Privacy Policy

Last updated: October 14, 2026

This policy explains how the sole proprietor Yukiya Matsumoto ("the Operator") handles information in the Tsugra app for iPhone, Apple Watch and Mac ("the App") and in the Operator's server it connects to ("the Server"; together, "the Service"). The Japanese version is the original; if the two differ, the Japanese version prevails.

1. Information we handle and where it goes

1-1. Stays on your device (the Operator does not receive it)

• Recorded audio, transcripts, summaries, tasks, journals, settings, and your own Anthropic API key (kept in the device Keychain).
• Transcription runs on-device with Apple speech recognition by default; audio is not sent out.
• Voice enrollment (voiceprint): a numeric voice feature used to label "me" and "others" is stored only in the device Keychain. It is never sent or synced. A ~14 MB speaker model is downloaded once from Hugging Face; no audio is sent. You can delete the enrollment in Settings.
• Apple Watch recordings are transferred to the iPhone through Apple's WatchConnectivity. Watch diagnostics (numbers and stop-reason codes only; no audio, text or location) are also sent to the iPhone for display in Settings.
• API usage records (numbers only; no conversations, questions, heart rate, location or API keys) are kept on the device for 90 days.
• Mac meeting recording (microphone and system audio) and the live interpreter run on the device.
• Calendar (the device calendar): events are written only when you choose "Add to calendar". Only if you turn on "Send Note Taker to calendar meetings automatically" does the App read upcoming events on the device to find meeting URLs and times.
• Google Calendar (only if you choose "Link Google Calendar"): within the scope you approve on Google's consent screen, the App reads your events and calendar list from the Google Calendar API on your device only, and uses them solely to detect meetings (automatic Note Taker and the meeting panel) and to check whether an event suggested from a conversation is already in your calendar. Permission to write events is requested only the first time you use "Add to Google Calendar", and only events you confirm are created. Google access and refresh tokens are stored only in the device Keychain; event contents and tokens are never sent to the Server (only when Note Taker is sent to a meeting are that meeting's URL, time and title sent to the Server and Recall.ai; see 1-6). Events read from Google are never used for advertising or to train AI models, never sold, and never provided to third parties beyond what is needed for the features you use. No person, including the Operator, reads them.
• You can unlink Google Calendar at any time in Settings > Google Calendar > Unlink Google Calendar. Unlinking revokes Google's permission (the tokens are invalidated) and deletes the tokens and loaded events from the device. You can also remove access under "Third-party apps & services" in your Google Account.
• Tsugra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

1-2. Optional context added to records (supported builds only)

• Heart rate, heart-rate variability, resting heart rate, step count and sleep (read from Health; never written) and the place of a conversation (down to town name; street addresses and coordinates are not stored). Collected only if you allow it. Public builds may not include these features.
• While iCloud sync is on, these body records are not collected and existing ones are deleted.
• If enabled, they are sent to Claude together with the transcript when AI summaries, journals or "Ask" are used (see below).

1-3. Information sent out for AI features

• For summaries, classification, task extraction, journals, "Ask" and minutes, the transcript, your question and selected past records (and the optional context above) are sent to Claude by Anthropic, PBC (USA). The App asks for your consent in Settings first.
• Through the Server: the Server only relays the content to Anthropic and does not store it. To let you re-fetch a result after a dropped connection, the result is kept for at most 10 minutes and then deleted.
• With your own API key: the App sends directly to Anthropic; the Server is not involved. Costs follow your own API agreement.
• If you use the on-device AI (Apple Intelligence), that summary is not sent out.
• Cloud transcription (optional): only if you enable it and consent, the audio file and the API key you set are sent to the OpenAI-compatible transcription service you specify. That provider's terms apply.

1-4. Account and purchases (Server)

• When you sign in with Apple, Google, LINE or Facebook, the Server stores only a hash of that provider's identifier (sub), linked to a random account ID issued by the Operator. It does not store the raw identifier, your email address, your name or your profile picture. If you link several sign-in methods to one account, each hash is linked to the same account ID.
• Purchases: the Server verifies the App Store signed transaction and stores the entitlement (product ID, original transaction ID, expiry, status, appAccountToken) against your account. Payment card data is never collected (Apple processes payments).
• Usage: to enforce usage and cost limits the Server stores, per account, request IDs, operation type, state, model used, estimated cost, dates and months, and granted counts (ads, packs). It does not include conversation content.
• It also stores hashes of refresh tokens, temporary sign-in values (nonces) and identifiers of Apple notifications (to prevent duplicates).

