Effective 7 September 2026. Last updated 26 October 2026.
This Privacy Policy describes how Generative Chaos LLC, 5900 Balcones Drive #33409, Austin, TX 78731, United States ("Chui", "we", "us" or "our") collects, uses, discloses and otherwise processes information in connection with the Chui mobile applications, desktop applications and the website at chui.io (together, the "Service").
By creating an account or otherwise using the Service, you acknowledge that you have read this Policy. This Policy forms part of, and is incorporated by reference into, our Terms of Use.
"User Content" means audio recordings, transcripts, summaries, notes, titles, speaker labels and any other content that you create, upload, import or generate through the Service, together with any content derived from it by the Service.
"Usage Data" means technical and operational information generated by your use of the Service, including device, application, performance, diagnostic and event data.
"Support Communications" means a fault report or other message you send us from within the Service or by email, together with any file you attach to it.
"Service Data" means User Content, Usage Data and Support Communications, collectively.
"Provider" means a third party engaged by us to process Service Data on our behalf and on our instructions.
We collect the following categories of information:
2.1 Account information. The identifier issued to us by the sign-in provider you use, your email address where you elect to share it, and your name where the provider supplies it and you allow it. We do not request your postal address or telephone number.
2.2 User Content. Audio recordings made or imported through the Service, and the transcripts, summaries, titles, speaker labels and notes generated from or alongside them. It also includes files you attach to a meeting — a photograph, a document, a slide deck or anything else you choose — together with the file's name, its size, its type and, for a photograph taken with the Service's own camera during a recording, how far into that recording it was taken.
A photograph taken with the Service's own camera is created by the application and stored with the meeting. It is not placed in your device's photo library, so the copy held with the meeting is the only one, and deleting the meeting destroys it. The Service does not open the camera on its own at any time; a photograph is taken only when you press the shutter. A file attached in any other way is a copy of a file you already had, and deleting it here does not touch the original.
2.2a Photographs from your device's photo library. Where a meeting was recorded on a device that has a photo library, the application may offer to add the photographs taken while that recording was running. Reading your library requires your device's permission, and the application asks for that permission only when you press the control that offers this; it never asks on its own.
Your library is then read for two purposes and for no other. First, to make the offer: the application asks it for the photographs whose own timestamp falls inside the recording, and for a small preview of each, which is shown to you on your own screen and sent nowhere. Each is shown with a mark you can clear, and no photograph is sent to us unless you leave its mark set and confirm. Second, on confirming: the application asks the library for the full copy of each photograph you left marked, and for no other — if that copy is held in your own cloud photo service rather than on the device, your device fetches it from there in order to hand it over. Where sending one fails and you try again, the full copy of that photograph is read once more, and only of that one. Nothing else in your library is read at any point. You may decline for that meeting, decline permanently, or turn the offer off at any time in Settings → Privacy within the application.
A photograph you confirm is re-encoded on your device before it is sent, which removes the location, camera and timestamp information the original file carried. What reaches us is the image itself, its size, its type, the moment it was taken and, where the recording's own clock permits it, how far into the recording that moment falls. The original stays in your photo library, untouched. The application has no means of adding to your photo library, altering it or deleting from it, and deleting a photograph here does not touch the original. The Android application cannot read your photo library at all: it has no such feature, so no photograph reaches us by this route from an Android device.
2.3 Usage Data. Information including but not limited to recording duration, file size, coverage against elapsed time, battery level at the start and end of a recording, application version and build, device model, operating system, the surface used, feature interactions, session events, error and crash reports, and diagnostic messages returned by the operating system or by a Provider, together with your IP address and the approximate location — typically city, region and country — derived from it. Where one of our own advertisements led you to Chui, we record which one on your account, as the place you came through tells us: the app store you installed from (for Apple's own App Store advertisements, Apple's reference numbers for our campaign, ad group, search term and advertisement, the country of the App Store, and whether the advertisement was tapped or only seen; for an installation from one of our advertisement links, that link's name), or, on chui.io, the advertisement's name carried in the address of the pages you opened before creating your account. No advertising identifier and no cookie is used: the advertisement's name is simply stored with your account. An account that existed before the advertisement is never marked, and we use the answer only to learn which of our advertisements bring people who go on to use and pay for the Service.
2.4 Support communications. Information you provide when you contact us, including the content of your message and any material you attach to it. Where you report a fault from within the application, we also receive the application version and build, the surface you were using, the name of the screen you were on, the identifier of the meeting that was open at the time if there was one, and a short list of the actions the application had most recently performed. The application does not capture an image of your screen at any time. Where a report carries an image, it is a file you selected yourself, and it may contain User Content — a screenshot of a meeting, for example. Images are re-encoded on your device before they are sent, which removes any camera, timestamp or location information the original file carried.
2.5 Calendar information. Where you connect a calendar account: which provider it is, the email address that identifies that account, the identifier that provider issues for it, the permissions you granted, and the times at which the connection was made and last read. We also hold the long-lived credential that account's provider issues to us, and a short-term copy of the meetings in your next day and a half. And we keep the name and email address of each person invited to those meetings, as an entry in your own list of people — the contacts the Service builds for you. Section 5 describes all three — what is read, what it is used for, where it is kept and for how long.
2.6 Questions you ask through an assistant. Where you connect an assistant — Claude, ChatGPT or another client — through our MCP interface, every request it makes on your behalf carries one sentence saying what you are trying to find out, in your own words. We ask for it because search quality is what this feature is: by the time a question reaches our index only the words searched for remain, and nothing anywhere records what you hoped to learn. The distance between those two is how we find out that a search failed somebody, and it cannot be recovered afterwards. It is read by the people who build the Service.
