Privacy Policy

Unidesk is a desktop app (macOS and Windows) and a website (unidesk.app). Unidesk is based in Bengaluru, India, and is referred to in this policy as "we" or "us". This Privacy Policy explains how we handle data. It is written under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules. For buyers in the United States, it also explains how Paddle handles payment information and how US residents can make privacy requests (see sections 3 and 9).

The short version

• Recordings, transcripts, notes, tasks, whiteboards and time entries live on your computer. Delete the data folder and Unidesk has no copy.
• You choose where transcription and summaries run: on your device or in the cloud. On-device processing never uploads anything.
• Cloud transcription and summaries send audio or transcript text through our cloud service to model providers, only when you use those cloud features. Unidesk does not store that audio or text on its servers, and we do not use it to train AI models.
• Dictation always runs on your device. On-device transcription and summaries also run on your device. Nothing is uploaded.
• Your notes, tasks, whiteboards, time entries and dictation are never sent to any AI model provider and are never used to train AI models. Only meeting audio and transcripts go to AI model providers, and only when you use cloud transcription or cloud summaries.
• There is no cloud sync or cloud backup. Your meetings, notes and other content are never stored on our servers.
• Unidesk stores only account and usage records: your email address, plan and subscription status, cloud hours used and summary counts. Payments for orders placed in the United States are handled by Paddle.com, and other payments are handled by Razorpay. Unidesk never sees or stores your full card or UPI details.
• We do not send window titles, meeting participant lists or invitations to any cloud service. The desktop app has no analytics. The website uses Google Analytics only if you accept cookies. We do not sell your data.
• You can access, correct or delete your data at any time. For account data, email us; we delete within 30 days.

1. Scope

This policy covers the Unidesk desktop application (for macOS 13+ and Windows 10+), the website unidesk.app, and the services those products rely on. It does not cover third-party meeting platforms (Zoom, Microsoft Teams, Google Meet, etc.) whose terms and privacy policies govern their use.

2. Data that stays on your computer

When you use Unidesk, the following data is stored in a local database and as local files on your computer:

• Recordings (audio files)
• Transcripts (text)
• Summaries (text and metadata)
• Notes (text, images, embedded content)
• Tasks and due dates
• Whiteboards and sketches
• Time entries and time tracking data

This data remains in your control at all times. If you delete the app's data folder, all of this data is gone. Unidesk does not keep a copy.

3. Data that leaves your computer, and why

The following table shows what data we send where:

Transcription (Pro and Max)

When you use cloud transcription, your audio is split into short chunks on your device and sent over an encrypted connection to our cloud service, which passes them to a speech-to-text provider listed in section 5. If that provider is unavailable, the service may use another provider from the same list. The transcript is sent back to your app. Unidesk does not store the audio.

Cloud summaries (Pro and Max)

Free summaries are written on your device by a local model. With cloud summaries, only the transcript text (not the audio) is sent through our cloud service to an AI model provider listed in section 5. Which provider is used depends on your plan and on availability. The summary is returned to your app. Unidesk does not store the transcript or summary on its servers.

How model providers handle your data

Requests sent through OpenRouter are set to use only providers that do not keep your data (zero data retention), and to deny data collection. For providers reached in other ways, their own retention and logging terms apply, and we do not control them. We choose providers that do not train on the data we send: OpenRouter requests go only to providers that keep no data and deny data collection, Cloudflare (which runs Deepgram for us) does not use Workers AI content to train AI models, and Groq does not retain inference data by default. The models and providers we use may change at any time without notice; we update the list in section 5 when they change.

Google user data. Unidesk's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to any AI model provider, and we do not use it to develop, improve or train generalized AI or machine learning models.

Payments

Orders placed by customers in the United States are sold through Paddle.com Market Ltd and its affiliates ("Paddle"), which is the Merchant of Record for those orders. When you check out, you give your payment and billing details to Paddle. Paddle acts as an independent controller of those details under its own privacy notice, which is available at paddle.com/legal/privacy. Unidesk receives from Paddle the information it needs to provide and support your subscription, such as your email address, plan and subscription status. We do not receive your full card details.

All other orders are processed by Razorpay, and Unidesk is the seller. When you check out, you give your payment details to Razorpay. Unidesk receives the result of the payment and the subscription status, and keeps those records. Unidesk never sees or stores your full card or UPI details.

On-device processing

In Settings, you choose whether transcription and summaries run on your device or in the cloud. Dictation always runs on your device. When a feature is set to on-device, your audio and transcript are processed by local models on your computer and are never sent to Unidesk or to any provider. If the local model has not been downloaded yet, Unidesk asks you to download it; it never falls back to the cloud without your choice.

