Privacy Policy

Last updated: October 14, 2026 · Original policy: June 13, 2026

Becki is a privacy-conscious professional memory platform. This Privacy Policy explains what we collect, how we use it, and the controls you have. Local storage and local processing are different. Astir can keep recordings and meeting records on your device, but configured cloud transcription sends audio to the selected provider. Transcript text, summaries, notes and other selected context can also be sent for AI processing or saved as shared memory. Your structured cross-tool memory (decisions, commitments, dead-ends, open-loops) and its retrieval index sync to our servers, scoped to your account and encrypted in transit and at rest, so the AI tools you authorize can reach it.

1. Who we are

Becki is operated by BECKI.IO LLC. Contact: support@becki.io. Privacy inquiries: support@becki.io. Website: www.becki.io.

2. Plain-language summary

• Local transcription processes audio on your device. Configured cloud transcription sends audio to the selected provider under that provider's terms. Recording a meeting does not establish that every processing step is local.
• Local meeting records can include transcripts, summaries, notes and speaker labels. Selected content can leave your device for AI processing, connected tools or memory ingestion.
• Participants' information may appear in audio, transcripts, selected context or extracted memory. Obtain the required consent before recording or sharing it. Identity controls apply to the paths and accounts where they are enabled; they are not universal anonymization.
• We do not sell your data, run advertising on it, or share it with advertisers.
• We do not read your data as humans for any purpose other than providing or supporting the service. Your synced data is scoped to your account.
• We do store extracted structured memory (decisions, commitments, dead-ends, open-loops, project list) in our cloud database so Becki can sync across your devices and make context available to AI tools you authorize.
• Becki-managed AI processing can send text for extraction, query processing, decision reasoning and synthesis. See Subprocessors for service providers and data received. Provider retention is separate from Becki's storage and is governed by applicable service terms.
• We do collect minimal diagnostics needed to run the product (crash reports if you opt in, aggregate usage counts).

3. Data we collect and where it lives

3.1 Account data

When you create a Becki account we collect your email address, an optional display name, and assign a unique user identifier. We do not require a phone number. Authentication is provided by Supabase (see Subprocessors). Payments for paid plans are processed by Paddle.com, our reseller and Merchant of Record (see Subprocessors). Paddle handles checkout, billing, and sales tax on our behalf. Becki receives only a customer identifier and your subscription status, never your full card number.

3.2 Meeting audio

Audio is captured on your device using the recording sources and permissions you enable. Local transcription processes that audio on your device; cloud transcription sends it to the provider you configure. The selected provider's terms and your account settings govern its processing and retention. Local recording retention depends on your software and configuration. Deleting a local recording does not by itself delete a copy held by a provider.

3.3 Verbatim transcripts

Meeting transcripts and associated timing or speaker labels can be stored locally. Text used for extraction, summarization or another AI task can be sent to a provider or Becki-managed processing service. Text saved as vault memory syncs as described in Section 3.6. Local storage is not a promise that a transcript is never transmitted or that a provider immediately deletes it after processing.

3.4 Meeting summaries and your notes

Meeting summaries and notes can be kept locally. Content you submit to an AI task, a connected tool or memory ingestion can be transmitted for processing or stored in your synced vault. A locally saved copy and an externally processed copy can exist at the same time.

3.5 Other participants' information

Names, contact information and speaker labels may be present in recordings, transcripts, context you submit or extracted memory. Do not assume these identities are automatically removed from every AI request. Where enabled, identity-tokenization controls apply to specific memory-ingestion paths. You remain responsible for participant consent and for the information you authorize tools and providers to receive.

3.6 Structured memory and the NeuraVault (synced)

Becki extracts structured items, decisions, dead-ends, commitments, open-loops, and notes, from your meetings, commits, and AI conversations. These structured items, together with their text content, are stored locally AND synced to our cloud database. We do this because the entire purpose of Becki is to make this structured memory available to AI tools you use across multiple devices and contexts; if it stayed local-only, there would be no cross-tool memory.

