Privacy by architecture, not by promise.
Most notetakers ask you to trust a policy. Recard names each path precisely: Standard recordings are processed securely in the cloud and synced; Ultra Privacy uses the same Vertex AI processing but returns the full result to the phone and verifies deletion of every Recard-managed cloud copy.
Two modes, named plainly, never blurred.
Ultra Privacy is transient cloud processing with verified application-level deletion, not on-device AI. Here is exactly what happens.
Standard Synced to your library
Ultra Privacy Temporary processing (normal plan limits)
Verified cleanup Before success is shown
Ultra Privacy temporarily creates the minimum application records and storage objects required to process a recording. Before the app reports success, Recard deletes and checks the recording, audio, transcript, analysis, notes, indexes, share tokens, and Vertex staging objects. Google states that Vertex AI customer data is not used to train models without permission. Limited provider service or abuse-prevention data may be processed under Google Cloud’s own terms.
Ask & Voice stay optional. A separate iPhone switch is off by default. If enabled, Ask sends the minimum local transcript and analysis needed for that interaction; Voice sends compact meeting context plus live microphone audio. Recard keeps no cloud-library copy or search index for that private context. Conversation history stays on the iPhone and clears after 24 hours of inactivity. This is transient cloud AI, not an on-device model.
Specific, testable, not marketing fog.
Every claim below is something you can verify in the app, not a vague reassurance. If you can’t check it, we shouldn’t say it.
Local-first storage (Android)
On Android, your library lives in a database on your device. Recordings, transcripts, and notes open offline, put the phone in airplane mode and they’re still there. The web app syncs your library from the cloud.
Processed in the cloud, then synced
Standard recordings are processed securely in the cloud and synced to your private library. Ultra Privacy returns the same complete result to the phone without keeping a synced server copy.
Ultra Privacy verifies the wipe
Recard does not label the result complete until its temporary cloud objects and records are deleted and checked. If cleanup cannot be verified, the original audio stays on the phone for retry.
Private Ask is explicit
Ultra recordings are absent from Ask and Voice by default. The separate switch sends bounded context only for the requested interaction and never writes its transcript or embedding into Recard’s cloud library.
Never trained on your data
Your recordings are processed under Google Cloud’s Vertex AI terms and are not used to train AI models. Processing is transient, not a training set.
Email from your own account (Android)
On Android, summary emails send through your own SMTP server and never pass through Recard’s cloud. We never see the recipient or the content.
Biometric app lock (Android)
On Android, require fingerprint or face unlock to open the app, so a borrowed or lost phone doesn’t hand over your library.
Delete your account in-app
Remove your account and its data from inside the app. No support ticket, no waiting on us to get around to it.
Encrypted in transit
Data moving between the app and our backend travels over TLS. Your saved SMTP password is encrypted on-device and never leaves it.
Export before you delete
Take everything with you, Word or Markdown on any device, plus PDF and SRT on Android, before removing anything. Your data is never held hostage.
Subprocessors, named by role.
We publish who is in the loop and what they do, because hiding it is how a privacy brand loses trust. None of them use your data to train models.
| Subprocessor role | What it does | Data involved & training |
|---|---|---|
| AI model & transcription provider | Converts your audio to text and powers summaries, Critique, Ask Recard, and Voice. | Audio and transcript processed transiently to produce your results. Not used for training; processing memory cleared after. |
| Cloud hosting & sync | Runs authentication and, in Standard mode, stores and syncs your library across devices. | Account identity and synced results. Not used for AI training. |
| Transactional email | Delivers account and system emails, such as sign-in and verification messages. | Your email address, for that message only. Not used for AI training. Summary emails you send use your own SMTP server, not this provider. |
| Subscription billing (Stripe / app store) | Processes subscriptions and manages your plan. | Purchase and subscription status only. Handled by the store, not by us. |
| Ultra Privacy (mobile) | Temporary Firebase and Google Cloud Vertex AI processing, plus optional transient Ask and Voice requests. | The complete result returns to the phone, then Recard deletes and verifies deletion of its cloud recording content. If the separate Ask and Voice switch is enabled, bounded private context is used in memory without cloud-library storage or indexing. Provider service/security processing remains governed by Google Cloud terms. |
Roles are described generically here; when a subprocessor changes, we intend to publish it in a changelog (see the roadmap below).
An honest roadmap beats an empty badge row.
We would rather tell you exactly what we hold than decorate the page with logos we haven’t earned.
Recard does not currently hold SOC 2, ISO 27001, or HIPAA attestations, and we won’t display badges we haven’t earned. We handle data in line with GDPR principles and support real, in-app account deletion today. When an attestation is genuinely in place, it will appear here with its report, not before.
What we hold today
On the roadmap
No dates promised. As of 2026 these are goals, not commitments, verify the current status here before relying on it.
No bot means no uninvited recording, but the call is yours to make.
Because Recard never sends a bot to announce itself into a meeting, it can’t record a room it wasn’t brought into. That removes an entire class of consent problems the bot-based tools created for themselves.
It also means you decide when to record. Some places, California, Illinois, Florida, and the EU among them, require everyone’s consent to record a conversation, and call-recording rules are stricter still. Know the law where you are, and tell people when you’re recording. It’s the right thing to do, and it keeps you protected.
Privacy you can verify.
Ultra Privacy provides the normal transcript and analysis through transient Vertex AI processing, then keeps the durable content only on the phone after verified Recard-cloud deletion.