We ask the assistant for one sentence and for nothing else — not your chat history, not the messages surrounding your question, not a transcript of your exchange with the assistant, and no other contextual field: our interface offers nowhere to put them. What arrives is limited to 500 characters and truncated there. We ask an assistant for a sentence; we cannot inspect what it chooses to put in one, which is a reason to prefer assistants you trust and the reason we hold whatever arrives to the protections in this paragraph. Because your question is usually about a meeting you are reading, that sentence can quote or paraphrase the meeting: «where did Ivan say the release was slipping». We say so plainly rather than imply otherwise. What it can quote is your own recording, which we already hold, and it is stored in the same database and under the same protections as the recording it concerns. It never changes the answer you get back — the same request with the same parameters and a different sentence returns exactly the same result — and the interface says so to the assistant in those words. We never send the sentence itself to our analytics provider. What that provider receives about such a request is its shape and no part of its content: which tool was called, which of our two addresses it arrived on, the name the assistant registered itself under, whether it succeeded, how long it took, how many results came back, whether a sentence was supplied at all and how many characters it ran to — together with the internal identifier of your account, as section 9 describes.
It is retained until you delete your account, and section 9 describes one consequence worth knowing in advance: deleting a meeting does not delete a sentence that happened to quote it.
2.7 Billing information. Where you take a paid plan at chui.io, the payment is taken by a payment processor, and your card number is given to that processor and never to us. What we receive and keep is the record of the subscription itself: which plan it is, when it began, when it renews or ended, the country we are required to determine in order to charge the right rate of tax and the evidence on which we determined it, the amount charged and the tax within it, and an identifier issued by the processor that lets us match the subscription to your account. Where you subscribe from within an application obtained from the Apple App Store, Apple takes the payment and passes on the same record of the subscription: which plan it is, the price and its currency, when it renews or ended, whether it is set to renew, and Apple's own identifiers for the purchase. Apple gives us no card number and no payment method of yours. Where you subscribe from within an application obtained from Google Play, Google takes the payment and passes on the same kind of record: which plan it is, the price and its currency, when it renews or ended, whether it is set to renew, the region of the purchase, and Google's own identifiers for it. Google likewise gives us no card number and no payment method of yours. In both cases we also give the store an identifier of our own making that stands for your account, so that a renewal can be matched to it; it is not your name, your address or anything a person could read you from.
2.8 Questions you ask the Service itself. The Service has an assistant of its own: you type or say a question about your meetings, the people in them or your account, and it answers. The answer is written by a generative language model operated by a Provider (section 4.1; which company it is, is named at chui.io/subprocessors). To write it, the model is given your question, which meeting you were looking at when you asked, and the rest of that conversation, and it reads whatever of your account it needs through the Service's own tools — titles, summaries, transcripts and notes of your meetings, your list of people and what is noted about each, your upcoming calendar meetings, and your account and company details — never more than you could open yourself. Where it asks for a meeting's audio it is given a link that plays for about twelve hours (one hour for a colleague's meeting), not the audio. Where its answer would change something — renaming a meeting, sharing one, merging two people — nothing changes until you press yes. We keep each conversation, the full exchange with the model included, so that you can return to it; and, for each question, a record of what it cost and which tools ran, which holds none of your words. Each tool call the assistant makes is recorded as paragraph 2.6 describes, with your question in place of the assistant's sentence, together with the words it searched for and which meeting or person it opened. Section 9 says how long each is kept. A question you say rather than type is turned into words as you speak by a speech-to-text Provider, which is also given the words saved in your dictation word list, and is then tidied by a language-model Provider with that list and any instructions you gave for dictation, unless you switched the tidying off (section 4.1). We keep neither the sound nor those words: they become a question only when you send it.
2.9 Advertisement pages and the former Android waiting list. Each of our advertisements links to its own page on chui.io. When that page is opened, and when its App Store or Google Play button is pressed, our server records the event in our product analytics: which advertisement it was, whether the device describes itself as an iPhone, an iPad, an Android phone or a computer, which application's built-in browser opened the page (Instagram, Facebook, LinkedIn or ChatGPT, where it says so), and the country our hosting provider reads from the connection. We record no IP address, no cookie, no device or advertising identifier and no user-agent string, so nothing recorded tells one visitor from another, and the page itself runs no script and sends nothing from your browser. The App Store button carries the advertisement's name to Apple, which then reports to us, per advertisement and only as totals, how many times the app's page was viewed, how many first downloads followed, how many times the app was then opened, and how many purchases were made and for how much. The Google Play button carries the advertisement's name to Google in the same way, and Google reports to us, only as totals and per advertisement where there are enough of them to report separately, how many installs followed. A computer is sent on to chui.io's download page with the advertisement's name in the address, which stays in the address of chui.io's home and download pages opened from there, and a download started from those pages is counted per advertisement in the same way. Leaving chui.io drops it: nothing is stored in your browser.
Until Chui was available on Google Play, the page offered an Android phone a waiting list instead; it no longer does. We keep the email addresses left there, together with the name of the advertisement, for one purpose: to write to each person once to say that Chui is now available for Android. We delete each address at most one year after it was left; it is never sent to our analytics provider, and you can have it removed at any time by writing to privacy@chui.io. None of this is collected by the Chui applications themselves: it happens only on chui.io, before a person has the app.
2.10 Dictation on a computer. When you dictate into another application on a Mac or a Windows computer, the Service reads, through the computer's accessibility features, the window you are typing into, and only while you are dictating into it: never another window or the rest of the screen, and never a password field or a number field. It reads at two moments. When you press the dictation key, it reads the text just before the cursor in the box you are typing into — at most the last 300 characters — so that what you dictate continues the sentence you were writing: no capital letter in the middle of it, and words that agree with it. It also reads the text in that window and picks out of it, on your computer, at most 40 names and unusual words, so that a name shown there comes out spelled the way it is shown; the rest of the window's text never leaves your computer. The text before the cursor and the picked words are sent to our server with your dictation and, unless you switched the tidying off, to the language-model Provider that tidies what you dictated; the picked words also go to the speech-to-text Provider as words to expect (section 4.1). They are used for that one dictation and then discarded, and all that is recorded is how many characters and how many words were read. After the dictation is pasted, the box is read again for up to a minute, while it keeps the focus, to see whether you corrected the spelling of a name or a term in what was pasted (say «cloud» to «GCloud»). What is read then stays on your computer and is discarded; only such a corrected pair of words is kept, by adding it to your dictation word list, marked as learned, where you can see it and remove it. The applications on a phone never read another application's box.
