Privacy isn't a policy page. It's the architecture.
Most notetakers promise to look after your conversations on their servers. Lalela is built so your conversations don't need looking after: they stay on your machine. This page says exactly what that means — including the edges.
No meeting bots
Nothing joins your calls. Lalela records your mic and your computer's own audio output, the same sound you already hear.
On-device transcription
Whisper runs on your own Mac, PC, iPhone or iPad. In the default mode, meeting audio never touches a network.
Audio is discarded
After transcription the audio is gone. What's kept is text — readable, editable, deletable by you.
Voiceprints stay local
Speaker recognition is opt-in and biometric data never leaves the device. Not to our cloud, not to anyone's.
Files you own
Notes are Markdown in a folder you pick. No export ransom — your notes are already exported, permanently.
No training on your data
We never use your transcripts to train anything. The free-tier proxy forwards only the text needed for your request and stores none of it.
Verify it in the source code
The claims above are checkable. The on-device part of Lalela (recording, Whisper transcription, speaker separation and voiceprints, local AI and Markdown storage) is open source as Lalela Community, under Apache-2.0, at github.com/OzRazak/lalela-community. The web app and our cloud services are not open source. More about the open-source edition.
Exactly what leaves your device — and when
"Local-first" claims deserve specifics. This is the complete list.
| Data | Leaves the device? | Details |
|---|---|---|
| Meeting audio | Never — with one exception you choose | Transcribed on your device and discarded. Exceptions: if you explicitly pick cloud transcription in Settings (off by default on every platform), or record in the web app in your browser, the audio is uploaded to private storage, transcribed by AssemblyAI, then deleted from storage immediately. |
| Transcripts & notes | Only if you sign in and sync | Saved as Markdown + a local database on your device. Signing in syncs meetings to your private Supabase workspace (row-level security, only you and people you share with) so your other devices and the web app can see them. |
| Voiceprints (speaker recognition) | Never | Opt-in, computed on-device, stored only in the local database. They are biometric data, so they are never synced, shared or uploaded — full stop. |
| Transcript text sent to AI | Only when you ask for AI, and only in the mode you chose | On-device model (local or Apple Intelligence): nothing leaves your device. Free allowance: the text for that request is proxied through our server to OpenRouter and on to the provider of the model you picked (such as Anthropic, OpenAI or Google), then discarded — used for your answer, not for training. Your own key: goes directly from the app to OpenRouter under your agreement with them. In the iPhone, iPad and Microsoft Store apps, Lalela asks your permission once before any text goes to a cloud AI provider (the Mac app and the direct Windows download do the same from version 1.3.11); you can withdraw it any time in Settings → Recording → Privacy & consent. |
| Screenshots of shared content | Never (stored locally) | Mac only. Captured only when you click Capture (or enable the change-triggered option), saved next to the meeting's Markdown files. |
| Account email & plan | If you create an account | Stored in Supabase auth; used for sign-in, sharing and metering your free AI allowance. |
| Anonymous usage data | On by default — untick it any time | Which features get used (for example “a recording started” or “a summary was made”), sent to PostHog in the EU. Never your recordings, transcripts, notes, titles, names or anything you type. Turn it off in the app's settings. Details below. |
| Crash & error reports | Only if you turn them on | Off by default. When on, a cleaned-up error type, message and code location, sent to PostHog in the EU, never linked to your account. |
| Reports about AI content | Only when you press Report on an AI result | The problem category, your optional comment, where in Lalela it happened, the AI model, your app version and platform, your account id if signed in, and the AI text itself only if you leave “Include the AI output” ticked. Stored in Supabase for Auxo Digital to review. Never audio, transcripts or voiceprints. Details below. |
| Website analytics | When you visit our websites | The web app and this site use Google Analytics and Microsoft Clarity to understand page visits. Clarity records how pages are used (clicks, scrolling); on the web app all text is masked in the browser, so your meetings, transcripts and notes are never captured, and it never runs on shared meeting links. The web app skips both when you turn usage data off. Advertising pixels on this site only load if you accept them in the cookie banner, and declining also stops Clarity here. |
