Where Does Your Meeting Audio Go? We Read the Privacy Policies of 7 AI Note Takers

Introduction

AI note taker privacy comes down to four questions: does the app train AI models on your meetings, how long does it keep your audio, who can access your content, and where does the processing happen? We read the current privacy policies of seven popular apps and answered all four questions for each one.

Most "is this app safe" articles rank tools on vibes and marketing pages. We went to the primary sources instead: the policies themselves, as posted in early August 2026, with version dates and links so you can check every claim.

By the end of this post you will know exactly which apps use meeting content to improve their AI, which ones delete audio quickly, where the gray areas are, and how to run this same audit yourself on any tool in about ten minutes.

Note (info callout): This article summarizes policy documents as of August 3, 2026. Policies change, and this is not legal advice. We link every source so you can read the current version yourself, and we will update this post when the policies change.

Key Takeaways

Tip callout:

• Otter's policy describes training its own AI on de-identified recordings and transcripts, and it shares content with data labeling vendors.
• Fireflies and tl;dv both state that customer content is not used to train AI models.
• Granola deletes raw audio once your transcript exists. tl;dv deletes free accounts' recordings after 3 months.
• Notta's posted policy does not state a retention period for recordings, which is a finding in itself.
• Every cloud policy is a promise that can change with an update. On-device processing, like MeetingsAI's Private Mode, is a property of the software instead.

How We Compared AI Note Taker Privacy Policies

We picked seven widely used meeting note apps: Otter.ai, Fireflies.ai, Fathom, tl;dv, Notta, Granola, and MeetingsAI. For each one, we read the privacy policy posted on its official site on August 3, 2026, noted the version date, and answered the same four questions:

1. Model training. Is customer meeting content used to train or improve AI models, and can you turn that off?
2. Retention. How long do audio and transcripts live on the company's servers, and what does deletion actually mean?
3. Human access. Can employees or contractors ever see or hear your content?
4. Location of processing. Does audio leave your device, and where does it go?

We deliberately did not score marketing pages, security badges, or certifications. A SOC 2 report tells you a company follows its own procedures. The privacy policy tells you what those procedures allow. When a policy was silent on a question, we say so, because silence is an answer too.

What Each AI Note Taker's Privacy Policy Actually Says

Otter.ai

Policy version: updated June 16, 2026. Read it here.

Otter's policy is the most explicit about model training in this group. It describes training Otter's proprietary AI technology on de-identified audio recordings and on transcriptions, and it notes that those transcriptions may contain personal information. The policy also lists data labeling providers among the parties that receive user content, meaning third-party annotators can work with data Otter shares to build training and evaluation sets.

On retention, the policy uses open-ended language: personal information is stored for as long as needed for the purposes in the policy or as required by law. No specific timeframe for audio or transcripts is given. Content also flows to cloud hosting (Amazon Web Services), AI service providers, and any calendar or conferencing integrations you connect.

Context worth knowing: a federal class action, In re Otter.AI Privacy Litigation, argues that Otter's assistant recorded meetings without all-party consent. The motion to dismiss was heard on July 15, 2026, and no ruling had been issued when we published. The case tests consent, not the policy terms above, and no court has found Otter's practices unlawful.

Fireflies.ai

Policy version: updated March 6, 2026. Read it here.

Fireflies takes the strongest written anti-training position of the cloud apps. Its policy states that personal information is not used for AI model training and that vendors are contractually barred from training their own models on it. It also describes a zero data retention arrangement with processing vendors: meeting audio, video, transcripts, and summaries are not stored by third-party vendors after processing ends.

Your content still lives on Fireflies' own servers until you remove it. If you close your account, the policy commits to deleting account data within 30 days. Fireflies also publishes a subprocessor list on its trust page, which makes independent verification easier than most apps in this group allow.

Fathom

Policy version: updated August 11, 2025. Read it here.