2.11 Speaking to Chui on a computer. If a dictation on a Mac or a Windows computer starts with «hey Chui» (or «хей чуй»), what follows it is not pasted: it is a request to the Service, and a spoken conversation with Chui begins. For as long as that conversation lasts — until Chui ends it, you press × on the dictation pill, or five minutes pass — the sound of your microphone is sent as you speak to the language-model Provider that runs the conversation (section 4.1), which answers out loud. To answer, it may read your meetings, people, promises and the other things the Service's own assistant can read (paragraph 2.8), and it may act for you as that assistant can: type text where your cursor is, start a recording, open the assistant on screen, and — only after you say yes or press «Yes» — send or delete something. We keep which actions it took and how long the conversation lasted; we do not keep a recording of the conversation. The applications on a phone do not offer this conversation.
We do not collect precise geolocation such as GPS coordinates, nor contacts, nor advertising identifiers, and we do not employ any technology intended to track you across other applications or websites.
We process Service Data for the following purposes, including but not limited to:
(a) providing, operating, maintaining and supporting the Service, including transcribing, diarising, summarising, indexing and making your recordings searchable and playable, and delivering notifications to your devices;
(b) authenticating you, administering your account, taking payment for a paid plan and issuing receipts for it, and enforcing account entitlements, usage limits and subscription terms;
(c) investigating, diagnosing and resolving faults, including through crash reports, error logs and diagnostic messages;
(d) measuring and analysing usage, performance, reliability and adoption, including through event analytics and aggregate reporting;
(e) maintaining the security and integrity of the Service, and detecting, preventing and investigating fraud, abuse and breaches of our Terms of Use;
(f) responding to your enquiries and support requests, including where you submit a specific recording to us for review;
(g) complying with applicable law and responding to lawful requests from competent authorities, and establishing, exercising or defending legal claims; and
(h) operating, developing, evaluating, testing and improving the Service and any current or future features, functionality, products and services, including by review and automated analysis of Service Data, User Content and any content generated by the Service or by users.
3.1 Your choice in respect of paragraph (h). You may opt out of the processing described in paragraph (h) at any time in Settings → Privacy within the application. Opting out does not affect processing carried out before we receive your instruction, nor the purposes in paragraphs (a) to (g). Where your account belongs to an organisation, an administrator of that organisation may also switch this processing off for every account of the organisation, and never on; while they have, it cannot be switched back on for any of them. Where our Data Processing Addendum applies, the processing in paragraph (h) is done on the organisation's instruction, which that switch withdraws (clause 3.4 of the Addendum).
3.1a Files attached to a meeting. Where we are able to read a file, we do, and what it contains is used in writing the summary of that meeting. A photograph is looked at by a language-model Provider that can read images; a document is read as its text. Where the file is a photograph taken during the recording and the recording's own clock can place it, the point in the recording at which it was taken is disclosed with it, so that what it shows can be placed at the moment it belongs to; where it cannot, the file is disclosed with no such point and is read as being about the meeting as a whole.
Not every file is read. Only some kinds can be, the number read from any one meeting is limited, and a file of a kind we do not read — or one beyond those limits — is stored and listed and nothing further is done with it. We do not undertake that any particular file will be read, and nothing in the Service tells you which were.
It is not transcribed and it is not sent to any speech-to-text Provider, and the file itself is not indexed for search. What we write about it does form part of the summary, and summaries are searchable like any other text in your account — so a phrase visible in a photograph can be found by searching your own meetings. Paragraph (h) reaches it only in the sense that any Service Data may be reviewed to diagnose a fault, and your choice in paragraph 3.1 applies to it exactly as it does to a recording.
3.2 No sale and no advertising. We do not sell Service Data and we do not share it for cross-context behavioural advertising. We do not use Service Data for advertising and we have no advertising partners; the one exception is measuring which of our own advertisements led to an installation or an account, as paragraphs 2.3 and 2.9 describe.
4.1 Categories of Provider. We disclose Service Data to Providers engaged to perform functions on our behalf. Each processes it under a written contract, solely on our instructions and for no purpose of its own.
| Category | What it receives | Purpose |
|---|---|---|
| Speech-to-text providers | audio recordings; for something you dictate or a question you speak, the sound as you speak it and words to expect in it — the words saved in your own dictation word list and, on a computer, names picked from the window you are typing into (paragraph 2.10) | transcription and speaker separation; turning what you dictate into words as you speak |
| Language-model providers | transcripts, notes, files attached to a meeting (including photographs, and where in the recording a photograph was taken), Support Communications, and the questions you ask the Service's own assistant together with what it reads to answer them (paragraph 2.8), and the words of something you dictated or a question you spoke, with what is needed to tidy them — your dictation word list, any instructions you gave for dictation and, on a computer, what is read from the window you are typing into (paragraph 2.10); and, when you speak to Chui on a computer, the sound of that conversation (paragraph 2.11) | summarisation, generated output, answering your questions, tidying what you dictated, holding a spoken conversation with you and classifying reported faults |
| Cloud infrastructure providers | Service Data | hosting, storage, processing and delivery |
| Product analytics providers | Usage Data only; no User Content | measuring use, performance and reliability |
| Payment processors | your name, your email address, the identifiers of your account or company and of your agreement to the terms of purchase, the name of your company where it is the company that pays, and the payment details you give them directly; no User Content | taking payment and determining the tax within the price |
A payment processor is, in addition, a controller in its own right for what it does for its own purposes — preventing fraud, meeting the financial and anti-money-laundering rules that bind it, and running its own business — and handles the payment data for those purposes under its own privacy notice.
Some Providers are established outside the European Economic Area, including in the United States.
4.2 Which Providers, and changes to them. The Providers currently engaged in each category are listed at chui.io/subprocessors, and that list is also available on request. We may change or add a Provider within a category — for example, engaging a different speech-to-text engine — and where we do, we update that list. The categories and purposes set out above continue to describe what is disclosed and why.
