Privacy Policy

Last updated: 2026-09-29

Cadenza is a local-first Mac app with an optional hosted Web Sync service in private beta. This policy separates what happens on your Mac, on the public cadenzapp.com marketing site, and in Web Sync.

The short version: the Mac app keeps recordings on your Mac unless you enable Web Sync. Web Sync is optional, uses Cadenza-operated infrastructure, and its browser app is available to approved private-beta accounts at cadenzapp.com/app.

1. Public website and access logs

The web server for cadenzapp.com writes access logs containing:

• Your IP address, masked to a /24 block for IPv4 or /48 block for IPv6 before it is written to disk.
• Your user agent string.
• The URL path and query string you requested.
• The timestamp of the request.

Referer, Authorization, and Cookie headers are removed from the log format. Logs are retained for 30 days, then deleted by log rotation. The public marketing pages do not use analytics, advertising trackers, or a tag manager.

2. Data on your Mac

Audio recordings, transcripts, and summaries are stored locally on your Mac unless you explicitly enable Web Sync. Cadenza does not collect product analytics or send automatic crash reports.

The Mac app may send data directly to a provider when you choose a cloud-powered feature. For example, cloud transcription may send audio to the selected transcription provider, and summarisation may send transcript text to the selected AI provider. Local Whisper keeps transcription on the Mac. Provider credentials configured in the Mac app are stored in the macOS Keychain.

The Mac app also integrates directly with services such as Apple Calendar, Google Calendar, Notion, Craft, and Zoom when you enable the relevant feature. Those providers process data under their own privacy terms.

3. Optional Web account and Web Sync

The private Web beta uses Google sign-in and is available to approved beta accounts at cadenzapp.com/app. Cadenza receives the identity information needed to create and display your Web account, such as your Google account identifier, email address, display name, and profile image. After sign-in, the Web service uses a secure HttpOnly session cookie to keep you signed in.

When you explicitly enable Web Sync in the Mac app, Cadenza-operated infrastructure receives the recording data selected for sync:

• Uploaded audio is retained for 14 days after the upload is committed, then removed by the retention process.
• Recording metadata, transcripts, and summaries are retained until you request deletion or a future retention setting changes that policy.
• Server-held recording data is encrypted at rest. It is not end-to-end encrypted, so the service can process and return it for authorised Web features.

Web features may call third-party services through Cadenza servers when the feature requires a server-side integration. For example, Google OAuth is handled through the Web backend for account access, and private-beta Notion features may use server-side OAuth and proxy endpoints. The Mac app’s separately configured provider integrations continue to operate directly from the Mac unless their interface says otherwise.

Optional AI Access (MCP) on the Web is a separate, token-gated read path. A dedicated bearer token can list and read transcripts and summaries that are still stored after a Web Sync. Turning Web Sync off does not delete that cloud history. Disabling sync, signing out, or deleting a local recording does not imply immediate remote erasure. Revoke the token from the Web Settings → Integrations page. The Mac loopback MCP is unchanged and is not reachable from a remote host.

Three additional switches live on that same Integrations page and default to off. They are stored on the server; a remote MCP token cannot turn them on.

• Search index. When you enable it, Cadenza decrypts newly synced or reprocessed meetings and writes a plaintext full-text index (transcript lines, summary overview, decisions, and action items) so a remote agent can search them. Existing meetings are not indexed until you start the visible “Index existing meetings” job. The index is not end-to-end encrypted. Turning the switch off deletes that user’s index in the same transaction. Server logs do not record search queries, titles, or snippets.
• Speaker identity. When you enable it, your devices may upload the speaker profiles you created (name, aliases, notes, team) and speaker-to-profile mappings, so your other devices and agents can resolve a stable person. Profiles are sealed at rest with a key bound to your account. Turning it off deletes those profiles and mappings, and any voice profiles, in the same transaction. Person context is read from the search index, so identity without search still cannot answer meeting questions.
• Voice profiles. Available only while Speaker identity is on. When you enable it, a device whose own speaker memory setting is also on may upload voice samples: numeric voiceprints that its on-device speaker recognition model computed from meetings where you named a speaker. Voiceprints are biometric data. They are sealed at rest with a key bound to your account and are returned only to your own signed-in sessions; a remote MCP token cannot read them. The server does not compare, analyze, or otherwise use them. Turning the switch off, or turning Speaker identity off, deletes them in the same transaction.

4. Cookies and tracking

The public marketing site does not set analytics or advertising cookies. The private Web service uses the session cookie described above for authentication. Cadenza does not use that cookie for cross-site tracking or advertising.

5. Data deletion and account requests

• Delete local recordings: use Cadenza’s Move to Trash action or remove the relevant files from the app’s container on your Mac.
• Delete Web Sync data or the Web account: until self-service deletion is implemented, email hello@cadenzapp.com from the address associated with the account. After identity verification, the request will be handled manually.
• Disconnect an integration: disconnect it in Cadenza Settings, then revoke Cadenza in the provider’s own account settings if you also want to invalidate the provider token.
• Delete the Mac app: drag Cadenza to the Trash. You can also remove its container if you want to delete remaining local data.

6. Security and service status

Cadenza uses transport encryption for network traffic and encryption at rest for server-held recording data. No system can guarantee absolute security. The Web service is a private beta and may be interrupted while reliability, backup, deletion, and export controls are completed.

7. Future changes

This policy will be updated with a new date when data handling or beta-access terms change materially.

8. Contact

Questions, privacy requests, or deletion requests: hello@cadenzapp.com.