not receive it)

• Recorded audio, transcripts, summaries, tasks, journals, settings, and your own Anthropic API key (kept in the device Keychain).
• Transcription runs on-device with Apple speech recognition by default; audio is not sent out.
• Voice enrollment (voiceprint): a numeric voice feature used to label "me" and "others" is stored only in the device Keychain. It is never sent or synced. A ~14 MB speaker model is downloaded once from Hugging Face; no audio is sent. You can delete the enrollment in Settings.
• Apple Watch recordings are transferred to the iPhone through Apple's WatchConnectivity. Watch diagnostics (numbers and stop-reason codes only; no audio, text or location) are also sent to the iPhone for display in Settings.
• API usage records (numbers only; no conversations, questions, heart rate, location or API keys) are kept on the device for 90 days.
• Mac meeting recording (microphone and system audio) and the live interpreter run on the device (for what "Live meeting notes" sends, see 1-3).
• Calendar (the device calendar): events are written only when you choose "Add to calendar". Only if you turn on "Send Note Taker to calendar meetings automatically" does the App read upcoming events on the device to find meeting URLs and times.
• Google Calendar (only if you choose "Link Google Calendar"): events are read on your device only. See 1-8 below.

1-2. Body data (Health; optional, iPhone only)

• Only if you turn on "Use body data for the daily reflection" (off by default) does the App read heart rate, heart-rate variability, steps, active energy, exercise time, stand and sleep from Health (it never writes to Health). These values are used only to build the day's timeline, notable moments and daily reflection on your device; they are not saved in your records and are not sent to iCloud, the Server or any other third party. The reflection text is written by the on-device AI (Apple Intelligence) or from fixed templates. Stress is an estimate from heart-rate variability, not a diagnosis.
• Only if you also turn on "Add daily totals to the cloud journal" (off by default), when the cloud AI writes your journal, the day's totals and ranges (heart-rate minimum to maximum, steps, sleep time, exercise time and the estimated stress level) are sent to Anthropic together with your conversation summaries, through the Server (or directly with your own API key) (see 1-3). Time-by-time values and raw Health data are never sent. Nothing is sent while iCloud sync is on, and when you turn sync on, journals written with these totals are deleted from your device before anything is uploaded to iCloud.
• Body data is never used for advertising, marketing, sale or data mining, and is not provided to any other third party.
• You can turn either setting off at any time, and revoke read access in the Health app. If you decline, the timeline shows conversations only and everything else keeps working.
• Development builds only (not the public App) can attach heart rate and place (down to town name) to conversations sent to the AI. While iCloud sync is on, these body records are not collected and existing ones are deleted.

1-3. Information sent out for AI features

• For summaries, classification, task extraction, journals, "Ask" and minutes, the transcript, your question and selected past records (and the daily body totals you allowed in 1-2) are sent to Claude by Anthropic, PBC (USA). The App asks for your consent in Settings first.
• "Saved memories" (short notes you add yourself) are stored on your device. Only when you use "Ask" or the journal with the cloud AI are the ones relevant to your question or that day's records (up to 10) sent along. "Highlights" (marks on important moments) are stored on your device and are not sent (they are included in exports you choose to make).
• If you turn on "Live meeting notes" (Mac; Meeting add-on or Pro): only while a meeting is being recorded, the part of the meeting transcribed on your device since the last notes (labelled "Me" / "Them"), the notes so far and the note template you chose are sent through the Server to Anthropic each time new speech builds up (about every 3 minutes; nothing is sent while nobody speaks) to write the notes. Turning it off stops the sending. The meeting audio itself is never sent. If you use "Ask" during a meeting, the meeting's transcript so far is sent with your question too.
• Through the Server: the Server only relays the content to Anthropic and does not store it. To let you re-fetch a result after a dropped connection, the result is kept for at most 10 minutes and then deleted.
• With your own API key: the App sends directly to Anthropic; the Server is not involved. Costs follow your own API agreement.
• If you use the on-device AI (Apple Intelligence), that summary is not sent out.
• Cloud transcription (optional): only if you enable it and consent, the audio file and the API key you set are sent to the OpenAI-compatible transcription service you specify. That provider's terms apply.