Fathom sits in the middle. Its policy says the company may create de-identified data from meeting content and use it to train and improve Fathom's in-house AI models. The difference from Otter: there is a documented off switch, and the policy points you to account settings to opt out. It also states that outside AI providers such as OpenAI and Anthropic are not authorized to train on user data.

Retention mirrors Otter's open-ended approach: information is kept as long as necessary for the stated purposes. On deletion, Fathom commits to commercially reasonable efforts to remove recordings and personal information within 30 days of a request, while noting legal obligations can override that.

tl;dv

Policy version: updated July 1, 2026. Read it here.

tl;dv's policy states that customer content is not used to train, fine-tune, or improve foundation models, large language models, or other generative AI. It is also one of the only policies with concrete retention numbers: recordings on free accounts are kept for 3 months, while paying customers keep content until account deletion.

On human access, the policy says employees do not access recordings or transcripts unless you personally grant support access. Storage runs primarily in the EU (Germany and Finland), though AI processing can occur in the US depending on the hosting preference you pick in settings. For EU-based readers, that combination of stated retention, restricted access, and EU storage is the most specific in this comparison.

Notta

Policy version: effective March 11, 2025, still the posted version when we checked. Read it here.

Notta's policy is where we found the least. It says recordings and inputs are used to provide the service and to analyze and improve it, which is broad language without a training carve-out or an off switch. The only explicit AI training statement we found concerns Google Workspace API data, which is narrow and does not address your uploaded recordings either way.

More notably, we could not find any stated retention period for audio or transcripts anywhere in the policy text. You get standard privacy rights, including deletion on request, but nothing says how long content sits on Notta's servers if you never ask. If retention matters to you, get an answer from Notta support in writing before uploading anything sensitive.

Granola

Policy version: updated July 24, 2026. Read it here.

Granola has the cleanest audio story of the cloud apps: recordings exist only to produce your transcript. In the policy's words, "We do not retain or store such recordings once the transcription is created." Your notes, transcripts, and summaries do remain in Granola's cloud until you delete them.

On training, Granola uses aggregated, de-identified data to improve its AI, with controls in account settings, and Enterprise accounts are excluded by default. Like Fathom, it states that third parties such as OpenAI and Anthropic are not allowed to train on personal data. Deletion requests go through the app dashboard or Granola's privacy contact.

MeetingsAI

Full disclosure, this is our app, so here is the honest version of the same four answers.

MeetingsAI has two modes, and they behave differently. In Standard Mode, audio goes to cloud services for transcription, and transcripts can be stored to power sync across devices. That is the same basic shape as the apps above, and you should judge it by the same standard.

Private Mode is the difference. Everything runs on your phone: speech recognition uses Apple's on-device models, summaries are generated locally, and storage is encrypted on the device. No audio or transcription data leaves your phone, it works with no internet connection at all, and core features work without creating an account. There is nothing on a server to retain, train on, or subpoena, because nothing was sent.

The Same Four Questions, Side by Side

Who uses your content to improve AI models?

• States it does, no documented opt-out in the policy: Otter (de-identified)
• Does it, with an off switch in settings: Fathom (de-identified), Granola (aggregated, Enterprise excluded by default)
• States it does not: Fireflies, tl;dv
• Unclear, broad improvement language only: Notta
• Nothing reaches a server to train on in Private Mode: MeetingsAI

How long does your audio live in the cloud?

• Deleted as soon as the transcript exists: Granola (raw audio)
• Concrete timelines: tl;dv (3 months on free accounts), Fireflies (account data gone within 30 days of closing your account)
• As long as necessary, no number given: Otter, Fathom
• No retention period stated at all: Notta
• Never uploaded in Private Mode: MeetingsAI

Can humans see your content?

• Data labeling vendors receive shared content: Otter
• Support staff only, and only if you grant access: tl;dv
• Policies are largely silent on routine human access: the rest. Treat silence as a question to ask, not a guarantee.

Where does processing happen?

Every app above processes audio in the cloud. tl;dv commits to EU storage with a US option for AI processing. MeetingsAI's Private Mode is the only configuration in this group where processing happens on the device itself.