4.3 No training by Providers. No Provider is permitted to use your User Content to train, fine-tune or otherwise develop its own models. We require this by contract or under the Provider's applicable terms, and it is a condition of engaging any Provider in the first two categories above.
4.4 Other disclosures. We may disclose Service Data where required by applicable law or legal process, to protect the rights, property or safety of Chui, our users or the public, and in connection with a merger, acquisition, financing or sale of assets, subject to equivalent protections.
4.5 A link you create yourself. The Service can, at your request and for one meeting at a time, publish that meeting at a web address on chui.io. This is a disclosure you make rather than one we make: no meeting has such an address unless you ask for one, and none is created by default. While the address exists, anybody holding it may read the meeting's title, the date and length of the meeting, the names you have given to the voices in it, and the summary.
You choose how much is published with it, and the choice starts at «summary only». There are three settings, and a newly created address is always at the narrowest of them: the summary alone; the summary and the transcript; or the summary, the transcript and the recording itself, which anybody holding the address may then play, together with the files attached to that meeting — a photograph or a document, which anybody holding the address may then open or download. Only a further request of yours, for that one meeting, moves an address off the summary. Changing the setting applies to the address as it already stands, so it changes what everybody you have already given the address to can read — or hear — at once and in both directions. At the two narrower settings neither the recording nor any file attached to the meeting is published, and the page contains no address at which either could be reached. Nothing else about the meeting is published at any setting — not your own notes, not its processing status, not its diagnostics.
Where you have published the recording, it is served only for as long as the address itself works: withdrawing the address, or narrowing what it publishes, stops the recording being playable at the same moment it stops the page being readable.
The address contains an unguessable value we generate; we do not publish, list or index it, and the page asks search engines not to index it either. You may withdraw the address at any time, after which it stops working permanently; a later request creates a different address, so that anybody still holding the old one does not regain access, and that new address again starts at the summary only. We record that a meeting was given an address, when it was withdrawn and how many times the page has been opened; that record contains no part of the meeting, is deleted when the meeting is deleted, and is deleted with your account. Once a page has been read we cannot recall what the reader saw, and neither withdrawing an address nor narrowing what it publishes attempts to.
4.6 A temporary link you ask an assistant for. Where you have connected an assistant (section 5), you can ask it for a link to listen to one of your meetings. We create a temporary web address on chui.io that opens that one meeting — its summary, its transcript and a player for its recording — and nothing else in your account; it carries no sign-in and grants no other access. It stops working by itself, after about twelve hours for a meeting of your own and about one hour for one a colleague has shared with you. This is not publishing: no meeting is given a lasting address, nothing is listed anywhere, and the address cannot be used to reach any other meeting, any other person or any part of your account. It is a disclosure you make, to whoever you pass the link to, for as long as it lasts.
4.7 A meeting's notes you send by email. Where you recorded a meeting against an invitation in a connected calendar, the Service offers to email that meeting's summary to the people the invitation lists, and to any address you add yourself. Nothing is sent unless you press send, having been shown the email exactly as it will go and every address it goes to, any of which you may remove. The email carries the meeting's title and its summary, less any passage you choose to remove — never the transcript, the recording or the notes you typed themselves, though the summary may draw on them — and a link to the meeting only where you have already given it an address under paragraph 4.5 and removed nothing. Before you are shown it, the summary is checked for passages that may be private — a figure, a remark about somebody, something drawn from your own notes, something called confidential — by the same automated means that wrote it; each is pointed out so you can keep it or remove it, and nothing is removed unless you remove it. It is sent from a chui.io address in your name ("your name via Chui"), replies to it go to your own email address, and you receive a copy. This is a disclosure you make rather than one we make. To offer it, and so that you can see again what you sent, the addresses the invitation lists and the last email sent from a meeting — when, to whom and its exact text — are kept with the recording, for as long as the recording itself; and we count how many addresses each account writes to in a day, in order to apply a daily limit. Once an email has been sent we cannot recall it. Every such email also carries a button inviting its reader to install Chui. It leads to an app store through chui.io carrying a code for that meeting — never the meeting itself, and never anything about the reader. If somebody who received the email then creates a Chui account, with that code or with the very address the email was sent to, Chui opens that meeting's page for them — only where you have given the meeting an address under paragraph 4.5 and removed nothing from the email — and records that their new account came from that meeting, so that we can count how many people these emails bring. To do that, each address an email was sent to is kept with the recording, and goes with it. The same applies when somebody opens the meeting's address under paragraph 4.5 on a phone: the page first offers Chui, and its button carries the same code.
4.8 What you promised in a meeting, and the emails written for it. After a meeting is summarised, the Service reads that meeting's summary and transcript once more, with the same language-model provider that writes the summary, to list the things you promised in it to send or do for somebody — what, to whom, by when — and, where it can, to write the email that would keep each promise. These appear under the meeting's summary, are kept with the recording for as long as the recording itself, and are deleted with it. A promise's recipient is named as the meeting named them; an address is only ever one the meeting's calendar invitation lists, one already on that person's page in the Service, or one you type — and an address you type for a person is kept on that person's page, as if you had entered it there. Nothing is sent unless you press send, having been shown the email exactly as it will go and its recipient. Where a promise was to send a file, the email carries only the files you tick, chosen from those attached to that meeting. It is sent as in paragraph 4.7 — from a chui.io address in your name, replies to you, a copy to you, under the same daily limit — and is a disclosure you make rather than one we make. We record when a promise's email was sent and to how many people. You may dismiss a promise instead, and its card and email are then deleted. Once an email has been sent we cannot recall it.
4.8a Promises you add to your own to-do list. Where a promise needs your own work, its card offers «Add to my to-dos». Nothing is added unless you press it, and each press adds one item. Into Microsoft To Do: where you have connected a Microsoft account and allowed it to receive tasks, we create one task in that account's default list through Microsoft's interface — the promise's title, its due date where the meeting named one, whom it is for, the meeting's title and a link back to the meeting. Into Apple Reminders, on an iPhone: Apple Reminders cannot be reached by us over the internet, so your device itself adds one reminder with the same contents to its default list, after iOS has asked you once whether Chui may use Reminders. We never read, change or delete any other reminder, and nothing in your Reminders is sent to us. Microsoft or Apple then holds the item under its own terms — for Reminders, including in iCloud if you sync them there. In either case we record that the promise was added, when and where, so that it is added only once, and, if you ask the Service to, the place you chose for next time; you may clear that choice in Settings at any time.