| Ad campaign measurement | When you arrive from one of our ads, confirm a new account, or record your second meeting | This site keeps the campaign tags of the link you arrived on (such as utm_source=meta) in a first-party cookie for 90 days, shared with the web app. Ad click IDs (from Google or Meta) are only kept if you accept advertising cookies. When you confirm an account created on the web, its email address, account ID and those tags go to Duma, Auxo Digital's own marketing system, so we can count sign-ups per campaign; the same happens once when you record your second meeting (activation). Accounts created in the Mac, Windows or iPhone app send Duma only the account ID, no email, and are never passed on. Duma runs on Convex, hosted in the United States, so this data leaves South Africa; Duma deletes the plain email address within 30 days and keeps only a hashed form after that. Only if you accepted advertising cookies does Duma pass the sign-up and the activation on to Meta and Google, with your email address hashed, plus your browser's user agent and the ad click IDs, so they can measure our ads. We never send meeting content. |
Recording responsibly
A private notetaker doesn't exempt you from consent. Recording laws differ by country and by state — many require all parties to agree. Lalela keeps you honest: a clear recording indicator while capture is running, one-click pause and stop, easy deletion, and imported content is always labeled as externally sourced so you know what was recorded by whom. Tell people you're taking notes; it's the right thing to do and usually the law.
Security practices
- Signed & notarized. The Mac app is Developer ID-signed and notarized by Apple, with a secure auto-updater (cryptographically signed updates). The iPhone and iPad app comes from the App Store and the Windows app from the Microsoft Store, each signed by its store. The direct Windows installer isn't code-signed (Windows warns on first run), but its updates are cryptographically signed like the Mac's.
- Row-level security. When you do sync, every table in the cloud workspace is protected by Postgres row-level security — your rows are readable only by you and the people you explicitly share a folder with.
- Keys stay server-side or on device. Our AI-provider keys never ship in the app; your own BYOK key is stored locally on your device and sent only to your chosen provider.
- Least-privilege APIs. The hosted endpoints require an authenticated user, meter usage per account, and accept only our own storage URLs.
- Small surface, open formats. One analytics tool in the app (PostHog, EU), limited to the named events listed below and easy to switch off. No advertising trackers, and your data in formats you can audit with a text editor.
Usage data & crash reports
To know which parts of Lalela help people and which get in the way, the desktop, iPhone and web apps send anonymous usage data. It is on by default, and you can switch it off at any time. It records that something happened, never what was in it.
What usage data includes
- The app was opened, its version, and whether this is the first launch or just after an update
- You saw the sign-in screen, created an account, signed in or signed out
- First-run setup was started or finished
- A recording started or stopped (meeting or voice memo, and its length in a range such as “5–15 minutes”)
- A transcription finished (on-device, Apple or cloud, and whether it worked)
- A meeting was imported, and from where (an audio file, a transcript file, Teams, Otter and so on)
- A summary was made or tasks were pulled out (which kind of AI route ran: on-device, your own key or the free allowance, and the model family, such as “Claude” or “Llama”)
- You opened one of the main screens (Meetings, Search, Chat, Tasks, Knowledge, Automations, Settings)
- You searched (a rough count of results, never the words you searched for)
- You sent a chat message (that you sent one, never what it said)
- You added a task, created a share link, exported a meeting (Word or PDF) or sent one to a connected tool
- An automation or folder rule ran, and whether it worked
- Whether sync and update checks are working (ok, offline, signed out or a server problem)
- When you first try newer features, such as auto-sort, folder automations, dictation and Send to Atlas
- You reported an AI result (the problem category and which screen, never your comment or the AI text)
Each event also carries the app version, your operating system and chip type (for example macOS on Apple Silicon), whether you're signed in, and your plan. Lengths and counts are rounded into ranges. On the web we also count page visits, with links cleaned so share-link codes and meeting IDs are removed. Like any web request, the data reaches PostHog with your IP address, which PostHog uses to estimate your country and city.