1-4. Account and purchases (Server)

• When you sign in with Apple, Google, LINE or Facebook, the Server stores only a hash of that provider's identifier (sub), linked to a random account ID issued by the Operator. It does not store the raw identifier, your email address, your name or your profile picture. If you link several sign-in methods to one account, each hash is linked to the same account ID.
• Purchases: the Server verifies the App Store signed transaction and stores the entitlement (product ID, original transaction ID, expiry, status, appAccountToken) against your account. Payment card data is never collected (Apple processes payments).
• Web purchases (official website): payments are processed by Stripe, Inc.; the Operator never receives card numbers. The Server stores the Stripe checkout session ID, customer ID, subscription ID, the product, payment status, expiry, the claim code and the account ID that redeemed it. Your name, email address and billing address are collected by Stripe for the payment and handled under Stripe's policies.
• Usage: to enforce usage and cost limits the Server stores, per account, request IDs, operation type, state, model used, estimated cost, dates and months, and granted counts (packs). It does not include conversation content.
• It also stores hashes of refresh tokens, temporary sign-in values (nonces) and identifiers of Apple notifications (to prevent duplicates).

1-5. Ads

• The App shows no ads and contains no ad SDK.

1-6. Meeting recorder bot

• When you enter a meeting URL, the Server asks Recall.ai, Inc. (Tokyo region) to send a bot named "Tsugra 記録係" into the Zoom / Google Meet / Microsoft Teams / Webex meeting to record and transcribe it.
• The Server does not store the meeting URL (it is passed to Recall.ai). It stores the meeting title (the event title when sent automatically from a calendar), language, status, seconds used and the transcript (including participants' display names).
• The transcript is kept on the Server for at most 7 days or until the App acknowledges receipt, then deleted (capped at 1.5 MB). Media kept by Recall.ai is requested to be deleted after the transcript is fetched.
• If you turn on "Interpret in chat": during the meeting the Server receives what is said as Recall.ai transcribes it in real time (including speakers' display names), machine-translates it into the chosen language with Claude by Anthropic, PBC (USA), and posts it to the meeting chat through Recall.ai. Every meeting participant can read the translations. To transcribe non-English speech in real time, Recall.ai may use a speech recognition provider (Deepgram, Inc., USA). Utterances waiting for translation are deleted when the meeting ends and translations are not stored (only usage and cost records are kept). The cost is taken from your AI allowance.
• Tell all meeting participants beforehand that the bot will record and transcribe (see section 8).

1-7. Logs

• The Server runs on Cloudflare, Inc. It rate-limits per source (IP address) to stop abuse. The Operator does not write conversation content to logs. Cloudflare may process IP addresses and similar data to run the network.
• The App contains no analytics or tracking SDK. This web page uses no cookies, analytics or external resources.

1-8. Google user data (Google Calendar and Sign in with Google)

This section describes how the App handles information it receives from Google APIs ("Google user data").