5.1 Generally. Where you connect a third-party account to the Service — a calendar, or an assistant or client connected through our MCP interface — we receive from that provider only what the connection requires. What an assistant sends us on your behalf, and what we keep of it, is described in paragraph 2.6. User Content transmitted to a provider you have selected is thereafter governed by that provider's terms and privacy policy. You may disconnect an integration at any time. Where a connection requires an access credential that we hold, it is retained only while the connection is active and is deleted when you revoke it; for calendar connections we hold such a credential on our servers, encrypted, as paragraph 5.4 describes.
5.2 Calendar connections, and what is read. The Service can connect to a Google account or to a Microsoft account so that a recording can be filed against the meeting it belongs to. Connecting a calendar is a separate step from signing in — it is requested separately and may be refused on its own — and it grants the Service read-only access to two things: the list of calendars on that account, and the events on those calendars. We request no other calendar permission, and the Service cannot create, alter, delete or move any calendar or any event; it never writes anything to your calendar. The calendar permissions requested are calendar.calendarlist.readonly and calendar.events.readonly from Google, and Calendars.Read from Microsoft.
The same authorisation request also asks for the sign-in permissions that tell us which account you have just connected — without them the application could show you only "Microsoft" and not which of your accounts it is: openid and email from Google, and openid, profile and email from Microsoft. From Microsoft we additionally request offline_access, and from Google access_type=offline: both are what allow the connection to be renewed without asking you to consent again, so that connecting once connects every device you sign in on.
5.3 What calendar data is used for. Events are read in order to show you the meetings taking place around you, so that you may start a recording against one, and to remind you shortly before a meeting begins. Where you record against an event, that event's title names the recording, the invitation body or agenda is supplied to the summariser as context for it, and the names of the people invited become the list of candidates the Service offers when a speaker is labelled — a set of suggestions, and never a record of who attended. Where the invitation says that a meeting recurs, the identifier it carries for the series is kept with the recording, so that the Service can show you what was said at earlier occurrences of the same meeting.
Where you have chosen to be reminded of meetings, ten minutes before a meeting the Service may send a briefing instead of the ordinary reminder: what the last recorded occurrence of the same meeting left open, and where things stand with the people invited whom your list of people already holds. It is built only from the recordings you may open — your own, and those another user of your organisation has shared where you can open them — and from your own list of people, as the preceding paragraphs describe them. Where the occurrence it quotes was recorded by somebody else, the briefing says whose recording it was. It is never built from email, and nobody is looked up anywhere else in order to write it. Its text travels in the notification.
Each person invited to a meeting in a connected calendar whom the invitation names, with an email address, is added to your list of people with that name and address — or, where they are already in it, recognised as that person — whether or not you record that meeting. An invitee whose address is already on somebody in that list is that person, including where the calendar spells a name in the Latin alphabet and you spelled it in Cyrillic; a second address for somebody is remembered as theirs. This is what lets the Service know who you meet, show a person's address on their page so that you can write to them, and connect what was discussed with them across meetings: it is the basis of a contact record that is yours, which you can correct, and which is part of your account. An address you remove from somebody is not added back by a later invitation.
Calendar data is used for these purposes — and, where you ask us to, to email a recorded meeting's summary to the people its invitation lists (paragraph 4.7) — and for no other. It is not used for advertising; we do not sell it and do not share it for cross-context behavioural advertising; it is not used to profile, score or assess you or any person named in your calendar; and it is not used to train, fine-tune or otherwise develop any model, whether ours or a Provider's.
5.4 Where calendar data is held. The credential Google or Microsoft issues when you connect a calendar is held on our servers. It is stored encrypted, under a key held separately from the database, and it is never returned to any application, shown on any screen or included in any log. Connecting a calendar once therefore connects it for every device you sign in on, and lets the Service read your calendar when the application is not open — which is what allows a reminder before a meeting starts.
We also store the meetings in your next day and a half, so that the Service can offer to record one at the time it begins. For each such meeting we hold what the invitation carries that helps the Service do the things paragraph 5.3 describes — today that is what it is called, when it begins and ends, how and by what link it is joined, its body or agenda, who was invited, whether you have accepted it, and which recurring meeting it is an occurrence of. A meeting that has ended is deleted within twenty-four hours, and every stored meeting for a calendar account is deleted the moment that account is disconnected. Nothing older is retained, and this store is not used for any purpose other than the ones paragraph 5.3 describes.
Where a meeting is stored with a recording, that copy forms part of the recording, is subject to the recording's own retention and is deleted when the recording is deleted.
What we hold about the people invited to a meeting is what that invitation itself carries about them — on the stored meeting, which shares that meeting's life as described above, and, for their name and email address, on the entry for them in your list of people (paragraph 5.3). That entry is kept for as long as your account exists, is deleted with your account, and does not disappear when you disconnect the calendar it came from. Nobody is looked up in any outside source, enriched, scored or contacted by us because their name appeared on a meeting in your diary — an email reaches them only where you send one under paragraph 4.7 — and they are not counted as users of the Service. Section 6 addresses the other people a recording itself captures.
5.5 Disconnecting a calendar, and revoking access. You may disconnect a calendar at any time in Settings within the application. Doing so revokes the credential at the provider where the provider offers a means to do so, deletes that credential from our servers, and deletes every stored meeting for that account together with the record described in paragraph 2.5. Signing out of your last remaining device does the same for every calendar on the account.
Google publishes a means of revocation and we use it. Microsoft publishes none that an application may use on your behalf, so for a Microsoft account we destroy the credential and the standing permission is removed by you at the provider. You may in any case revoke the Service's access at the provider itself — at myaccount.google.com/permissions for a Google account, and at account.live.com/consent/Manage for a personal Microsoft account or myapps.microsoft.com for a work or school account. Doing so does not depend on us and cannot be undone by us.