The synced data includes:

• Vault entries (table: vault_embeddings), the text of each decision, dead-end, commitment, etc., plus a vector embedding for retrieval.
• Commitments (table: commitments), extracted action items with owner, recipient, deadline.
• Daily briefings (table: daily_briefings), server-precomputed briefings drawing from the above.
• Meeting metadata (table: meetings), title, start time, end time, calendar event id only. Summary and notes columns are explicitly null on push.
• Project list (table: projects), name, path, and metadata for projects you've added so a cross-device project picker works.

All synced data is row-level-security-scoped to your account: no other user can read your records via the API. Becki personnel may have administrative access to the database for support and infrastructure operation; we do not access your records except as needed to provide or support the service or as required by law.

3.7 Integrations and third-party services

Becki connects to additional services that power specific features. Optional integrations only activate when you explicitly configure them.

• Calendar (optional), access to calendars configured on your device, subject to the permissions and tools you authorize. Event details can be included in context for selected tasks. Calendar access does not authorize meeting recording.
• Source-control integrations (optional), access to repositories and work you authorize for memory ingestion. Separately configured agent tools, terminal commands and repository actions have their own permissions; memory setup does not automatically authorize them.
• Embedding (local and server-side). Embeddings support retrieval of vault content and search queries. Where a supported local model is available, that embedding step can run on your device. Server-side processing and fallback requests can send vault-entry or search-query text to Becki-managed infrastructure. Local embedding does not make every other memory operation local. See Subprocessors for hosting and processing disclosures.
• AI processing. Becki-managed processing and providers you connect are separate routes:
  • Becki-managed. Service-side features and fallbacks can process text using providers engaged by Becki, subject to feature and usage limits. The current Subprocessors page identifies those providers and the data involved.
  • Providers you configure. Astir can use local models, private endpoints, API credentials or supported provider accounts you connect. Processing, training settings, retention and charges depend on the selected feature, provider's terms and your account settings. Connecting your own provider does not disable every Becki-managed memory path.
• Connected AI tools. A tool that retrieves your vault context can send that context to its configured model provider. Its provider relationship and account terms are separate from Becki-managed processing. A locally launched tool does not necessarily perform local inference.
• Cross-tool memory (MCP), AI tools you install on your machine (Claude Code, Cursor, etc.) read from your synced vault via the Becki MCP server. Each tool authenticates as you and respects the same row-level scoping. You control which tools are connected.
• Authentication and cloud storage, Supabase authenticates your account and stores your synced vault content, scoped to your user id.

A current list of all subprocessors is published at www.becki.io/subprocessors.

3.8 Diagnostics and logs

Application logs are written locally on your Mac to help you debug issues. If you opt in to crash reporting, crash traces are sent to us without user-identifying payload. We do not embed third-party analytics SDKs or tracking pixels in the application.

4. Where your data lives, summarized

5. How we use your data

• To run the Becki product, capture work, extract structured memory, retrieve context on demand, deliver briefings.
• To authenticate you across devices and scope your data to your account.
• To make your structured memory available to AI tools you explicitly install and authorize.
• To keep the service reliable, crash reports, latency metrics, incident response.
• To send service emails (account verification, approval notifications, incident notices). We do not send marketing email unless you opt in.

6. Lawful basis for processing (GDPR)

For users in the European Economic Area, United Kingdom, or Switzerland, we rely on the following lawful bases under Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)), to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)), to run the service securely, prevent abuse, debug failures, and improve product quality. We balance these interests against your privacy rights.
• Consent (Art. 6(1)(a)), for optional integrations (calendar, source control), crash reporting, and any future marketing communications. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)), to comply with valid legal process.