• Sign in with Google (only the "openid" permission is requested; never email or profile): used only to sign you in. The Server stores only a hash of your Google identifier (sub); it does not store your email address, name or profile picture (see 1-4).
• What the App reads (only if you choose "Link Google Calendar" and approve on Google's consent screen):
  • Your calendar list (scope "calendar.calendarlist.readonly"): each calendar's ID, name and whether it is your primary calendar. Used so you can choose which calendars to check for meetings, and to show the linked account (your primary calendar ID, i.e. your email address) in Settings.
  • Your events (scope "calendar.events.readonly"): for the calendars you choose, events from 3 hours ago to 7 days ahead — title, start and end time, all-day flag, location, description, video-conference join URL (such as Google Meet), status, your own RSVP response and event ID. Used only to find meeting URLs and times (automatic Note Taker and the Mac meeting panel) and to check whether an event suggested from a conversation is already in your calendar. The App does not read other attendees' names or email addresses.
• What the App writes: The App does not request permission to write to Google Calendar. "Open in Google Calendar" only opens Google Calendar's own event page with a draft filled in; you decide on Google's page whether to save it.
• Where it is stored: Google access and refresh tokens and the linked account are stored only in the device Keychain (this device only; not synced to iCloud Keychain). Events read from Google are held in memory while the App runs and are deleted when you unlink. The IDs of the calendars you chose and markers for meetings Note Taker is scheduled for (event ID and start time, and a hash of the meeting URL) are stored on the device.
• Never sent to the Server: tokens, your calendar list and event contents (descriptions, locations, attendees, etc.) are never sent to the Server. The App talks to the Google Calendar API directly from your device, never through the Server. Google user data is never sent to Anthropic or any other AI provider.
• Sent only when Note Taker joins a meeting: only if you turn on "Send Note Taker to calendar meetings automatically" (or send Note Taker yourself), for that meeting the App sends the meeting URL and scheduled join time to Recall.ai, Inc. (Tokyo region) through the Server, and the event title (up to 120 characters) and scheduled join time to the Server. The Server does not store the meeting URL. The title is stored on the Server as part of the Note Taker history and shown in the App's Note Taker list (retention: section 4).
• What we never do: Google user data is never used for advertising (including personalized, retargeted or interest-based ads), never sold, never given to data brokers, never used to develop, improve or train generalized AI or machine-learning models, and never used to determine creditworthiness or for lending. It is not transferred to third parties except as necessary to provide or improve the features you use, for security purposes, or to comply with law. No person, including the Operator, reads Google user data, except with your explicit consent, where needed for security (such as investigating abuse), or to comply with law.
• Retention and deletion: tokens and events on the device remain until you unlink Google Calendar or delete the App. Note Taker titles on the Server are kept while your account exists and are deleted on request (section 6).
• Revoking access: you can unlink at any time in Settings > Google Calendar > Unlink Google Calendar. Unlinking revokes Google's permission (the tokens are invalidated) and deletes the tokens, chosen calendars and loaded events from the device. Your events in Google Calendar are not deleted. You can also revoke access in your Google Account under Security > Third-party apps & services (https://myaccount.google.com/connections).
• Tsugra's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

1-9. Integrations (sending to Slack, Notion, AI apps and Reminders; exporting to Obsidian)

• Only when you tap "Send" on a record does the App send the record's title, date and time, named participants, summary, minutes, decisions, tasks and insights to the destination you chose. Health data such as heart rate and place information attached to the record, and full transcripts, are never sent. Whatever is written in the summary or minutes text is sent as is, so please check the preview before sending.
• Slack and Notion: using an Incoming Webhook URL you created in Slack, or an internal integration token and destination page you created in Notion, the App sends directly from your device to Slack, Inc. (Salesforce) or Notion Labs, Inc. Nothing goes through the Server, and the Operator never receives the content, URLs or tokens. The Operator has no Slack or Notion app or account and requests no OAuth permission.
• Webhook URLs and tokens are stored only in the device Keychain (this device only; never synced to iCloud Keychain). You can remove them at any time in Settings > Integrations > Unlink. Content you send is kept by each service under its own policies; delete it in that service if needed.
• ChatGPT, Claude and other AI apps: the App sends nothing to AI providers. It only hands the request and the record to you via the clipboard or the share sheet and opens the app (or your browser). You decide whether to paste and send it, and the provider's own policies apply from then on.
• Reminders: only when you tap "Add tasks to Reminders" are tasks added to Reminders on your device (Apple EventKit; if you use iCloud Reminders, Apple's sync applies). Existing reminders are not read.
• Automatic export to Obsidian and similar (only if you choose a folder in Settings > Integrations > Obsidian; off by default): the record's title, date and time, named participants, summary, decisions, next steps, minutes, insights and links to related records (and the transcript only if you turn that on) are written as Markdown files on your device, only into the folder you chose. Nothing is sent to the Server, the Operator or anywhere else. Health data such as heart rate and place information are never exported. If the chosen folder is inside iCloud Drive or a similar service, that service's sync (e.g. Apple's) delivers the files to your other devices. Exported files are not removed automatically when you delete a record in the App (you can choose "Move to _deleted folder" in settings), so delete them yourself when no longer needed. You can revoke folder access with "Disconnect".
• Claude Code and Claude Desktop (MCP): if you register the small program bundled with the Mac app (tsugra-mcp) in Claude Code or a similar tool, that program only reads the exported files in the folder above; it never touches the App's database and makes no network connections. Whether what it reads is then sent to an AI provider (such as Anthropic), and how it is handled, depends on your Claude Code (or similar) settings and that provider's policies.