5.6 Google API Services User Data Policy. Chui's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5.7 Microsoft accounts. A Microsoft calendar connection is subject to the same limits throughout: read-only access under the Calendars.Read permission, the credential held on our servers and the meetings in your next day and a half stored, on the terms and for the retention paragraph 5.4 sets out, and no use of the data beyond the purposes set out in paragraph 5.3. Where your Microsoft account is issued by an employer or other organisation, your administrator may permit or refuse the connection and may revoke it at any time.
A recording ordinarily captures more than one person, and only one of them holds an account with us. This section addresses the others.
6.1 No bot joins your meeting. The Service does not send a participant, agent or bot into any call. Recording is performed by the device in your possession.
6.1a A photograph is a recording of the room. Where you photograph a whiteboard, a screen or a document during a meeting, the image may show people, their work, and information belonging to them or to their employer. Everything this section says about a recording applies to it, and paragraph 6.2 in particular: it is for you to have a lawful basis for taking it. This applies equally to a photograph you add from your device's photo library under paragraph 2.2a — it is for you to check what each one shows before you confirm it, which is why they are shown to you first.
6.2 Your responsibility. You are solely responsible for ensuring that you have a lawful basis and, where required, the consent of all participants before recording. Requirements differ between jurisdictions and some require the consent of every party. We have no means of determining who is present or whether they have agreed.
6.3 Requests from non-account holders. If you were recorded through the Service and wish to exercise rights in respect of that recording, contact privacy@chui.io. Recordings are indexed to the account that created them, and speakers within a recording are labelled speaker_0, speaker_1 and so on unless a name becomes known in one of the ways described in paragraph 6.4. Within a single account a named person is a record in their own right, and the meetings they appear in can be listed; that index exists only inside that one account. The voiceprints described in paragraph 6.4 are held only for people who switched recognition of their own voice on, and reach one step further and no further: a person's voiceprint is compared in their own recordings and, where they belong to an organisation, in recordings made by other accounts of that organisation to which they were invited. Nothing spans organisations. We operate no directory of people and no index of voices that reaches beyond a single organisation, a voiceprint is never compared against a recording made outside the organisation its owner belongs to, and we therefore cannot search the Service for you, whether by name or by voice. We will require sufficient particulars to identify the recording — ordinarily who recorded you and approximately when — and will verify your identity so far as is reasonably practicable. Where we locate a recording, we will respond in a manner that does not disclose the personal data of other participants.
6.4 Voiceprints. The Service separates the voices within a single recording and labels them speaker_0, speaker_1 and so on. That separation compares the voices of one recording with each other and with nothing else, keeps nothing once the recording has been processed, and is done for every recording. A speaker acquires a name where a user types it, where the name is stated plainly in the conversation, or — only for a person who has switched on the setting described in paragraph (f) for their own voice — where the Service recognises that person's voice as described in this paragraph.
Recognising a voice from one recording in another is off unless the person whose voice it is has switched it on, from their own account, for their own voice. Nobody can switch it on for anybody else.
(a) What is created, and for whom. For a user who has switched the setting on, the Service keeps one mathematical representation of that user's own voice (a "voiceprint"). It is learned from recordings that user made themselves, from a speaker in them who carries that user's own name — typed by the user, or, while no voiceprint exists yet, proposed by the Service — once that speaker has spoken for long enough for the measurement to be reliable, at present approximately thirty seconds of sufficiently clear speech; later recordings of the same kind refine it. No voiceprint is created for anybody else.
(b) What it is used for. When a recording has been processed, each separated voice in it is compared with the voiceprint of the user who made the recording, if they have one, and with the voiceprints of the users of the same organisation whom the calendar invitation the recording was made against names by address. Where a voice matches, the Service proposes that user's name for it. Every other voice in the recording is measured for that comparison only and the measurement is discarded in the same step: it is never stored and never named by the Service; where nobody in the recording has a voiceprint to compare with, no voice is measured at all. A proposed name is shown to the user and may be changed in a single action, and a name a user has entered is never overwritten by one the Service has inferred. We use voiceprints for no other purpose: they are not used to verify or authenticate identity, to grant access to anything, to profile, score or assess any person, or to infer emotion, health or any other characteristic.
(c) This is biometric data, and we treat it as such. A stored voice representation used to recognise a person is a special category of personal data within the meaning of Article 9 of the GDPR — whether or not a name is attached to it — and sensitive personal information under several United States state privacy laws. The only condition under Article 9 that can permit it here is the explicit consent of each person whose voice is recognised: an announcement that a meeting is being recorded, a participant's silence, or an employer's instruction is not that consent. That is why only the person whose voice it is can switch the setting in paragraph (f) on, and why it is off unless they do, the same in every country. We process a voiceprint on the basis of that person's explicit consent (Article 9(2)(a)), and for one reason: so that the Service does not ask who they are at every meeting they take part in.
(d) It does not leave the organisation. A voiceprint belongs to the account of the user whose voice it is. Where that account belongs to an organisation, it is compared only in that user's own recordings and in recordings made by other accounts of the same organisation to which that user was invited; where it belongs to none, only in that user's own recordings. We operate no global index of voices and none that spans organisations, and a voiceprint is never compared against a recording made by an account outside the organisation its owner belongs to. The only Provider it reaches is the cloud infrastructure that stores it on our behalf (paragraph 4.1); no Provider and no other third party receives it for any purpose of its own, and it is not used to train, fine-tune or otherwise develop any model, whether ours or a Provider's.
(e) The consent, and its record. By switching the setting on, a user gives their own explicit consent to the processing of their own voice described in this paragraph, and to nothing about anybody else. We record who consented, when, and the exact wording they were shown, in the language it was shown in; we record a withdrawal with when it was made and how. A withdrawal is never refused for want of any wording. A consent given by typing to an AI assistant connected to the Service is recorded with the sentence that assistant is instructed to read to the user before switching the setting on.
