Privacy Policy

HIBACHI inc. ("we", "us", or "our") is committed to protecting the personal information and privacy of users of Reki note (the "App"). This Privacy Policy explains what data the App collects, how it is used, and how it is stored.

This service is intended for users aged 13 and older. Persons under 13 may not use this service.

Company: HIBACHI inc.

Representative: Takashi Tanaka

Address: FPG Links Jinnan 5F, 1-11-4 Jinnan, Shibuya-ku, Tokyo 150-0041, Japan

Contact: contact@hibachi-inc.jp

The App collects the following data:

■ Account information: The email address used to sign in. If Google Calendar integration is enabled, we also collect the connected Google Account's email address, display name, and immutable identifier assigned by Google (OpenID Connect subject), and store them on our servers to manage the connection with the user's Reki note account.

■ Audio data: Audio files temporarily generated on your device during meeting recordings. These are sent through our servers to AI service providers for transcription. Our servers do not store audio data and discard it after processing.

■ Transcription and meeting notes: Text generated from audio, including transcriptions and meeting notes. If cloud sync is enabled, this data and related meeting metadata are encrypted and stored on our servers.

■ Calendar information: If calendar integration is enabled, we retrieve meeting times, titles, meeting links, locations, and attendee names and email addresses from calendars owned by the user via the Google Calendar API (calendar.events.owned.readonly scope) or macOS EventKit. OAuth tokens for the shared Google connection are encrypted and stored on our servers; calendar events are retrieved through our servers for display in the desktop and web apps. Authorized MCP integrations can also access calendar events. Google connections configured in older desktop versions remain on the device until you reconnect. macOS EventKit data is accessed locally on the device. When the user records a meeting or generates meeting notes, relevant meeting metadata may be sent through our servers to AI service providers as context for transcription and meeting note generation. If cloud sync is enabled, meeting metadata associated with recordings is encrypted and stored on our servers. Calendar information is used only to provide the App's features and improve transcription accuracy. It is not used for advertising, marketing, or AI model training.

■ Usage data: We collect anonymous usage statistics (e.g., number of recordings, meeting notes generated) to improve the App. We do not collect personally identifiable information such as transcription text, meeting notes content, meeting titles, attendee names, or file paths.

■ Work log (beta, optional, off by default): Only when you enable this feature, the App records the name of the app in use, window titles, the timing of activity, images of the front window, and text read from those images on your device, in order to create a record of your work. On-screen body text is captured only if you separately enable it. Excluded apps, password managers, and locked or idle screens are not recorded. This data is stored on your device and deleted after the retention period you set (7 days by default; 1, 7, or 30 days).

■ Work log summaries: While the work log is enabled, about every 30 minutes the App sends a selected portion of the text above, and when needed up to three window images, to the AI service selected in your settings to generate a summary of your work. Summaries may include app names, on-screen text, file names, and commands that were visible on screen. Summaries are stored on your device until you delete them.

■ Work log annotations: MCP integrations (AI services) that you have allowed to write can add annotations describing the intent, decisions, and outcomes of your work to our servers, separately from the summaries. Each annotation stores its text, supporting evidence, the time range it refers to, any related task, and the name of the integration that added it. Annotations are append-only and are not modified afterwards.

■ Detection improvement mode (macOS only, optional, off by default): Only when you enable this feature, the App sends the titles of windows open during meetings to improve call-detection accuracy. Titles may include meeting or attendee names (email addresses and URLs are stripped before sending). This data is used only to improve detection accuracy and is never shared with third parties. The feature is disabled by default and can be turned off at any time in the App's settings.

Collected data is used solely for the following purposes:

- Providing the App's features (transcription, meeting notes generation, cloud sync)

- Account authentication and management

- Improving the quality of the App and fixing bugs

- Responding to customer inquiries

We do not use your audio data, transcription data, meeting notes, or work log data for the purpose of training, improving, or developing AI models. Your data is processed solely to provide the App's features.