AI apps you connect (MCP)

In Unidesk 1.0.18 and later, you can let AI apps on your computer, such as Claude, Codex or Cursor, use your Unidesk data through MCP (Settings → MCP Settings). It is off until you turn it on, and each AI app must be allowed by you.

• Unidesk passes a connected app only the items it asks for, over a private connection on your computer. This traffic does not go through Unidesk servers.
• Full transcripts are shared only if you turn on Allow transcripts. It is off by default.
• Every change an AI app wants to make needs your approval, unless you turn on Always allow changes for that app. AI apps cannot delete anything in Unidesk.
• Once a connected app has read your data, that app and its AI provider handle it under their own terms and privacy policies, not ours. Connect only apps you trust.
• You can turn off an app, or turn on Pause all AI access, at any time.

No cloud sync

Unidesk does not sync or back up your meetings, notes, tasks or other content to any cloud service. Back up your computer to protect this data.

App updates

The app checks for updates when you open it and then weekly. The check sends your current app version and IP address to our download host, which is hosted on Amazon Web Services.

Local model download

When you first use Unidesk, the app downloads local models for on-device transcription, dictation and summaries. This download happens once. The model is cached on your computer; future launches do not re-fetch it unless you delete it.

4. Data we never collect

• Window titles, meeting invitations, or participant lists. On a Mac, Unidesk notices when a meeting app starts using your microphone or camera, so it can offer to record. We do not send the name of the app, the meeting title, the participant list or any other meeting metadata to any cloud service.
• Analytics or telemetry in the app. The Unidesk desktop app contains no analytics SDK. We do not track which features you use, how long you use them, or what you type.
• Advertising trackers on the website. unidesk.app uses no advertising cookies or marketing pixels. Analytics cookies are set only with your consent; see "Website analytics" below.
• Voiceprints and biometric identifiers. Unidesk does not create voiceprints or other biometric identifiers, and it does not identify speakers by their voice. The app does not label speakers in transcripts.
• Children's data. We do not collect personal information from anyone under 18; see section 11.
• Training data. We do not use your recordings, transcripts or summaries to train any AI model. Providers receive this data only to process your requests, under their own terms.
• Content of AI app requests. The MCP Activity log keeps the time, app, tool and result of the last 200 requests, on your computer only. It never stores the text of your meetings, notes or prompts, and it is not sent to us.
• Selling your data. We do not sell, trade or rent your personal information to any third party.

Website analytics (only with your consent)

If you click Accept on the cookie banner at unidesk.app, we load Google Analytics 4. It records the pages you visit, the referring site, your browser, device type and approximate location (derived from your IP address, which Google does not store). It sets the _ga and _ga_<ID> cookies, which last up to 2 years. Google signals and ad personalisation are off; we use the data only to understand which pages are useful.

If you click Reject or ignore the banner, Google Analytics is not loaded and no analytics cookies are set. You can change your choice at any time with Cookie settings in the website footer; withdrawing deletes the analytics cookies. Your choice is stored in your browser's local storage, not in a cookie, and is never sent to us.

The legal basis is your consent under section 6 of the DPDP Act. Google processes this data on our behalf under the Google Ads Data Processing Terms. Google's own use of the data it collects is described in Google's privacy policy.

Do Not Track and cross-site tracking

Do Not Track. Our website does not currently respond to browser "Do Not Track" signals. Instead, you control analytics on our website with the cookie banner described above, and you can withdraw consent at any time.

Cross-site tracking. The website does not use advertising cookies. Google Signals and ad personalisation are turned off in our Google Analytics setup, so our analytics data is not used for advertising. Google's own handling of analytics data is described in Google's privacy policy.

5. Sub-processors and third-party services

The following table shows where your data goes when you use the Unidesk service:

6. Legal basis for processing

We process your data with your consent under the DPDP Act 2023, for the service you have requested. We inform you at the point of data collection (this policy is always available in the app). You can withdraw consent and request deletion at any time.

7. Retention

Account data: Your email address, plan and subscription status, cloud hours used and summary counts are kept while your account is active. When you request account deletion, we delete account data within 30 days. Where the law requires us to keep payment or tax records, we keep only those records for as long as the law requires.

Local data: Recordings, transcripts, notes and other local data live on your computer until you delete them or uninstall the app. Unidesk does not retain copies.

Transcription and summary data: Audio and transcript text sent through our cloud service for transcription and cloud summaries are not stored on Unidesk's servers. Providers' retention policies apply to their copies, as described in section 3.