(f) The setting, and who moves it. The setting is "Own-voice recognition" under Settings → Privacy, and can also be moved by typing to a connected AI assistant. It is off unless the user switches it on, and only the user of the account can move it. An administrator of an organisation may switch it off for every account of that organisation, and never on; while they have, no account of that organisation can switch it on, every voiceprint of its accounts is deleted at once, and a user's own choice is kept and applies again only if the administrator lifts that restriction, when the voiceprint is learned again from the beginning. While the setting is off for a user, the Service holds no voiceprint of them and recognises their voice nowhere; they are labelled as any other speaker is, and names already given stay where they are. On the desktop application, the user's own voice is identified by the microphone channel it was recorded on, which needs no voiceprint and is not affected by this setting.
(g) The voiceprints held before this setting existed. Until September 2026 the Service created voiceprints of every speaker it heard, first for every account and then for accounts and organisations that had switched on a setting to recognise voices across recordings. Both were collected without the consent described in paragraph (c), and every one of them was deleted, in every account and every organisation, when each of those arrangements ended. Every name a person record carried at that moment, including a provisional one, was kept as though a user had entered it; only the ability to recognise the voice was removed.
6.5 Removing a voiceprint. Switching the setting in paragraph 6.4(f) off deletes the user's voiceprint at once; names stay. A voiceprint that has not been used in any recording for a year is deleted automatically, and a new one is learned only if the setting is still on and the user makes a further recording of the kind described in paragraph 6.4(a). Deleting the account deletes the voiceprint and the record of the consent. You may withdraw your consent at any time, in one action, by switching the setting off; withdrawal does not affect processing carried out before it. If you do not hold an account and believe your voice has been recognised, contact privacy@chui.io. Section 10 sets out your rights and the time within which we respond.
7.1 How AI is used. The Service uses automatic speech recognition and generative language models to transcribe recordings, separate speakers, and produce titles, summaries, search results and related output from your User Content, and to answer the questions you ask the Service about your own meetings (paragraph 2.8) — a language model reads your meetings to write those answers. Output is generated by machine and is not reviewed by a person before it is shown to you.
7.2 Accuracy. AI output contains errors, particularly where audio quality is poor, where participants speak concurrently, and where proper nouns, specialist terminology or more than one language are present. You should review AI output before relying on it. It is not a verbatim record.
7.3 No automated decisions with legal effect. The Service does not use automated processing to make decisions that produce legal or similarly significant effects concerning you. To the extent any processing were to constitute automated decision-making within the meaning of Article 22 of the GDPR, you have the right to obtain human intervention, to express your point of view and to contest the decision, and may exercise it by contacting privacy@chui.io.
7.4 Transparency. Where required by applicable law, including Regulation (EU) 2024/1689 (the EU Artificial Intelligence Act), we identify content generated by the Service as machine-generated.
7.5 Model training. Providers may not train on your User Content — see section 4.3. Our use of Service Data to improve the Service is described in paragraph 3(h), and your choice in respect of it in section 3.1.
7.6 Automated review of fault reports. Where you report a fault from within the application, the text of your report is read by a generative language model, which produces a summary and a suggested classification for our engineering records. That processing falls within paragraphs 3(c) and 3(f) and is not affected by the choice in section 3.1. No decision concerning you is made by it, and where you attached an image, the image is not disclosed to that model. The summary is written in our own words: it does not quote your report and does not name you, anyone you mention or any meeting, and what you wrote is held only within the Service.
Where the GDPR applies, we rely on: performance of a contract (paragraphs 3(a), (b) and (f)); our legitimate interests in operating, securing, measuring and improving the Service (paragraphs 3(c), (d), (e) and (h) — for an organisation's account to which our Data Processing Addendum applies, paragraph (h) instead rests on that organisation's instruction, clause 3.4 of the Addendum); compliance with a legal obligation and the establishment or defence of legal claims (paragraph 3(g)); and your consent where separately requested.
We retain User Content until you delete it. A meeting you delete from within the application is gone from the Service at once and is erased, with its audio, transcript, summary, notes and every file attached to it, within fourteen days. A photograph taken with the Service's own camera exists nowhere else (paragraph 2.2), so deleting the meeting that holds it destroys the only copy. Deleting a meeting does not delete a fault report you sent us about it, or any file you attached to that report; those are Support Communications and we retain them for as long as they remain necessary for the purposes in section 3, after which they are deleted. Where you delete your account, the account itself and your meetings are gone from the Service the moment you ask and are erased, with the stored files behind them, within fourteen days of your request — so retrieve anything you want to keep first — and routine backups that carried them expire within thirty days after that; a fault report you sent from within the application, and any file attached to it, is deleted with the account. Where the substance of such a report has already been written into an engineering record so that the fault can be fixed, that record is retained and identifies the report rather than you or your account. Deleting a meeting likewise does not delete a question you asked an assistant that happened to quote it (paragraph 2.6); those sentences are deleted with your account. Nor does it delete a conversation with the Service's own assistant that drew on it (paragraph 2.8): that conversation is kept until you delete it or your account, and shows the meeting as gone. Deleting such a conversation does not delete the record of what each question cost, which holds none of your words, nor the record of the tools it ran, which holds your question, what was searched for and which meeting or person was opened; both are deleted with your account. The Provider that writes the answers deletes what it was sent within thirty days, unless its own safety systems flag it for review or the law requires it to keep it longer. Where we took the payment, the record of it is retained after your account is deleted, and it stops naming you; where Apple or Google Play took the payment, nothing about it survives here at all — the store was the seller and keeps its own records. Where you have paid for a subscription at chui.io we are required by tax law to be able to show, for years afterwards, which country the supply was made in, the evidence on which we determined it, the tax within the price and — where you gave us a company VAT number — why no tax was charged. Deleting your account removes your account identifier from that record and keeps the rest: a date, a country, an amount and the identifiers issued by the payment processor, and — where you gave one — the company VAT number and the registered name the EU's register returned for it, because the number is the evidence for why no tax was charged and a record without it would prove nothing. No part of your meetings, your notes or what was said is in it. We rely on compliance with a legal obligation (paragraph 8) for this, and on nothing else. We also keep, permanently, the technical markers that make a deletion stick. They carry nothing of a meeting — no title, no words and no audio — and without them a device still holding a copy of a recording you deleted could quietly put it back days later. We rely on our legitimate interest in the integrity of the Service (paragraph 8) for that. Usage Data and diagnostic records are retained for as long as they remain useful for the purposes in section 3. A usage event identifies an account only by an internal identifier and carries no name or address. A diagnostic record describes one failure in up to 4,000 characters and may name what failed: an internal identifier of an account, a connected calendar or a payment record; a company VAT number whose check failed; or, where an email could not be delivered, the address it was sent to. Once an account is deleted its internal identifier names nobody, but a VAT number or an email address in such a record still can.
