MeetFolks

What this does with your data

Last updated 16 August 2026. MeetFolks is operated by Ravi Prasad as an independent project. Questions, access requests and deletion requests: privacy@meetfolks.app.

MeetFolks works out who spoke when at a table, using several phones at once. Each phone holds one speaker template — its owner's — and answers one question about its own recording: was my owner speaking here? Those answers are signed and sent to the server, which merges them onto a common clock.

1What never leaves your phone

The three recordings you make during setup are turned into numbers on the phone and the audio itself is never stored — what is kept is the 192-number speaker template they produce and the keypair that signs your claims, both in this browser's own storage (IndexedDB). Neither is ever uploaded. Three things enforce that rather than merely promising it:

• No endpoint accepts them. There is no upload path for a template or for enrollment audio.
• Requests are scanned before they are parsed. Anything template-shaped — embedding, vector, template, voiceprint, centroid, window_scores, at any depth — is rejected outright, so a future version of the app could not bolt one on unnoticed.
• The database has nowhere to put one. There is no embedding column, no score-curve column, no enrollment-audio column. "No biometric templates are stored" is a property of the schema.

There is a second reason, and it is not about privacy: a template is only reliable against audio from the phone that made it. In testing, the same speaker in one conversation had 313 s of speech attributed from one handset and 101 s from another. A template moved elsewhere is close to useless — which is why there is no migration path, and why a new phone needs its own setup.

Also held on your phone: the app itself and the ≈84 MB speaker model, in the browser's cache, plus a one-off flag used to recover from a half-updated copy of the app. There are no cookies, no analytics, no advertising identifiers and no third-party scripts anywhere in this app. To remove the template and key, use Diagnostics → Delete template and key; to remove everything, clear the site's data in your browser afterwards. Neither is recoverable, because the server never had a copy.

2What is sent to the server

Session codes expire four hours after a session is created. Server logs record identifiers and counts — session, device, how many files — and never transcript text.

3Audio, stated plainly

This is the part worth reading twice, because the obvious assumption about it is wrong.

• Audio arrives during the session, not after it. Your phone uploads roughly every 20 seconds while the conversation is happening.
• So closing the app does not undo what has already been sent. Stopping early leaves the earlier chunks on the server.
• You can delete them yourself. "Discard this recording", on the screen you see while a session is running, deletes every audio file your phone has sent for that session along with any text transcribed from them. It only ever touches your own recording. Afterwards there is no button for it, but the request is always honoured — see §7.
• It is sent on to be transcribed. Each chunk goes to AssemblyAI, over their EU endpoint, as plain 16 kHz audio. What travels with it is the list of display names at the table and nothing else — no session id, no device id, no claims. What comes back is words with timings.
• Everything else expires on its own. A sweep runs every five minutes and hard-deletes our copy of the audio 30 days after it arrived. The attribution and the transcript survive that; the recording does not.

Thirty days is longer than transcription needs, and here is why it is thirty. Nothing reads a recording once it has been turned into text — on that purpose alone the honest window would be hours, and it used to be 24 of them. The recordings are also the only material against which we can check whether attribution and transcription are actually getting better: a change to how speech is matched to a phone can only be judged by re-running it over real sessions and comparing what it produces to what shipped. A day's worth is never enough of them. That is a second use of the same recording, it is the reason for the longer window, and it is stated here rather than left to be inferred from a bigger number. It means people, and our own code, looking at recordings that are still here; it is not training a model on your voice, which we do not do (§6).

Our copy is held on infrastructure operated by Cloudflare (R2 object storage) and Railway (the API server). No specific storage region is guaranteed for those two; AssemblyAI is addressed at its EU endpoint.

4What this deployment does today

MeetFolks can be configured in ways that change the answers above — where transcription happens, and whether summaries are written by a third-party model. This is what meetfolks.app is running as of the date at the top:

Accepts audio

yes

Audio retention here

30 days — see §3 for why it is not hours

Transcription

AssemblyAI — universal-3-5-pro, falling back to universal-2

Audio sent outside this deployment

yes — to AssemblyAI, EU endpoint (api.eu.assemblyai.com)

Summaries

none — no transcript is sent to any summarising model

Grouping of unclaimed speech

on — computed on the server, never named (§5)

Biometric templates stored

no

Transcription is done by a company you have not chosen, and that is the honest way to put it. It buys real quality — in our own testing, one channel that a self-hosted model rendered as 77 words came back as 400 — and it is bought by sending your conversation to a processor. Both halves belong in the same sentence.

Language is auto-detected rather than pinned, so a table drifting between languages stays intelligible. We have opted out of AssemblyAI's model-improvement programme, so your audio is not used to train their models. Their own copy is held under their retention policy, described at assemblyai.com/docs/data-controls; deleting a recording here does not reach into it, though we will pass on a deletion request (§7).

The snapshot above is dated, so it can go stale between edits. The live answer is machine readable at /v1/config, and the app reads it at startup and states it under the wordmark before you agree to be recorded. Any further processor will be named here before it is switched on.

5People at the table who are not using the app

A recording captures whoever is in the room. Speech that no phone claims is grouped into anonymous clusters — "Speaker A", "Speaker B" — and is never named and never matched against anybody's template. That is deliberate: someone who did not opt in should not be identified by a system they never used.

Their audio is still audio, and sits on the same 30-day clock as everyone else's — including its use in the accuracy measurement described in §3, which is worth saying plainly about somebody who never opted into any of this. Whoever starts a recording is responsible for telling the people around them that it is happening — see the Terms. If you were recorded and want the audio removed, write to privacy@meetfolks.app with roughly when and where; we will find the session and delete it.

6Who else touches the data

• AssemblyAI — transcribes the audio, at their EU endpoint. They receive the recording and the display names at the table; they do not receive session ids, device ids, claims or anything about who said which part. See §4.
• Cloudflare — serves the app, sits in front of the API, and stores audio in R2.
• Railway — runs the API server and its database.

All three keep ordinary operational logs, which include IP addresses, under their own retention policies. There are no analytics providers, no advertising networks and no error-reporting service in this deployment. Nothing here is sold. We do not train models on your data, and we have opted out of the one programme — AssemblyAI's — that would otherwise have used it. We do measure our own accuracy against recordings while they are still here (§3), which is a different thing from training on them and is described rather than folded into this sentence.

7Deleting things

• Your recording: "Discard this recording" in the app, or wait 24 hours.
• Your template and signing key: Diagnostics → Delete template and key. Instant, local, unrecoverable.
• A whole session — its claims, envelopes, corrections, contact shares and result: email privacy@meetfolks.app. Deleting a session removes everything that hangs off it.

None of that reaches the copy AssemblyAI held while transcribing; that expires on their schedule (§4). If you want it removed sooner, say so in the same email and we will ask them.

There are no accounts and no email addresses on the server, so a request is matched to data by what you can tell us about it: the session code, the display name you used, and roughly when it happened. Requests are answered within 30 days, usually much sooner. The same address handles access requests and any complaint about how this is run.

8Security

Everything is served over HTTPS. Claims are signed with a key that never leaves the device, and the server resolves who a claim is about from that signature, so one participant cannot attribute speech to another. Devices authenticate with a token, and the API is configured to accept requests only through the edge. No system is perfect and this one is not offered as if it were.

9Children

MeetFolks is not intended for children under 16 and should not be set up by one. If a child's voice ends up in a recording, §5 and §7 apply and the fastest route is the deletion request above.

10Changes

Changes are made by editing this page and moving the date at the top. Anything that changes what leaves your phone, who holds it, or how long it is kept will be reflected here and in /v1/config before it takes effect.

Terms of Service