Privacy Notice

Last updated August 23, 2026

This notice explains what personal data Debrief collects when you use our service, why, who we share it with, and how you can exercise your rights over it. It applies to your account data and how we handle it — it's separate from our Recording Consent & Responsible Use terms, which cover your responsibility to get consent from people you record.

Who we are

Debrief is operated by GrokIT Solutions, a proprietorship based in Pune, India. For anything in this notice, contact us at privacy@grokitsolutions.in.

What we collect

We collect only what the service needs to function:

• Account data — your name, email address, and password (stored as a salted hash, never in plain text).
• Encryption metadata — cryptographic salts and wrapped encryption keys used to protect your content. These aren't readable without your password or recovery phrase, and we can't use them to access your data ourselves.
• Meeting content — audio, transcripts, and AI-generated summaries from meetings you record or upload. See "How we handle meeting content" below — this is the most sensitive category and we treat it differently from the rest.
• Meeting metadata — title, duration, language, and timestamps for each meeting, used to power your dashboard.
• Billing data — your subscription plan, billing cycle, and payment status. Card details are handled directly by our payment processor — we never see or store them.
• Biometric login data — if you enable biometric sign-in, we store a public key and device identifier used to verify your fingerprint/face unlock. The biometric data itself (your fingerprint, your face) never leaves your device — we only ever see a cryptographic credential your device generates, not the biometric itself.
• Usage and log data — standard technical logs (IP address, timestamps, error logs) generated by using the service, used for security, debugging, and abuse prevention.

How we handle meeting content

Debrief uses zero-knowledge storage encryption: your transcripts, summaries, and audio are encrypted on your device before they're ever sent to us, using a key derived from your password. We store only the encrypted version — we cannot read it, and neither can anyone who gains access to our database.

One important distinction: to produce a transcript and summary in the first place, your meeting audio and the resulting text are briefly processed in unencrypted form by our transcription and AI providers before the result is encrypted and stored. This is necessary for the service to work — it is not something we can do without your content passing through those providers. We do not retain a plaintext copy ourselves once processing is complete, but you should understand that "zero-knowledge" describes how we store your data, not that no system ever sees it unencrypted during processing.

Why we process your data

• To provide the core service — recording, transcription, summarization, and search over your own meetings.
• To operate your account — authentication, billing, customer support, and service communications.
• To maintain security — detecting abuse, fraud, and unauthorized access.
• To improve the service — aggregated, non-identifying usage patterns only. We do not use your meeting content to train AI models.

Who we share it with

We share the minimum necessary data with these categories of service providers, each acting on our instructions:

• Transcription: a speech-to-text provider that processes your audio to produce a text transcript.
• AI summarization: an AI provider that processes your transcript text to generate summaries and answer questions about your meetings.
• Payments: a payment processor that handles billing and subscription payments.
• Email delivery: an email provider that sends account, billing, and recovery-code emails.
• Infrastructure: our hosting, database, and encrypted file storage providers, who store your (encrypted) data but have no route to read it.

We do not sell your personal data, and we do not share meeting content with anyone beyond what's needed to run the service. Each provider above is contractually bound to use your data only to perform the specific service we hire them for, and to protect it with security measures equivalent to our own — none of them may use your content for their own purposes, including training their own models.

Where your data is processed

Some of the providers above — our AI summarization and email delivery providers — process data outside India, including in the United States. Where this happens, it's limited to what's described above (summarization processing and email delivery) and is necessary to provide the service.

How long we keep it

We retain your account and meeting data for as long as your account is active. If you delete your account, we erase your account data and meeting content, including stored audio, within 30 days, except where we're required to retain specific records for longer (for example, billing records for tax/accounting law).

Your rights

Under India's Digital Personal Data Protection Act, you can:

• Access — ask what personal data we hold about you.
• Correct — ask us to fix inaccurate or incomplete data (you can already update your name directly in your Profile settings).
• Erase — delete your account and data yourself anytime from Profile → Danger zone, or email us to request it.
• Withdraw consent — withdraw consent for processing at any time; this may mean we can no longer provide the service to you.
• Nominate — name another person to exercise these rights on your behalf if you die or become incapacitated.

To exercise any of these, email privacy@grokitsolutions.in. We'll respond within 15 business days.

Security

Meeting content is encrypted on your device before it reaches us, using industry-standard encryption (AES-256-GCM, with keys derived via PBKDF2). We maintain access controls, authentication safeguards, and monitoring designed to protect your account and data. No system is perfectly secure, and we continuously work to identify and fix issues as we find them.

If something goes wrong

If we become aware of a personal data breach affecting you, we'll notify you and the Data Protection Board of India as required by law.

Children

Debrief is not directed at, and is not intended for use by, anyone under 18. We don't knowingly collect personal data from children.

Grievance Officer

Gunjan Tiwari, reachable at privacy@grokitsolutions.in, is our designated contact for privacy complaints and grievances under the DPDP Act. If you're not satisfied with our response, you can complain to the Data Protection Board of India.

Changes to this notice

If we make material changes to how we handle your data, we'll notify existing users (by email or in-app notice) rather than relying solely on an updated date on this page.