AI meeting summary privacy comes down to one door

Every honest privacy claim has an exception. Make a tool show you the exception before you believe the rest of the sentence. Most of what Savory does never touches a network: capture, transcription, the people library, and search all run on the machine in front of you, and none of it ever leaves your hardware. That side of the story lives in full on the privacy page and in the piece on on-device transcription. This post is about the exception.

AI meeting summary privacy is not really a question about walls. It is a question about one door, because the optional AI summary is the only feature in Savory that sends anything off your Mac. Everything else you do in the app leaves no trace beyond your own hardware. One door, and it stays shut until you open it.

There is a design decision underneath that. Rather than scatter network calls across the app wherever they happened to be convenient, the whole summary path is funneled through one place you can audit. A single door is a thing you can inspect, gate, and reason about. A hundred small ones are a thing you have to trust.

To be exact about the walls before we leave them: your audio is captured and transcribed on your own machine, the transcript and the people around it stay in a local store, and search runs against that store without a round trip. None of that is what this post defends. This post defends the one place where that pattern is broken on purpose.

So the rest of this is a tour of that door. What opens it, what passes through it, what gets stripped on the way out, and what, honestly, does not. If you remember one thing from this, remember that nothing goes through the door unless you are the one who sends it.

Off until you open it

The summary feature ships off. A fresh install records, transcribes, and files meetings without ever composing a single network request, and it will keep doing exactly that forever if you never change a setting. Summaries are opt-in, off by default, and decided per meeting.

Off by default is a phrase every product uses, so here is the concrete version. A transcript-only meeting stays transcript-only until you explicitly ask for a summary of that specific meeting. There is no global switch that quietly turns your whole library into outbound traffic, and no background job that summarizes things while you sleep.

There is a reason it is per meeting and not a blanket setting. Most meetings never need a summary. A one-on-one you remember fine, a standup that ran five minutes, a call that ended in a decision you already acted on: sending those to a model would be cost and exposure with no return. Making the choice small and local keeps the default at nothing sent.

This is also why the free plan makes no calls at all. Summaries are the Pro feature, and on the free plan the paywall stands in front of the generate button, so there is nothing to send and no way to send it. That is not a policy we are promising to honor. A request from an account without Savory Pro would be refused by the account service anyway, and you can see where the plans draw that line on the pricing page.

The feature itself, the key topics, decisions, and action items with owners, is described on the summaries page. Here we care only about the plumbing behind it: the moment you tap generate, and what physically happens next.

One route, whichever way you installed it

The first thing that happens when you tap generate is that Savory checks your subscription. Summaries are part of Savory Pro, and the check happens before anything else: without an active subscription or trial there is no request to make, and the code path simply does not run. That is not a feature flag you can forget to set. It is the literal precondition for the door to open.

When the call does run, the scrubbed text goes from your Mac to the Savory account service, and the account service forwards it to the AI provider, Google's Gemini or OpenAI, under a key that Savory holds. Your Mac never talks to the provider directly, and no provider credential ever lives on your machine. That is one route, the same one whether you installed Savory from the Mac App Store or downloaded it from this site.

What the account service does with the text is the whole question, so here is the exact answer. It forwards the request and returns the response. It keeps no copy of the transcript or the summary, it holds no transcript, note, person, or calendar event for any account, and its logger structurally refuses to write message bodies, so a prompt cannot end up in a log line even by accident. What it does record is metering: which account asked, when, how many tokens went out and came back, and what that cost. A number, never a sentence.

That arrangement has a plain consequence worth stating out loud. The provider relationship is Savory's, not yours. You do not sign up with OpenAI or Google, you do not paste in credentials, and you cannot be billed by them. In exchange, Savory is now a party in the path, which is a heavier promise than the one this post made when it was first published, and it is why the account service is built to hold as little as it does.

Your subscription is not the same thing as safe to send raw. A transcript is a dense object, full of the kind of strings you would not want copied into a third party's logs by accident. So before the text leaves your Mac, it goes through a scrubber.

What the scrubber removes, and what it doesn't

The scrubber runs on your Mac, before anything reaches the account service. It makes a pass over the transcript and removes four specific kinds of identifier: email addresses, phone numbers, runs of sixteen digits shaped like a card number, and UUIDs, the long machine-generated ID strings that show up in shared links and internal tools. All four are pattern-shaped, which is exactly why they can be found and stripped reliably before anything is sent.

Each summary records how many identifiers it stripped. That per-summary redaction count is not decoration. It is a receipt. It means the scrubbing is a measured event you can look at after the fact, not a claim you are asked to take on faith.

Now the part most privacy pages quietly skip. The scrubber does not remove spoken names, physical addresses, Social Security numbers, or dates of birth. If those things were said in the meeting, they are in the transcript, and they are sent verbatim. It would be easy to imply otherwise on a marketing page, and it would be false.