7. Data sharing and disclosure

We share data only with:

• Subprocessors, third parties that power Becki's infrastructure, each acting as a data processor on Becki's behalf under their own data-processing terms. Current list: www.becki.io/subprocessors.
• Law enforcement or other authorities, only when compelled by valid legal process and only to the extent required.
• A successor entity, in the event of a corporate merger, acquisition, or asset sale, with prior user notice.

We do not sell personal data within the meaning of the California Consumer Privacy Act (CCPA) or comparable laws. We do not run third-party advertising or tracking pixels on the product or this site.

8. Data retention

• Local files (transcripts, summaries, notes), retained on your device until you delete them. We have no remote control over local data.
• Cloud-synced vault content, retained while your account is active. Deleted within 30 days of an account-deletion request.
• Meeting audio, local file retention depends on your software and configuration. Configured cloud transcription has separate provider retention terms; deleting a local file does not delete provider-held data.
• Diagnostic logs (server-side), retained for 90 days.
• Email send log, retained for 13 months for delivery troubleshooting and unsubscribe handling.

9. International data transfers

Becki's primary cloud infrastructure is operated from data centers in the United States. Some subprocessors may operate from additional regions. By using Becki, you consent to the transfer of your synced data to those regions for the purposes described in this policy. Where required by law (including EU/UK/Swiss data subjects), transfers are governed by Standard Contractual Clauses or equivalent safeguards executed with each subprocessor.

10. Your rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated cloud data.
• Export your data, your local data is already a set of files you own; cloud data is exportable via request.
• Object to or restrict specific processing.
• Withdraw consent for optional integrations and processing at any time.
• Lodge a complaint with a supervisory authority (e.g. your local Data Protection Authority).
• For California residents (CCPA/CPRA): rights to know, delete, correct, opt out of sale or sharing (we do not sell or share for cross-context behavioral advertising), and limit use of sensitive personal information. We do not discriminate against users for exercising these rights.

To exercise these rights, email support@becki.io. We respond within 30 days (or as required by your jurisdiction).

11. Security

• Local processing is available for supported features. Cloud transcription and other selected AI processing can transmit audio or text outside your device.
• All network traffic uses TLS 1.2 or higher.
• Synced cloud data is encrypted at rest using AES-256 disk-level encryption provided by our infrastructure (see Subprocessors).
• Synced data is row-level-security-scoped at the database layer, no Becki user can read another Becki user's records via the API.
• Third-party access tokens you provide (for optional integrations) are stored in your system Keychain where supported.
• Becki personnel with administrative access to infrastructure do not access user records except as needed to provide or support the service or as required by law.

Becki is not a zero-knowledge service. Synced data is encrypted in transit and at rest, but it is not encrypted with a key only you hold; administrative access can permit access to synced content as described above. Queue encryption and conditional identity controls do not establish universal end-to-end encryption or prevent all downstream AI processing.

No system is perfectly secure. If we learn of a breach affecting your data, we will notify you without undue delay and as required by applicable law.

12. Recording consent and third-party participants

Becki captures meeting audio for transcription. Recording laws vary by jurisdiction, many U.S. states and several countries require all-party consent before recording a conversation. You are responsible for obtaining the legally required consent from every participant in any meeting you record using Becki. Becki does not announce that recording is in progress; doing so is your responsibility. See our Acceptable Use Policy for more.

Participants' information may be included in audio or text sent to a configured provider or saved as memory. Obtain any required consent for that processing as well as for recording. Review the chosen transcription mode and tools before sharing sensitive meeting content.

13. Children

Becki is intended for working professionals and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact support@becki.io and we will delete it.

14. Changes to this policy

If we change this Privacy Policy materially, we will update the "Last updated" date above and notify you via the app or email before the change takes effect. Non-material changes (typos, contact info updates, clarifications) will be reflected in the updated date alone.

15. Contact

Privacy questions: support@becki.io. General support: support@becki.io.

Becki has not appointed an EU/UK representative under Article 27 of the GDPR. EU/UK users with data-protection questions can reach us directly at support@becki.io.