How long the audio is kept is yours to choose. By default we keep the audio of a meeting for as long as we keep the meeting. In the Service's settings you may instead choose a number of days, and where you use the Service as a member of a company, the company's administrator may choose it for everyone in the company, in which case it applies to you and you cannot change it for yourself. When that number of days after a meeting has passed, we delete its audio only — from our storage, and from any of your devices that still hold a copy — and never while the meeting is still being recorded or uploaded. The transcript, summary, notes, attached files and everything else about the meeting stay until you delete them. Audio deleted this way cannot be recovered, and before a shorter period deletes audio at once, the Service tells you how many meetings it would affect and asks.
When an account or a subscription ends. Where we terminate an account for breach of the Terms, clause 9.4 of those Terms gives you not less than thirty days in which to ask us at privacy@chui.io for a copy of your User Content before the same destruction happens. The end of a subscription is not the end of an account: where a subscription lapses, is cancelled or is ended by us, the account continues on the free plan and no recording is deleted because payment stopped. Where a change to the free plan would put a recording beyond what that plan includes, clause 6.4 of the Terms says what becomes of it — it stops being available to open, and we do not delete it without notice and a period in which you can retrieve it.
We may retain Service Data for longer where required by law or where reasonably necessary to establish, exercise or defend legal claims.
Where the GDPR applies, you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing carried out on the basis of our legitimate interests.
Deletion of a recording and of your account are available within the application. For all other requests, contact privacy@chui.io; we will respond within one month. Where the GDPR applies to you, you may also lodge a complaint with the data protection supervisory authority of the country in which you live or work.
Where you are a resident of a United States state with a comprehensive consumer privacy law — including Texas, California, Colorado, Connecticut, Virginia and others — you have the right to confirm whether we process your personal data and to access it, to correct it, to delete it, and to obtain a portable copy.
You also have the right to opt out of the sale of personal data, of sharing or processing for targeted advertising, and of profiling in furtherance of decisions producing legal or similarly significant effects. We do none of those things: we do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not carry out such profiling.
Appeals. If we decline a request, you may appeal by writing to privacy@chui.io with "Appeal" in the subject line. We will respond within forty-five days and, where an appeal is refused, will tell you how to complain to your state Attorney General.
Non-discrimination. We will not deny you the Service, charge a different price, or provide a different quality of service because you exercised a privacy right.
Authorised agents. An authorised agent may submit a request on your behalf with written authorisation. We may still ask you to verify your identity directly.
We send messages necessary to operate the Service — sign-in, transactional, billing, security and service notices — and you cannot opt out of those while you hold an account.
Where we send promotional email, you may opt out at any time using the unsubscribe link in the message or by writing to privacy@chui.io. Opting out of promotional email does not affect the service messages described above.
The Service uses no cookie to track you. What it keeps in your browser's or the application's own storage on your device is only what the Service needs in order to work; the one cookie it sets, chui_consent, is written only on the page where you authorise a third-party application to reach your account, is confined to that page's path (/oauth), holds a random value that means nothing away from our servers, expires forty-five minutes after it is set, and exists solely so that such an application cannot obtain your authorisation in somebody else's name — it is strictly necessary to a service you have requested and accordingly requires no consent. Signing out clears your session; the rest stays on the device until you clear the browser's storage or remove the application.
We do not use advertising or tracking pixels, and we do not use any technology that follows you across other applications or websites. Because we do not carry out such tracking, we do not respond differently to browser "Do Not Track" signals.
Service Data is encrypted in transit and at rest. Access to audio is granted through short-lived signed links rather than public addresses, with one exception you choose yourself: where you have published a meeting's recording under section 4.5, it is served at that meeting's address, and only for as long as that address works and publishes the recording. Access to User Content within our systems is limited to the purposes set out in section 3.
Sign-in is provided through third-party identity providers and we do not hold your password to any of them. You are responsible for the security of the account you use to sign in, and for access to the devices on which the Service is installed.
No method of transmission or storage is entirely secure, and we do not warrant absolute security.
Service Data is processed in the United States and in the European Union.
An account opened from the European Union, the European Economic Area, the United Kingdom or Switzerland is stored in the European Union.\* Its meetings, audio, transcripts, summaries, notes, people and account records are kept on servers inside the Union, and a company is stored in the region of the person who creates it, together with the data of every member. Wherever an account is stored, some Providers and some of our own services process Service Data outside the European Union, including in the United States (section 4.1 and chui.io/subprocessors).
\* Where an account is stored is decided once, when it is opened, from the country the connection comes from. If that was wrong (an account opened while travelling, for example), write to support@chui.io and we will move it.
Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland, that transfer is made on the basis of the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.
The Service is not directed to, and may not be used by, persons under sixteen years of age. We do not knowingly collect personal data from such persons.
We may amend this Policy from time to time. Where an amendment materially affects how we process User Content, we will provide notice within the application before it takes effect. Continued use of the Service following the effective date constitutes acceptance of the amended Policy.
Generative Chaos LLC 5900 Balcones Drive #33409, Austin, TX 78731, United States privacy@chui.io
Our representative in the European Union (Article 27 of the GDPR), whom you may contact instead of us or as well as us on any matter concerning the processing of your personal data:
Data Protection Representative Limited ("DataRep"), 77 Camden Street Lower, Dublin D02 XE80, Ireland