1-5. Ads (free plan)

• When you have used the monthly "Ask" allowance on the free plan, you may optionally watch a rewarded ad delivered by Google AdMob (Google LLC).
• Ads are requested as non-personalized and the App does not ask for tracking permission (ATT). Google may nevertheless process device information and IP address for ad delivery and fraud prevention under its own policies.
• Google tells the Server, with a signature, that an ad was completed, using your random account ID; the Server then adds the allowance.

1-6. Meeting recorder bot

• When you enter a meeting URL, the Server asks Recall.ai, Inc. (Tokyo region) to send a bot named "Tsugra 記録係" into the Zoom / Google Meet / Microsoft Teams / Webex meeting to record and transcribe it.
• The Server does not store the meeting URL (it is passed to Recall.ai). It stores the meeting title, language, status, seconds used and the transcript (including participants' display names).
• The transcript is kept on the Server for at most 7 days or until the App acknowledges receipt, then deleted (capped at 1.5 MB). Media kept by Recall.ai is requested to be deleted after the transcript is fetched.
• If you turn on "Interpret in chat": during the meeting the Server receives what is said as Recall.ai transcribes it in real time (including speakers' display names), machine-translates it into the chosen language with Claude by Anthropic, PBC (USA), and posts it to the meeting chat through Recall.ai. Every meeting participant can read the translations. To transcribe non-English speech in real time, Recall.ai may use a speech recognition provider (Deepgram, Inc., USA). Utterances waiting for translation are deleted when the meeting ends and translations are not stored (only usage and cost records are kept). The cost is taken from your AI allowance.
• Tell all meeting participants beforehand that the bot will record and transcribe (see section 8).

1-7. Logs

• The Server runs on Cloudflare, Inc. It rate-limits per source (IP address) to stop abuse. The Operator does not write conversation content to logs. Cloudflare may process IP addresses and similar data to run the network.
• The App contains no analytics or tracking SDK (other than the ad SDK). This web page uses no cookies, analytics or external resources.

2. Purposes

• To provide recording, transcription, summaries, journals, search, "Ask", minutes and interpreting.
• To handle sign-in, verify purchases, manage allowances and limits, and prevent abuse.
• To investigate incidents, improve quality and answer inquiries.
• To comply with law.

We do not use information to track you for advertising or sell it to third parties.

3. Disclosure to third parties and external transfers

We do not provide personal data to third parties except with your consent, where required by law, or where Japan's Act on the Protection of Personal Information permits. The table lists the external providers that handle data to deliver the Service, or that receive information when you use a feature.

Information may be transferred to providers located abroad (for example the USA). Data-protection regimes there may differ from Japan's. Each provider handles data under its own privacy policy, and AI providers may retain data for a period; please check their published information. The Operator does not send information to these providers beyond what is needed to provide the feature.

4. Retention

• On-device data: until you delete it (audio per your retention setting; API usage records 90 days).
• Temporary AI results on the Server: at most 10 minutes.
• Meeting transcripts: until acknowledged, at most 7 days.
• Account, purchase and usage records: while the account exists. On your deletion request they are deleted unless law requires retention. When you use "Delete Account" in the App, or Apple notifies an account deletion, the corresponding sign-in links are deleted.
• How to delete your data (also if you signed in with Facebook or another provider): use Settings > Account > Delete Account in the App; the account on the Server and every linked sign-in method (the identifier hashes) are deleted. If you cannot use the App, contact us at the address below.

5. Security

Communication with the Server is encrypted (HTTPS). API keys and voice features are kept in the device Keychain. The Server uses Apple signature verification, signed tokens, rate limiting and per-account isolated storage to prevent unauthorized access and leaks. No system is perfectly secure.

6. Requests for disclosure, correction, deletion

You may request notification of purposes, disclosure, correction, suspension of use, deletion or suspension of third-party provision of the retained personal data we hold. Contact us below with your request and your account ID (shown in Settings > Account). We will verify your identity and respond within a reasonable period. On-device data can be deleted by you in the App ("Delete record data", "Sign out of all devices"). We cannot delete exported files, OS or iCloud backups, or content already sent to other companies.

7. Minors

Minors should use the Service with the consent of a parent or legal guardian. We do not knowingly collect personal information from children under 13.

8. Recording and consideration for others

The Service records and transcribes conversations. When you record other people you must respect those present and comply with the laws of your country or region (on recording, wiretapping and privacy) and with meeting and workplace rules. Giving notice and obtaining consent where required is your own responsibility. When using the meeting bot, tell all participants beforehand.

9. Changes

We may revise this policy to follow changes in law or the Service. Important changes will be announced on this page or in the App. Continued use after a revision means you accept it.

10. Contact

Operator: Yukiya Matsumoto (sole proprietor)
Contact: support@tsugra.com