Payment and subscription records: Subscription IDs, payment amounts and dates, and subscription status are kept by Unidesk for as long as needed to run your subscription and meet accounting and legal obligations. Razorpay and Paddle keep their own records under their own terms and privacy notices.

Update checks: App version and IP address are sent to our download host. Standard hosting logs are kept under the host's terms.

Website analytics: Google Analytics event data is kept for 2 months, then deleted automatically. Cookies expire after up to 2 years or when you withdraw consent.

8. Security

• Encryption in transit: All data sent to our cloud service and to cloud providers is encrypted over HTTPS.
• Local data protection: Your local database and audio files are not encrypted by Unidesk. They are protected by the OS user account on your computer. A user who can access your account can access these files. Sign-in tokens are stored using your operating system's secure storage when it is available.
• Account records: Account records, including your email address, are stored in our database in readable form. Access to them is limited to our systems and the people who run them.
• Cloud processing: The cloud service processes audio and text in memory for your request. It does not write them to disk on our servers.
• AI app connections (MCP): AI apps reach Unidesk through a local socket (Mac) or named pipe (Windows), not a network port, and must present a secret token kept in a file that other user accounts on the computer cannot read. Requests are rate-limited per app, and meeting text is marked as untrusted data so AI apps are told not to follow instructions inside it.

To protect your data from physical or network threats, use full-disk encryption (macOS FileVault or Windows BitLocker). Unidesk does not encrypt your local database or audio files on disk; OS-level encryption is the recommended practice.

9. Your rights and how to exercise them

All users

• Export your data: You can export your notes, tasks and meeting transcripts or summaries from the Unidesk app at any time.
• Delete your local data: You can delete any recording, transcript, note or task from the app, or delete all app data by removing the app's data folder.

Your rights under the DPDP Act 2023

You have the right to:

• Access: Request a summary of the personal data we process about you and the activities for which we process it.
• Correction: Request that we correct inaccurate or incomplete personal data.
• Erasure: Request that we delete your account and personal data. We will delete within 30 days.
• Grievance redressal: File a grievance with us at support@unidesk.app.
• Nomination: Nominate another person to exercise your rights if you die or become unable to do so.
• Withdraw consent: Withdraw consent at any time, as described in section 6.

Rights for US residents

If you live in the United States, you can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Email support@unidesk.app from the address you sign in with and say which request you are making. We will acknowledge your request within 10 business days and respond within 30 days. We will delete account data within 30 days of a deletion request, unless the law requires us to keep it. We do not sell personal information.

For personal data that Paddle holds as an independent controller, contact Paddle as described in its privacy notice.

How to exercise your rights

Email support@unidesk.app with your request. Include your email address, the type of request (access, correction, erasure, nomination, grievance) and any details about your account. We will acknowledge your request within 10 business days and respond substantively within 30 days. We will delete account data within 30 days of an erasure request. Other requests typically receive a response within 15 days.

10. Recording other people

Unidesk records audio from your computer's speakers and microphone, on your computer only. It never joins a call as a bot, and it does not tell anyone that you are recording. When you record a meeting, you are responsible for telling everyone on the call and getting their agreement first, and for following the law that applies to you and to them. Some US states, and some other places, require every person on a call to agree before the call is recorded.

The full consent rules are in section 3 of our Terms of Use.

Unidesk is not a party to your compliance obligations. If you record a call in violation of applicable law, Unidesk is not liable for the recording, the use of the recording or any consequences that result.

11. Children

Unidesk is for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a minor, we will delete it promptly. If you believe we have collected information from a child, please contact support@unidesk.app.

12. International data transfers

Unidesk is based in India. Account sign-in runs on Amazon Web Services in India. Our cloud service runs on Cloudflare's global network. When you use cloud features, your audio or transcript text is sent to model providers and other services in the United States and other countries (see section 5). Payments for orders placed in the United States are handled by Paddle.com, and other payments are handled by Razorpay. On-device features do not transfer data.

Some providers (Cloudflare, OpenRouter, model providers, AWS, Razorpay, Paddle) may process your data outside India, as permitted under the DPDP Act 2023.

13. Changes to this policy

We may update this policy at any time. If we make a material change to how we use your data, we will notify you by email (if you have provided an email address) or by displaying a prominent notice on the Unidesk app or website before the change takes effect.

Your continued use of Unidesk after a policy change constitutes your acceptance of the updated terms. If you do not agree with a material change, you may request deletion of your account within 30 days of the update.

14. Contact

Questions or concerns about privacy? Email us at support@unidesk.app.

For DPDP Act inquiries or grievances, write to the same address. For personal data that Paddle holds, use Paddle's privacy notice.