Privacy Policy

Information we process

We process account details; documents, comments, meeting notes, transcripts, and source links you create or import; product usage, security, and diagnostic data; and billing information handled by our payment provider. When you connect ChatGPT, Codex, Claude, or another AI client, we process its OAuth authorization or API credential and the tool calls it makes on your behalf.

Meeting integrations

If you connect Granola or Zoom, HTML Docs receives the meeting titles, times, participants, summaries, transcripts, and source links needed to create the documents you requested. Granola API keys and Zoom OAuth tokens are encrypted at rest. Imported meeting documents are private by default.

How we use information

We use information to provide collaboration, search, synchronization, support, security, abuse prevention, and service improvement. We do not sell personal information or use private document content for advertising.

Sharing and subprocessors

We disclose data only to service providers that help operate HTML Docs—such as hosting, database, authentication, realtime collaboration, observability, AI inference you invoke, and payment services—or when required by law. A connected AI client receives only data returned by tools you authorize.

Retention and deletion

Documents and comments remain until you delete them or close your account. Deleted active content is removed promptly; backup copies, where present, age out within 30 days unless a longer period is required by law or an active security investigation. OAuth authorization codes expire after five minutes and are deleted within 30 days. OAuth access tokens expire after one hour and refresh tokens after 30 days; expired or revoked token records are deleted within 30 days. Security and diagnostic logs are retained for up to 30 days unless needed longer to investigate abuse or satisfy a legal obligation.

Disconnecting Granola or Zoom deletes stored credentials. When Zoom notifies us that the app was deauthorized, imported Zoom source documents and associated credentials are deleted. You can request account or data deletion through support.

Security

We use encryption in transit, restricted service credentials, explicit document authorization, scoped OAuth access, signed webhook validation, and encrypted third-party tokens. No internet service can promise absolute security; please report suspected issues through our security or support pages.

Your choices

You can revoke AI connector consent, disconnect meeting providers, remove imported documents, and request access, correction, export, or deletion where applicable. Local law may provide additional privacy rights.

International processing and changes

Information may be processed where our providers operate. We may update this policy as the service changes and will post the new effective date here.