Savory
1. The short version
- Meeting audio is never written to disk. Not on your device, not on ours. The code path that would save it does not exist, and an automated audit fails the build if one appears.
- Transcription runs on your Mac or iPhone. Transcripts, notes, people, and settings are stored in local storage on your device.
- A summary is the one thing that leaves as text, only for the meetings you ask about, with email addresses, phone numbers, card numbers, and internal IDs removed first.
- Savory requires an account, so our account service stores your email address and account state. It never stores your meeting content.
- On signed builds with iCloud available, your transcripts, summaries, notes, and people sync through your own private iCloud database. Audio and voiceprints never sync.
- We do not sell your information for money, your meetings are never used for advertising, and neither we nor our providers train models on your content. This marketing website measures advertising like any other website; the apps carry no advertising or analytics code at all.
The plain-language architecture explanation lives on the security and privacy page. This document is the binding one. Where the two differ, the stricter statement governs our behavior.
2. Who we are
Savory is a native macOS and iOS app operated by Gregg Hawkins, 415 Gartrell Street SE Unit 2, Atlanta, GA 30312, United States. For the purposes of the GDPR and UK GDPR, we are the controller of the personal data described here. For the purposes of US state privacy laws, we are the business.
Privacy questions, rights requests, and complaints go to privacy@savory.ai. General support is support@savory.ai.
This policy covers three things: the Savory applications for macOS and iOS, this website at savory.ai, and the Savory account service that signs you in, sends account email, meters your subscription, and forwards summary requests to an AI provider on your behalf.
3. What Savory processes on your device
Nearly everything Savory knows about your meetings is created and kept locally, at ~/Library/Application Support/Savory/ on the Mac and inside the app container on iOS. The macOS permission prompt states the audio rule in the same words the app does: "Savory listens to your microphone to transcribe meetings on your device. Audio is never saved."
| What | Detail |
|---|---|
| Meeting audio | Microphone and system audio are read into memory, handed to the on-device transcription engine, and dropped. No file is written at any point, so there is nothing to upload, sync, or recover. |
| Transcripts and speaker segments | Produced locally by Whisper models that run on your machine. Speaker separation also runs locally, from models shipped inside the app. |
| Summaries and action items | Returned by an AI provider when you ask for a summary, then stored locally. See section 5. |
| Notes, coursework, and tags | Whatever you write, plus the Notes and Student mode structures around it. |
| People | Names and email addresses extracted from calendar attendees and from meetings, deduplicated into one record per person, plus your meeting history with them. |
| Calendar caches | A disposable per-source copy of events in the sync window, plus the connected-account registry. Disconnecting a source purges its cache. |
| Voiceprints | Optional and off by default. If you turn on voice recognition, the voice embedding is stored on that device only. It is never synced and never sent to us or to anyone else. See section 13. |
| Consent records | Your recording rules, per person and per meeting, and an append-only audit log of the decisions applied. The log records the decision, never meeting content. |
| Credentials and tokens | Sign-in tokens and calendar tokens live in the system Keychain, marked non-syncing, so they stay on the device that created them. |
| Transcription models | Whisper model files downloaded on first use and stored in Application Support. Speaker separation models ship inside the app and need no download. |
At-rest protection for local storage comes from the operating system: FileVault on macOS, and system data protection on iOS.
4. What leaves your device, and when
Savory is deliberate about network use. Every outbound flow is listed here.
