Privacy policy

Draft. Last edited 14 August 2026.

The short version: the default on-device plans keep audio and transcript text on your device. If you bring your own key on a backend you run, your transcript stays inside your own infrastructure and we never receive it. On the paid hosted tier, transcript text transits our server and our model provider to generate the copilot. Our production application logs exclude transcript-derived text, and our server copy follows the retention setting you choose. Optional Fast transcription sends audio directly to ElevenLabs. The app contains no advertising, tracking, analytics SDK, or crash-reporting SDK.

Where your data goes, by tier

The one thing that is true everywhere: raw audio never reaches a Cyrano server. The protocol the app uses has no audio field, so there is nothing to upload. Everything else depends on your tier:

The in-app “Where your data goes” screen (in Settings, and linked from the first-run consent screen) shows this same breakdown computed live from your current settings, so it reflects your actual configuration, not a generic promise.

Audio never leaves your device

Transcription and speaker labeling run on-device using Apple's speech frameworks. Audio buffers exist only in memory during processing and are discarded immediately after use; raw audio is never written to disk, caches, temp files, or crash logs. This is enforced by construction, not by promise: the protocol the app uses to talk to a backend has no audio field at all, so there is nothing an app bug or a server could upload or store.

The one exception is explicit and opt-in: the "Fast transcription" setting (off by default) streams session audio to ElevenLabs for cloud transcription instead, described under "Optional ElevenLabs features" below.

Sessions are explicit

Cyrano is never always-listening. Nothing is captured until you start a session; while one is active, the operating system's microphone indicator and a prominent in-app state make that visible; and sessions auto-expire (default 30 minutes). On the Mac, capturing system audio (for example, the other side of a call) is a separate, off-by-default opt-in behind its own consent gate and macOS's own permission prompts. The automation paths cannot route around that gate.

The free tier: no server at all

With no backend configured, live transcription, speaker labeling, the semantic map, session review and history, spoken whispers, and redaction all happen on your device. No account exists, nothing is transmitted, and there is nothing for anyone to collect.

The copilot: bring your own key

Cyrano's analysis features (commitments, open asks, subtext, next moves, custom watch categories, generated whispers) require a backend. You can run that backend yourself as a Cloudflare Worker on your Cloudflare account and provide your Anthropic (or OpenRouter) API key. When you do:

• Transcript text (never audio) streams over TLS to your worker, and to no other destination.
• Your worker sends transcript windows to your LLM provider under your own key and account terms for analysis. How that provider handles API data is governed by your agreement with them, not by us.
• We are not in the loop. We do not operate, have access to, or receive data from your worker, your Cloudflare account, or your LLM account. We cannot read, disclose, or delete your transcripts because we never have them.

One nuance so this is exact: if you enter your own API key but point the app at our hosted worker (rather than one you run), your key isn't billed to us, but your transcript text still transits our server, exactly as in the hosted tier below. “We never receive it” holds only when the backend is one you run.

The copilot: hosted (paid subscription)

If you'd rather not run any infrastructure, a paid subscription connects you to our hosted backend, running on our LLM key. This is a real convenience tradeoff, and we describe it plainly rather than dress it up:

• Transcript text (never audio) streams over TLS to our Cloudflare Worker and is sent to OpenAI's API on our key to generate the analysis. OpenAI's handling and retention of API inputs and outputs is governed by our agreement and production account controls with OpenAI.
• Production application logs exclude transcript-derived text. We retain non-content operational events such as counts, timings, provider/model identifiers, and failure notices. A separate content-debugging flag exists only for controlled test deployments and is disabled in the production configuration.
• Our server copy is deleted when your session ends, unless you choose 24-hour or pinned retention. Deletion from our Worker does not control any separate retention required by the model provider under its terms or account-level data controls.
• If you want zero transcript data to reach us, don't use this tier. The free on-device tier transmits nothing, and bringing your own key on a backend you run keeps every transcript inside your own infrastructure. Both are first-class, and the app makes it easy to switch.

Retention is yours to set, per session, on every tier that uses a backend: ephemeral (the default, where the transcript is deleted when the session ends), 24 hours, or pinned until you delete it. Retention is enforced server-side. Every session review screen has a one-tap control to redact the other party's lines, and purge is a single call.

Service providers for the hosted tier: Cloudflare (Workers and Durable Objects that run the backend), OpenAI (the model that produces the analysis), and Apple or Stripe (subscription processing, depending on where you purchased). The free tier does not use these services for session analysis. A backend and model account you run yourself operate under your own agreements rather than ours.

