Privacy policy

Who we are

Gorowame is a meeting recorder: it records conversations, transcribes them, and produces summaries, decisions and action items. It is operated by Gorowame, of MSU Housing, Marawi City, Lanao del Sur, Philippines 9700.

For anything in this policy, contact privacy@gorowame.com.

Two kinds of information, and why it matters to you

Your account — your name, email address and how you use the service. We decide how that is handled.

Meeting content — the audio you record and everything derived from it. That belongs to the company whose workspace it sits in. We hold it on their instructions, not our own.

If you were recorded in somebody else’s meeting and want it removed, ask them, not us. We cannot act on another company’s content without their instruction.

What we collect

From you: your name and email address, your password (stored only as a scrypt hash, so we cannot read it), your workspaces and who is in them, and the audio you record — only ever when somebody presses record.

From your recordings, we generate: transcripts with timestamps, summaries, key topics, decisions, and action items. An action item is given an owner or a due date only when the meeting actually stated one — neither is ever guessed.

Automatically: your sign-in session (stored as a hash), the browser or app you used, rate-limiting records, and server logs. Our logs never contain passwords, keys, audio, or transcript content.

How we use your email address

Two different kinds of message, and you can stop one of them.

• Account messages — verifying your address, resetting your password, workspace invitations, and notices about your subscription or this policy. These are part of the service and cannot be turned off while you have an account.
• Product email — occasional messages about new features, tips for getting more out of Gorowame, and changes to plans or pricing. Every one has an unsubscribe link, and unsubscribing stops them for good without affecting your account.

We do not send email on anyone else’s behalf, and we never sell, rent or share your email address with advertisers. Your address is used by us, for Gorowame, and nothing else.

You can unsubscribe from product email at any time using the link in any such message, or by writing to privacy@gorowame.com.

What we do not collect

• No analytics, tracking pixels, advertising identifiers or third-party scripts of any kind. The application ships none.
• No cookies except the one that signs you in. There is no cookie banner because there is nothing to consent to.
• Your calendar events are never stored. If you connect a calendar, events are fetched to show you and then discarded. Only the connection itself is kept, and its tokens are encrypted.

Recording other people is your responsibility

Gorowame shows a notice before every recording, but the legal obligation to obtain consent is yours. The rules differ by country and by US state, and some require everyone present to agree rather than just one person. We do not verify that consent was obtained, and we cannot.

Who else processes your data

We use Vercel to run the application (Frankfurt), Supabase for the database (Frankfurt), Cloudflare R2 for audio (Western Europe), Groq for transcription, OpenAI for summaries, search and as the transcription fallback when Groq is unavailable, Google for calendar access if you connect it (read-only), Creem for payments, and an email provider for account messages.

Read this one twice. Your meeting audio is sent to Groq to be transcribed — and to OpenAI instead if Groq is unavailable — and your transcript text is sent to OpenAI to produce summaries and search. If a conversation is too sensitive to leave your company, do not record it in Gorowame.

Storage and processing are in the EU by deliberate choice. Some providers above are US companies and may process data outside the EU.

How long we keep it

Each company sets its own retention period in workspace settings — any number of days from 1 to 3,650, or forever, which is the default. When a meeting passes that age it is deleted completely, audio included, and we keep no copy. If you use the desktop app, it keeps a short-lived offline copy of your meeting titles and dates — never audio or transcripts — so the app is not blank with no internet connection; that copy is cleared when you sign out of the desktop app, and never lives longer than 30 days on its own.

A deleted workspace can be restored for 30 days, then it is erased permanently. A deleted account is removed immediately: the email address is replaced, the name, avatar and password hash are erased, and every session is revoked. That cannot be undone.

Sharing a meeting

A share link is read-only, revocable, and expires by default. It carries less than the meeting page does — no audio and no email addresses. Only the link’s hash is stored, so a lost link can be replaced but never recovered. Anyone holding the link can read what it points to until it is revoked, so treat it as public.

Your rights

You can see your data, export any meeting as Markdown, correct your name or email in settings, and delete your account from the app on both web and mobile — no email required, effective immediately.

Depending on where you live you may also object to or restrict processing, ask for your data in a portable form, and complain to your data protection authority. If your content sits in someone else’s workspace, direct the request to them.

Security

Passwords are hashed with scrypt and never stored or logged in the clear. Sessions are stored as hashes. Calendar tokens are encrypted at rest with AES-256-GCM. Audio is served through short-lived signed links, not public URLs. Every request is checked against your workspace membership on the server, and all traffic is HTTPS-only.

What we do not claim: we hold no SOC 2, ISO 27001 or HIPAA certification, and Gorowame is not suitable for regulated health, legal or financial recordings without your own assessment.

Children

Gorowame is for workplace use and is not directed at children. We do not knowingly collect their data.

Changes and complaints

If we change this policy materially we will say so in the app before it takes effect. You may complain to the National Privacy Commission of the Philippines or to your own data protection authority.