2. Purposes

• To provide recording, transcription, summaries, journals, search, "Ask", minutes and interpreting.
• To handle sign-in, verify purchases, manage allowances and limits, and prevent abuse.
• To investigate incidents, improve quality and answer inquiries.
• To comply with law.

We do not use information to track you for advertising or sell it to third parties.

3. Disclosure to third parties and external transfers

We do not provide personal data to third parties except with your consent, where required by law, or where Japan's Act on the Protection of Personal Information permits. The table lists the external providers that handle data to deliver the Service, or that receive information when you use a feature.

Information may be transferred to providers located abroad (for example the USA). Data-protection regimes there may differ from Japan's. Each provider handles data under its own privacy policy, and AI providers may retain data for a period; please check their published information. The Operator does not send information to these providers beyond what is needed to provide the feature.

4. Retention

• On-device data: until you delete it (audio per your retention setting; API usage records 90 days).
• Temporary AI results on the Server: at most 10 minutes.
• Meeting transcripts: until acknowledged, at most 7 days.
• Google Calendar tokens and loaded events (on the device): until you unlink Google Calendar or delete the App.
• Slack webhook URLs and Notion tokens (on the device): until you unlink the integration or delete the App.
• Account, purchase and usage records: while the account exists. On your deletion request they are deleted unless law requires retention. When you use "Delete Account" in the App, or Apple notifies an account deletion, the corresponding sign-in links are deleted.
• How to delete your data (also if you signed in with Facebook or another provider): use Settings > Account > Delete Account in the App; the account on the Server and every linked sign-in method (the identifier hashes) are deleted. If you cannot use the App, contact us at the address below.

5. Security

Communication with the Server is encrypted (HTTPS). API keys, voice features and integration webhook URLs and tokens are kept in the device Keychain. The Server uses Apple signature verification, signed tokens, rate limiting and per-account isolated storage to prevent unauthorized access and leaks. No system is perfectly secure.

6. Requests for disclosure, correction, deletion

You may request notification of purposes, disclosure, correction, suspension of use, deletion or suspension of third-party provision of the retained personal data we hold. Contact us below with your request and your account ID (shown in Settings > Account). We will verify your identity and respond within a reasonable period. On-device data can be deleted by you in the App ("Delete record data", "Sign out of all devices"). We cannot delete exported files, OS or iCloud backups, or content already sent to other companies.

7. Minors

Minors should use the Service with the consent of a parent or legal guardian. We do not knowingly collect personal information from children under 13.

8. Recording and consideration for others

The Service records and transcribes conversations. When you record other people you must respect those present and comply with the laws of your country or region (on recording, wiretapping and privacy) and with meeting and workplace rules. Giving notice and obtaining consent where required is your own responsibility. When using the meeting bot, tell all participants beforehand.

9. Changes

We may revise this policy to follow changes in law or the Service. Important changes will be announced on this page or in the App. Continued use after a revision means you accept it.

10. Contact

Operator: Yukiya Matsumoto (sole proprietor)
Contact: support@tsugra.com