| What leaves | When | Who receives it |
|---|---|---|
| Account details | When you create an account, sign in, verify your email, change your password or email, or delete your account. | The Savory account service. Email address, an optional display name, a password verifier, the identifier your sign-in provider gives us, the locale and time zone signal that decides how we ask about product email, and your marketing choice. |
| Google account identity | When you sign in with Google. | Google, and then us: your Google account identifier, email address, and name. See section 5. |
| Google Calendar reads and writes | Every few minutes while a Google source is connected, and when you create, move, or delete an event from inside Savory. | Google. Calendar content is never sent to Savory servers. |
| Apple Calendar | Never. Apple calendars are read on device through EventKit, with no network step of ours. | Nobody. |
| A scrubbed transcript | Only when you ask for a summary, and only for that meeting. | Google (Gemini) or OpenAI. The request passes through the Savory account service, which forwards it under our own API key and keeps no copy, whichever way you installed Savory. See sections 6 and 9. |
| Derived text, through iCloud | Continuously, on signed builds where iCloud is available, for the account whose data is syncing. | Apple, into your own private iCloud database. Transcripts, summaries, action items, people, notes, and reminder settings sync. Audio, voiceprints, calendar caches, consent records, and Keychain secrets do not. |
| Purchase events, App Store | If you subscribe to Savory Pro in the Mac App Store version. | Apple bills you and notifies us. We receive the event, the product, the price and storefront, and hashed transaction identifiers. Apple does not give us your payment details. |
| Purchase details, savory.ai download | If you subscribe to Savory Pro in the version downloaded from savory.ai. | Stripe, the merchant of record for that sale. When you start a subscription we create a customer record at Stripe carrying your account email address and an internal account identifier, and Stripe's payment page collects your payment method and billing address directly. Stripe then notifies us of each subscription event: the plan, the price and currency, the billing country, the subscription and invoice identifiers, and the renewal, cancellation, refund, and dispute state. Stripe does not give us your card details. |
| Account email | Verification codes, password and email change notices, the closing record when an account is deleted, and product updates if you opted in. | Postmark, our email provider, which needs your address to deliver the message. |
| Crash diagnostics | If you have diagnostics sharing turned on in your operating system settings. | Apple, through MetricKit. Savory embeds no third-party crash or analytics SDK, so no crash data reaches a third party. |
| Model downloads | First launch, and when you change transcription model. | Hugging Face, which hosts the Whisper model files. The request carries no account data. |
Two things follow from that list. Transcription works with the network off, because no part of it needs a server. And a meeting you never summarize stays a meeting you never summarized: the text of it goes nowhere.
5. Google user data
Savory asks for five Google scopes. Three identify you at sign-in, and two are the calendar scopes that make the product work.
| Scope | Why Savory needs it |
|---|---|
| openid, userinfo.email, userinfo.profile | To sign you in with Google and to name the account in the app. We receive your Google account identifier, email address, and name. |
| calendar.readonly | To read the events in your connected calendars so the app can show your day, extract attendees into People, start a meeting from an event, and attach a meeting to the event it belongs to. |
| calendar.events | To act on your behalf when you ask: creating an event from the composer, moving one by dragging it, deleting one, and setting your own reminders. Nothing is written to your calendar unless you perform one of those actions. |
Where Google data goes. Your Google OAuth tokens are stored in the system Keychain on your device, marked non-syncing, and are never transmitted to Savory servers. Calendar events are stored in local caches on your device. Attendee names and email addresses from those events become People records, which sync through your own private iCloud database when sync is available. Google Calendar content is never sent to Savory's servers and is never included in a summary request except where it appears in the transcript of a meeting you chose to summarize, after the scrub described in section 6. We advertise Savory, and no Google user data is any part of that: see section 18.
Savory's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the user-facing features described above; we do not transfer or sell it to advertising platforms, data brokers, or information resellers; we do not use it for advertising, credit assessment, or lending; we do not allow humans to read it, except with your explicit consent, where required for security or to comply with applicable law, or where the data has been aggregated and anonymized; and we do not use it to develop, improve, or train generalized artificial intelligence models.
Removing our access. Disconnect the account in Savory under Settings, which deletes the stored tokens and purges that source's cached events, or revoke access at myaccount.google.com/permissions. Meetings you already recorded keep the event details captured at the time, because those belong to the meeting, not to the calendar connection.
6. What our servers hold
The Savory account service exists so that an account is portable between your devices and so that a subscription can be metered. Identity moves to the server. Content never does.
| Record | What it contains |
|---|---|
| Account | Email address, whether and when it was verified, an optional display name, an Argon2id password hash for password accounts, how the account was created, the distribution channel it came from, your product email choice and when it was set, and the region signal used to decide how we asked. |
| Sign-in identity links | The provider and the stable subject identifier for a linked Google or Apple account, and for Sign in with Apple an encrypted refresh token that exists so we can revoke Apple's grant when you delete your account. |
| Sessions | Hashed refresh tokens, their rotation family, and an optional device label. The token itself exists only in your Keychain. |
| One-time codes | Hashed six-digit codes for email verification, password reset, and email change, with a ten-minute expiry and an attempt cap. |
| Audit events | An append-only record of account lifecycle events: created, signed in, sign-in failed, identity linked, consent changed, deleted. The metadata is free of names, emails, and tokens by design. |
| Subscription events | App Store notifications for a subscription bought in the Mac App Store version: product, price, currency, storefront, renewal and refund state, and hashed transaction identifiers. Stripe events for a subscription bought in the savory.ai version: the plan, price, currency, billing country, subscription and invoice identifiers, the settled amount and fee, and the renewal, cancellation, refund, and dispute state, plus the Stripe customer identifier that links the subscription to your account. No name, no payment instrument. |
| Metering records | One row per summary attempt: which provider and model, token counts, estimated and actual cost, and the outcome. The row is keyed to a hashed subscription identifier, not to you, and carries no prompt or response text. |
| Request metadata | Your IP address is used in memory to rate-limit sign-up, sign-in, password reset, account deletion, and summary requests. Platform request logs record the usual server fields transiently. |
What the account service never holds: audio, transcripts, summaries, notes, action items, people, calendar content, voiceprints, card or bank details, and your calendar or provider tokens. When a summary request passes through the service, the scrubbed text is forwarded to the provider and not persisted, and the logger structurally refuses to write prompt, transcript, or response fields at any nesting depth.