Why On-Device Processing Changes the Question

Everything you just read is a promise. Some of these promises are strong, dated, and specific, and the companies behind them deserve credit for that. But a promise in a policy can be rewritten in the next update, and most policies reserve exactly that right. You are also trusting every subprocessor downstream of the promise.

On-device processing is a different kind of answer. When transcription and summarization happen locally, the privacy policy has less to govern, because the sensitive material never leaves your hardware. We wrote about this distinction in why meetings are the worst place for a cloud round-trip: a meeting leaks strategy, personnel issues, and customer names in a single breath, which makes it the worst possible payload to ship to servers you cannot see.

That is the design bet behind Private Mode, and it pairs with the other structural choice we made: no bot ever joins your call. If you want the wider landscape on that, our bot-free AI note takers comparison covers it in depth.

How to Audit Any AI Note Taker in 10 Minutes

You do not need a lawyer to repeat what we did. Here is the routine:

1. Find the policy and its date. An undated or years-old policy for a fast-moving AI product is your first red flag.
2. Search the text for "train", "improve", "de-identified", "retain", "delete", and "service providers". These six words surface 90 percent of what matters.
3. Look for numbers. Vague purpose language is normal. The absence of any concrete retention number is worth a support email before you upload sensitive audio.
4. Check for a subprocessor list. Companies that publish one (like Fireflies) are inviting verification. That is a good sign.
5. Open the app's settings. If the policy mentions a training opt-out (like Fathom's), confirm the toggle actually exists on your plan, and turn it off.
6. Test deletion. Delete a throwaway recording, then ask support what happens to backups and how long purging takes.

Warning callout: A missing answer is an answer. If a policy will not tell you how long your audio is kept, assume indefinitely and act accordingly.

Frequently Asked Questions

Do AI note takers train their AI on your meeting recordings?

Some do. As of August 2026, Otter's policy describes training its proprietary AI on de-identified recordings and transcripts. Fathom and Granola use de-identified or aggregated data with opt-outs in settings. Fireflies and tl;dv state they do not train models on customer content. Always check the current policy, because these positions change.

Which AI note taker keeps your data on your device?

Among the apps compared here, MeetingsAI's Private Mode is the only option where transcription and summarization run entirely on the phone, with no audio or transcripts uploaded at all. Every other tool in this comparison processes meeting audio on cloud servers, though their retention and training terms differ significantly.

How long do AI note takers keep your recordings?

It varies more than most people expect. Granola deletes raw audio as soon as your transcript is created. tl;dv keeps free users' recordings for 3 months. Otter and Fathom keep data as long as necessary for their stated purposes, with no fixed number. Notta's posted policy does not state a retention period at all.

Is it safe to use an AI note taker for confidential meetings?

It depends on the tool and the stakes. For routine meetings, a cloud tool with strong written commitments may be fine. For legal, medical, HR, or unreleased product discussions, prefer on-device processing so the content never leaves your hardware, and always get consent from participants before recording, whatever tool you use.

Does MeetingsAI send my meetings to the cloud?

In Standard Mode, yes: audio is processed by cloud services and transcripts can sync across devices. In Private Mode, no: speech recognition and summaries run on-device using local AI, storage stays encrypted on your phone, and it works fully offline. You choose the mode per your sensitivity level, which is the point.

Conclusion

Seven apps, four questions, and a wider spread than the marketing pages suggest. Otter documents training on de-identified content and vendor annotation. Fireflies and tl;dv put anti-training commitments in writing. Granola deletes audio fast, Fathom gives you an off switch, and Notta leaves the biggest questions unanswered.

Read the policy before you press record. And when a meeting genuinely matters, pick the configuration where the policy has the least to govern, because the audio never left your phone.

Want your next sensitive meeting to stay on your device? Download MeetingsAI and flip on Private Mode. Transcription, summaries, and AI transcription that work with airplane mode on.