Speaker labels, not identities

Speaker labeling distinguishes only "you" and "other" (or "unknown" below a confidence threshold). Cyrano does not identify third parties, build voiceprints, or persist voice embeddings.

Optional ElevenLabs features (off by default)

Two settings trade privacy for speed, and both require you to enter your own ElevenLabs API key, which is stored only in your device's Keychain. In both cases your device talks to ElevenLabs directly. No Cyrano backend is involved. ElevenLabs can associate requests with the account represented by that API key and may retain API inputs or outputs according to that account's settings and agreement:

• Fast voice sends the text of a whisper (a short generated cue) to ElevenLabs for speech synthesis.
• Fast transcription streams the session's raw audio continuously to ElevenLabs for cloud transcription, including what other participants say. This is a materially bigger tradeoff than fast voice and is the only way audio ever leaves your device. The setting says so in plain language before you enable it.

Optional context sharing and agent connections (off by default)

• Context sharing lets you deliberately attach your clipboard or a single app window to a session. The clipboard is read only at the moment you press attach; window snapshots are OCR'd on-device and analysis receives text only. Attachments are used once and discarded by default, even in retained sessions, unless you choose to keep one.
• Agent connections let you mint a separate, revocable key so an AI agent of yours can read session context from your worker and post findings back. Keys are stored hashed on your worker and can be revoked in Settings at any time. What your agent does with the context is between you and it.

No advertising or behavior analytics

The app contains no advertising, tracking, analytics, or crash-reporting SDK. We do not record taps, scrolling, browsing history, searches, or advertising identifiers. Hosted accounts do have a service-usage meter tied to their subscriber identifier: it records aggregate model spend for the billing period and lifetime so we can enforce fair-use and abuse limits. It does not contain transcript text. Production backend logs contain non-content operational events such as counts, timings, provider/model identifiers, and failure notices; transcript-derived text is disabled by the production logging flag.

Data collected through the app

Using the App Store's definition of collection, Cyrano and its service providers may collect the following when you use the corresponding feature:

• Audio data: only when you enable Fast transcription and send audio to ElevenLabs.
• Other user content: transcript text and any context you explicitly attach to a hosted session, plus text sent for optional Fast voice.
• Photos: only when you explicitly send a screenshot or other image to a connected agent; ordinary analysis receives on-device OCR text rather than the image.
• Identifiers, purchases, and other usage data: a hosted subscriber identifier, purchase status and paid-through information, and the aggregate service-usage meter.
• Customer support, email address, device identifier, and diagnostic data: only when you affirmatively send an in-app report; the report contains what you type, an optional reply address, and—if you leave the clearly displayed switch on—the listed app version, build, platform, OS version, device model, and locale. A short-lived hash of the connecting IP address is kept for daily abuse prevention.
• Performance data: non-content server timings and request-performance information used to operate and troubleshoot the hosted service.

We use these data only for app functionality, customer support, billing, security, fraud prevention, and maintaining the service. We do not use them for advertising or tracking and do not sell them.

This website and downloads

• This site sets no cookies and runs no analytics or tracking scripts.
• The site is served by Cloudflare, which processes request metadata (such as IP addresses) transiently as any host does.
• The download button redirects to the app installer hosted on DigitalOcean Spaces, which keeps standard download request logs.
• The app's update check fetches a small public version.json manifest to see whether a newer build exists. It is an ordinary file download that carries no personal data.

What we actually hold about you

On the free and bring-your-own-key tiers: nothing, unless you email us. In that case we have your email address and whatever you wrote, kept only to answer you. There are no accounts, no user database, and no transcripts.

On the hosted (paid) tier, Apple or Stripe processes payment; we do not receive payment-card details. We hold a subscriber identifier, purchase provider and subscription record, paid-through/status information, and the aggregate service-usage meter. Our Worker also holds transcript text while a hosted session runs and for any longer retention option you choose. Production application logs exclude transcript-derived text. Our model provider may separately retain API inputs and outputs under its agreement and the controls enabled on our production account.

Children

Cyrano is a productivity tool for general audiences and is not directed at children under 13. We don't knowingly collect data from children. Collection varies by plan and optional feature as described above.

Changes

If this policy changes materially we'll update the date above and note the change on this site.

Contact

Questions about privacy? Write to admin@frnd.tech.