7. Why we process it, and on what legal basis
- To provide the service you asked for (contract): creating and authenticating your account, syncing your own data through your own iCloud account, connecting a calendar, generating a summary you requested, and metering a subscription.
- With your consent: sending a transcript for summarization, storing a voiceprint, and receiving product-update email. You can withdraw any of these at any time, in the app or through the unsubscribe link, without affecting anything you did before.
- For our legitimate interests: keeping accounts secure, detecting token theft, rate-limiting abuse, understanding aggregate product and revenue performance from records that carry no personal identifiers, and defending legal claims.
- To comply with law: keeping financial records of purchases and responding to lawful requests.
8. Who else processes your information
We use a small number of providers, each for one job.
| Provider | Role | What they receive |
|---|---|---|
| Apple | iCloud sync, Sign in with Apple, App Store billing, crash diagnostics | Your synced content in your own private database, your Apple sign-in identifier, your purchase, and any diagnostics you share with Apple. |
| Stripe | Merchant of record and payment processing for Savory Pro in the version downloaded from savory.ai, including receipts, tax, refunds, disputes, and transaction support through its Link service | Your account email address, your payment method and billing address as you enter them on Stripe's payment page, and the subscription itself. Stripe uses them under its own privacy policy as the seller of that purchase. |
| Google sign-in, Google Calendar, Gemini for summaries, and website analytics through Google Analytics 4 and Google Tag Manager | Your Google identity and calendar activity; when Gemini is the provider for a summary you requested, the scrubbed transcript text; and, kept entirely separate from both, your activity on this website. | |
| OpenAI | Summaries, when OpenAI is the active provider | The scrubbed transcript text for that request. |
| Postmark | Account email and product-update email | Your email address and the message content. |
| Railway | Hosting for the account service, its database, and this website | The records in section 6, and ordinary web request metadata. |
| Hugging Face | Hosting for the transcription model files | The download request. No account data is attached. |
| Advertising platforms | Campaign delivery and conversion measurement on this website: Google Ads, Microsoft Advertising, LinkedIn Ads, TikTok Ads, Meta for Facebook and Instagram, X Ads, and Apple Ads | Your activity on savory.ai, through their conversion and audience tags. Nothing from the app, and nothing from your account. See section 18. |
We may also disclose information if we are legally required to, or to establish or defend legal claims. If the business is ever transferred, this policy travels with it and you will be told before anything changes.
We do not sell personal information for money, and no data broker appears in the list above. The advertising tags on this website do meet the definition of sharing for cross-context behavioral advertising under US state privacy laws, and in some states the definition of a sale even with no money involved. We say so plainly rather than argue the label, and section 18 is where you turn it off. The apps themselves carry no advertising identifier, no ad SDK, and no analytics SDK.
9. AI providers, and what happens to a summary request
Summaries are off until you turn them on, either globally or for one meeting. When you ask for one, the transcript is rendered as text, then scrubbed: email addresses, phone numbers, card-shaped number runs, and internal identifiers are replaced with redaction markers before anything is sent, and the assembled prompt is checked a second time for any address that slipped through.
Be precise about what the scrub does not cover. It targets identifiers, not meaning. Spoken names and the substance of your discussion are what a summary is made from, so they are sent, under your explicit consent.
The request goes from your device to the Savory account service, which forwards it to Google or OpenAI under our own API key and records only metering data. This is the same route whichever way you installed Savory.
Neither we nor our providers use your content to train models. The paid API terms under which we and you use Gemini and OpenAI exclude API inputs and outputs from model training. A provider may retain a request briefly for abuse monitoring under its own terms.