Attendee names are not an oversight, either. They are kept on purpose. A summary that says 'Speaker 2 will own the forecast' is useless, so real names are deliberately included as labels, and inline speaker names in the transcript itself are a macOS and Meetings-mode feature. The trade is honest: the summary is useful precisely because it knows who said what, and that means names cross the door.

So do not read the scrubber as anonymization, because it is not that. It removes four classes of machine-readable identifier and nothing more. The right mental model is a filter that catches the strings you would most regret leaking automatically, not a curtain that hides who was in the room or where they live.

Two more passes before the send

Scrubbing is not the only thing that runs before the request goes out. A prompt guard makes a second pass over what is about to be sent, layered on top of the scrubber rather than standing in for it, and catches any address that slipped through the first pass. Two passes, not one, on the way to the door, and both of them run on your Mac.

There is also a daily allowance. Savory Pro includes a fixed amount of summary generation per day, sized to cover a normal day of meetings, and the account service meters every request against it. A pathologically long transcript or a runaway loop cannot quietly turn into an unbounded bill for anyone: when the allowance is used up, summaries pause until the next day, and nothing else in the app is affected.

The order matters, so it is worth naming. The subscription check runs first, then the transcript is scrubbed, then the prompt guard reviews what scrubbing produced, all on your machine, and only then does the request reach the account service, which clears it against the allowance before it forwards a single token. A failure at any one of those steps stops the send rather than chasing it out afterward.

Neither of these changes the honest limits above. A prompt guard and an allowance are gates on the door, not new walls behind it. They exist so that the one path in the app that can send text off your Mac is the most scrutinized path in the app, not the least.

Where the text lands, and whose rules apply

Once the scrubbed text reaches Gemini or OpenAI, it is in their hands under their terms. Savory uses both providers under their paid API terms, and those terms exclude what you send and what comes back from being used to train their models. A provider may keep a request for a short time for abuse monitoring under its own policy. That is a genuine boundary, and pretending otherwise would be its own kind of dishonesty.

This is the edge of what Savory can promise. The guarantee is scoped to three things: what the scrubber strips before sending, the opt-in gate that keeps the door shut until you open it, and what the account service refuses to keep along the way. What a provider does with the text after it arrives is governed by Savory's contract with that provider, and the privacy policy names both providers and states that contract's terms plainly.

Which provider handles a given request is Savory's call, not yours, and we would rather say that than imply a choice you do not have. Both are held to the same no-training terms, and if that ever stops being true for one of them, the policy changes before the routing does.

That is not a dodge. It is the accurate shape of the situation. If a provider's retention terms matter for a given transcript, and for some transcripts they genuinely should, read the policy the way you would read any vendor you hand data to. Savory's job is to make sure the text that reaches them is opt-in, scrubbed, guarded, metered, and forwarded by a service that keeps none of it. It is not to quietly rewrite the policy on the other side of the door.

What changed, and why this post says so

When this post was first published, the door was keyed to a credential you pasted in yourself: summaries ran on your own OpenAI or Gemini account, straight from your Mac, and there was no Savory server in the path. The post said a hosted path was planned and not shipped, and promised that if the shape changed, the page would change with it. The shape changed in September 2026, when Savory Pro replaced the bring-your-own-key arrangement on every version of the app, so this is the page changing with it.

What the new shape costs you is stated above and not softened: Savory now sits in the path and holds the provider relationship. What it buys is also real. There is no credential on your machine to leak, nothing to configure before the first summary, no separate provider bill, and a daily allowance instead of an open-ended meter on an account of your own. The account service that makes this possible is built to keep nothing but numbers, and the privacy page and the policy both describe it in the present tense.

We keep this section here for the same reason we listed what the scrubber ignores. A privacy story is only trustworthy to the degree it tells you where its edges are, and a page that quietly rewrote its own history would be a nicer way of being wrong.

Read the door, not the brochure

If you want to check any of this, the test is a close cousin of the one that works for the walls. On the free plan, tap generate and you meet the paywall, not a network request. On Savory Pro, ask for one summary and watch the redaction count tell you how many identifiers it stripped on the way out. Turn Wi-Fi off and everything else in the app keeps working, because everything else never needed the door.

The strongest version of a privacy claim is one you can verify without trusting the person making it. The walls, capture and transcription done locally, are close to physics. The door is narrower and more deliberate: opt-in, gated by your subscription, scrubbed, guarded, metered, and forwarded by a service that keeps only the count. Both are stated the same way, in plain language, so you can check either one for yourself.

None of this asks you to like the trade. You are allowed to decide that even one scrubbed, opt-in request is one too many, and to never turn the feature on. That is a supported way to use Savory, not a degraded one. The transcript and the people library are the product; the summary is the one optional step that reaches past your own hardware.

If you want the feature-level version of all this, the summaries page walks the same door from the product side. Read it, look at what the scrubber does and does not touch, and then decide for yourself whether to open the door at all.