What it never includes
Audio, recordings, transcripts, notes, summaries, chat questions or answers, AI prompts or output, meeting titles, people's names or email addresses, file or folder names, what you search for, anything you type, voiceprints, or screen captures. Lalela doesn't record your screen or clicks for analytics, and the app has no automatic click tracking: only the named events above can be sent, and the app drops anything else before it leaves your device.
Who it's linked to
If you aren't signed in, events carry a random ID created on your device. If you sign in, events are tied to your account's internal ID (never your email address), so we can see how the desktop, iPhone and web apps are used together. Signing out starts a new random ID. Accounts belonging to the Lalela team are marked so we can leave them out of the numbers.
Crash & error reports
These are off by default in the desktop and iPhone apps. If you turn them on, Lalela sends a short report when something breaks: the type of error, a cleaned-up error message and code location, the app version, and your operating system and chip type. File paths, quoted text, email addresses and keys are removed first. Crash reports use a random ID that changes every time the app starts and are never linked to your account. The web app reports errors as part of usage data, so the same switch controls both.
How to turn it off
- Desktop and iPhone: Settings → Recording → Privacy & consent → untick “Share anonymous usage data”. It stops straight away and stays off. The first-run screen has the same checkbox. The crash report switch sits right below it.
- Web app: Settings → Privacy → untick “Share anonymous usage data”. This stops PostHog, Google Analytics and Microsoft Clarity in that browser. The choice is saved per browser, so set it on each one you use.
Who processes it, and for how long
- PostHog (EU cloud, Frankfurt) handles usage data and crash reports for every Lalela app. We keep this data for up to 12 months.
- Google Analytics and Microsoft Clarity are used only on the web app and this website, never in the desktop or iPhone apps. On the web app, Clarity's session recordings mask all text before anything leaves your browser, and Clarity never loads on shared meeting links. They keep data under their standard retention, up to 14 months.
- Meta Pixel is used only on this website (never in the web app or the desktop and iPhone apps), and only if you accept advertising cookies in the banner. If you did, the sign-up itself reaches Meta and Google from our server, through Duma, not from a pixel: see “Ad campaign measurement” above.
We use this data only to improve Lalela. We don't sell it, and we don't use it for advertising. To have your usage data deleted, write to the address below.
Reporting AI content
Lalela uses AI to write summaries, notes, chat answers and more, and AI can get things wrong or say something inappropriate. Every AI result in the desktop, iPhone, iPad and web apps has a Report button (there's also “Report a problem with AI content” in Settings). A report sends Auxo Digital the problem category, your comment if you add one, where in Lalela it happened, the AI model used, your app version and platform, and your account id if you're signed in. The AI text itself is included only if you leave “Include the AI output in my report” ticked, and only up to 8,000 characters. Reports never include audio, transcripts or voiceprints. They're stored in Supabase, read only by the people at Auxo Digital who review them, and used only to investigate and improve Lalela's AI. If Lalela can't reach our servers it opens a prefilled email to hello@auxo.digital instead, so you can see exactly what you're sending.
We don't sell your data
We do not sell, rent or trade your recordings, transcripts, notes or account details to anyone, and we never use them to train AI models. The only parties who ever see any of it are the ones named in the table above, doing the job you asked for at the moment you asked for it. On Windows and macOS, transcription runs on your own computer by default, so for most people nothing leaves the device at all.
To ask what we hold about you, to get a copy of it, or to have it deleted, write to support@auxodigital.africa and we'll answer personally. To delete your account yourself, see how to delete your Lalela account.
Questions we haven't answered?
Read the FAQ or write to support@auxodigital.africa — privacy questions get real answers, not boilerplate.
Read the FAQ