10. How long anything is kept
| Where | How long |
|---|---|
| Your device | Until you delete it. You can also set transcripts to auto-delete after 90 days, and trashed items are purged on their own window, 30 days by default. |
| Your iCloud database | For as long as the synced copy exists. Deleting your account removes the whole zone that held it. |
| Account record | Until you delete your account, at which point the row is hard-deleted rather than flagged. |
| One-time codes | Ten minutes, and single use. |
| Sessions | A refresh token slides for up to 60 days of use, and a sign-in family expires 180 days after it began. Signing out revokes them immediately. |
| Audit events | Retained after account deletion, because they are the record that the deletion happened. They contain no personal identifiers. |
| Subscription and metering records | Retained as financial records. On account deletion the link to your account is severed at the database, leaving a record that can no longer be attributed to you. |
| Delivery records are held by Postmark under its own retention schedule. Suppression entries for unsubscribes and complaints are kept so we cannot email you again by accident. | |
| Website analytics and advertising cookies | Analytics event data is retained for 14 months. The cookies and tags themselves expire on their own schedules, at most 13 months for visitors in the EEA and the UK. |
| Website logs | Ordinary request logs, held transiently by the hosting platform. |
11. Deleting your data
Signing out removes nothing. Deletion is its own explicit act, and there are two of them.
- Delete all data clears the account's content on that device and hard-purges any stored voiceprints. It is confirmed with biometrics, and the deletion propagates to your other devices through sync. The account itself stays.
- Delete your account is gated by both biometrics and a re-authentication against the server. It removes the server record first, then your iCloud zone, the on-disk storage, the Keychain tokens, and the local rows, in an order that leaves nothing orphaned if it is interrupted. If you signed in with Apple, we spend the stored Apple refresh token to revoke that grant. A closing record is emailed to your former address.
What survives, deliberately: the PII-free audit row that records the deletion, and the financial records described above with the identity link severed. Nothing that survives can be traced back to you by us.
Because your content is on your device, export is a first-class action rather than a request queue: notes and transcripts export to plain files at any time.
12. Your rights
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. You also have the right to complain to your supervisory authority.
If you are a resident of California, Colorado, Connecticut, Virginia, or another US state with a comprehensive privacy law, you have the right to know what we collect and why, to access and delete it, to correct it, to receive a portable copy, and to opt out of sale, sharing for cross-context behavioral advertising, and profiling. We do not sell personal information for money, and we do not profile you in any way that produces legal or similarly significant effects. We do share website activity with advertising platforms for cross-context behavioral advertising, which those laws treat as sharing and some treat as a sale, and section 18 gives you three ways to stop it, one of which is the Global Privacy Control signal we honor automatically. Meeting content, account records, and Google user data are never part of that sharing. We do not process sensitive personal information to infer characteristics, and we do not use or disclose it beyond the purposes described here. We will not discriminate against you for exercising any right.
Most rights are self-service: your content is on your device, export produces plain files, and deletion is a button. For anything you cannot do yourself, write to privacy@savory.ai from the address on the account. We will verify that the account is yours, answer within 30 days, and tell you if we need longer. If we refuse a request you may appeal by replying to our decision, and we will answer the appeal within 45 days.
13. Recording, consent, and other people
Recording laws vary by place and context, and some require the consent of every participant. You are responsible for obtaining any consent the law requires where you record. Savory is built to help you act deliberately rather than by accident: every session passes a consent gate before capture begins, a denial prevents capture rather than discarding it afterwards, you can mark people who should never be recorded, and every applied decision is written to an audit log that records the decision and no meeting content.
Voice recognition deserves its own paragraph, because a voiceprint is biometric information. It is off by default. If you turn it on, the voiceprint is created and stored on that device, is excluded from sync by a structural rule rather than a setting, is never transmitted to us or to any provider, and is hard-purged when you delete your data. We never collect, receive, or possess it. Anonymous speaker separation, which labels voices as speaker one and speaker two within a single meeting, persists no biometric at all.
These are engineering facts, not legal advice. If you record in a regulated setting, check your own obligations.
14. Children
Savory is not directed to children. You must be at least 16 to use Savory, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to privacy@savory.ai and we will delete it.
15. Security
Secrets live in the system Keychain, marked non-syncing, so a token cannot follow you to a device you did not authorize it on. Passwords are hashed with Argon2id and never stored or logged in the clear. Refresh tokens rotate, and reusing a replaced token revokes the whole sign-in family as a theft signal. Traffic to our service and to every provider runs over TLS. Server logs refuse fields that would carry a password, token, code, email address, or message body, at any nesting depth. There is no third-party analytics or crash SDK in the app. And the guarantee at the center of the product is enforced by a build gate: an automated audit runs on every change and fails the build if a path that writes audio to disk appears.
No system is perfect. If you find a vulnerability, write to support@savory.ai with the subject line Security, and we will work with you.