When cloud sync is enabled, transcription, meeting notes, and related meeting metadata are encrypted and stored on our servers. You may enable or disable cloud sync at any time. When disabled, this data is stored only on your device.

For the work log, when cloud sync is enabled, only the roughly 30-minute summaries (up to 4,000 characters each) and a number indicating the amount of activity are stored on our servers. The underlying records, such as app names, window titles, on-screen text, text read from images, and images, are not stored on our servers. Stored summaries and annotations can be read by MCP integrations you have authorized.

Data stored in the cloud is permanently deleted when you delete your account or request data deletion.

We do not disclose your data to third parties except in the following cases:

- With your consent

- When required by law or legal process

- To service providers (cloud infrastructure, payment processors, etc.) to the minimum extent necessary to provide the App's features. In such cases, we require these providers to handle data appropriately.

The App uses APIs from external AI service providers for transcription and meeting notes generation. Audio data, text data, and meeting metadata required for processing are sent through our servers to these providers.

These providers' servers are primarily located in the United States. While the United States does not have comprehensive data protection laws equivalent to Japan's Act on the Protection of Personal Information, each provider protects data in accordance with its own privacy policy.

■ Transcription: Speech recognition services located in the US — audio data is transmitted

■ Meeting notes and chat: AI services located in the US — text data is transmitted

■ Work log summaries: AI services located in the US, or the AI service you select in settings — work log text and, when needed, window images are transmitted (nothing is sent externally if you select an on-device AI)

■ Cloud sync: Cloud database services located in the US — transcription, meeting notes, and related meeting metadata are stored

■ Payments: Payment services located in the US — email addresses and payment information is processed

■ Analytics: Analytics services located in the US — anonymous usage data is transmitted

Please refer to each provider's privacy policy for details on how transmitted data is handled.

■ Audio data: Immediately discarded from our servers after transcription processing is complete. Recording files on your device are retained until you manually delete them.

■ Transcription, meeting notes, and related meeting metadata: Retained on your device until the App is uninstalled. If cloud sync is enabled, data is permanently deleted from our servers within 30 days of account deletion or a data deletion request.

■ Work log: The underlying records (app names, window titles, on-screen text, images, and text read from images) are deleted from your device after the retention period you set. Summaries are retained on your device until you delete them. Summaries and annotations stored on our servers are permanently deleted within 30 days of account deletion or a data deletion request.

■ Account information: Permanently deleted within 30 days of an account deletion request.

■ Usage data: Retained in anonymized form for up to 24 months.

We implement the following security measures to protect your data:

■ Encryption in transit: All data transmission is encrypted using TLS 1.2 or higher.

■ Encryption at rest: Data stored in the cloud is encrypted using AES-256.

■ Access control: Data access is restricted to authenticated users only. Administrative access is managed based on the principle of least privilege.

■ Local data: The security of data stored on your device depends on your operating system's security features.

In the event of a data breach or unauthorized access, we will promptly investigate the scope of impact, notify affected users, and report to relevant authorities.

You have the following rights regarding your data:

- Request disclosure of your personal data

- Review and correct your account information

- Request deletion of data stored in the cloud

- Delete your account

- Opt out of usage data collection (can be disabled in the App's settings)

To exercise these rights, please contact us at the address below. We will respond within two weeks.

We may update this policy in response to changes in law or our services. If we make significant changes, we will notify you through the App or on our website.

If you have enabled Google Calendar integration, you can revoke access at any time by:

- Selecting "Disconnect Google Calendar" in the App's settings

- Removing Reki note's access in your Google Account settings (https://myaccount.google.com/permissions)

When you disconnect an account, we delete its OAuth tokens stored on our servers and stop retrieving its events through the shared connection. Connections configured in older desktop versions must be disconnected separately on each device.

Reki note's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

For details, see https://developers.google.com/terms/api-services-user-data-policy.

For inquiries about this policy or the handling of personal information, please contact:

HIBACHI inc. — Privacy Inquiries

Email: contact@hibachi-inc.jp