16. Where your information is processed
Savory is operated from the United States, and the providers in section 8 process data in the United States and in other countries where they operate. If you use Savory from outside the United States, your information is transferred there. Where a transfer of personal data out of the European Economic Area, the United Kingdom, or Switzerland requires a safeguard, we rely on the standard contractual clauses in our agreements with those providers.
17. Cookies and this website
savory.ai uses cookies, pixels, and similar technologies, in three kinds, and the difference between them is the whole point of this section.
- Strictly necessary. What the site needs to serve pages and stay secure. Your light or dark theme choice is remembered here too, in a browser session value rather than a cookie, and it never leaves your browser.
- Analytics. Google Analytics 4, deployed through Google Tag Manager, tells us which pages people read, where they arrived from, and whether a visit ended in a download or a sign-up.
- Advertising. Conversion and audience tags from the platforms we advertise on, so we can tell which campaigns work and show Savory to people who visited without signing up.
What those tags collect is ordinary website data: pages viewed on savory.ai, an approximate location derived from your IP address, your device and browser, the site or ad that referred you, links clicked, and whether a visit turned into a download or a sign-up. What they never receive is in section 18, and the list is short because the boundary is structural: they run on this website, and this website holds none of your Savory data.
The hosting platform keeps ordinary web request logs. If you email us, we use your message to reply to you and for nothing else, and we never add you to a mailing list from it.
18. Advertising, and your choices
We advertise Savory, and we measure whether the advertising works. All of that happens on this marketing website and nowhere else. Analytics run on Google Analytics 4 through Google Tag Manager; the conversion and audience tags belong to the platforms we buy ads on: Google Ads, Microsoft Advertising, LinkedIn Ads, TikTok Ads, Meta for Facebook and Instagram, X Ads, and Apple Ads.
Under US state privacy laws, running those tags is sharing personal information for cross-context behavioral advertising, and in several states it meets the definition of a sale even though no money changes hands. We describe it that way rather than argue the label. What we do not do is take payment for personal information, and what those platforms get is the website activity described in section 17.
- No advertising or analytics code ships inside the Savory apps, on any distribution channel. Advertising lives on the website, and the website holds none of your Savory data.
- No meeting content is ever used for advertising or handed to an advertising platform: not audio, not a transcript, summary, action item, note, person, voiceprint, or calendar event.
- Google user data received through the sign-in and Calendar scopes is never transferred to an advertising platform, never used to build an audience, and never used for advertising or ad targeting. That is the Limited Use commitment in section 5, and running campaigns does not touch it.
- Account records such as your email address or subscription state are not uploaded to an advertising platform for audience matching, hashed or otherwise. If we ever propose to do that, this policy changes first and it runs on your consent, not on notice.
Your privacy choices
Any one of these stops the advertising and analytics tags. You do not need to do more than one.
- The footer link. "Your privacy choices", in the footer of every page, is our "Do Not Sell or Share My Personal Information" link, and it brings you here.
- A universal opt-out signal. We honor a legally recognized universal opt-out signal, including Global Privacy Control. If your browser sends one, we treat it as an opt-out of sharing for targeted advertising for that browser, and nothing further is required of you.
- Consent, if you are in the EEA, the UK, or Switzerland. Nothing beyond the strictly necessary loads until you allow it, and you can withdraw that permission at any time, with the same effect as never having given it.
- The platforms and your browser. Google Ads Settings, the industry opt-outs at optout.aboutads.info and optout.networkadvertising.org, your device advertising controls, and ordinary cookie blocking all work here, because these are ordinary web tags.
- Ask us. Write to privacy@savory.ai and we will apply the opt-out for you. An authorized agent may do it on your behalf.
Opting out of advertising changes nothing about the app. Savory works identically either way, and there is no version of Savory that shows you ads.
19. Changes to this policy
If we change how Savory handles your information, we will update this page, change the version and effective date above, and describe the change in the changelog. Material changes are also announced in the app. Continuing to use Savory after a change means the updated policy applies to you.
- Version 1.1, September 5, 2026. The published Savory privacy policy, covering the apps, this website, the account service, Google user data, and advertising. This version adds Stripe as the merchant of record for Savory Pro in the version downloaded from savory.ai, and records that summary requests from every version pass through the account service under our own key.
20. Contact
Savory, operated by Gregg Hawkins
415 Gartrell Street SE Unit 2, Atlanta, GA 30312, United States
Privacy and rights requests: privacy@savory.ai
Support: support@savory.ai
Security reports: support@savory.ai, subject line Security