Your audio is yours. Everything else is opt-in.

The following are the only cases where data is transmitted from the app, and each one is either necessary for the app to work or an explicit opt-in:

1. Model downloads. On first run, Parlo downloads the speech and language models it runs locally (several gigabytes). The download request includes version and platform identifiers only.
2. Account sign-in & license check. Signing in uses a magic link sent to your email address. Once per day, Parlo checks whether your license is still valid; this sends only a license token and app version.
3. Factual question lookups (opt-in use). When you ask Parlo a factual question, the text of the question is sent to a search provider so Parlo can answer it. Audio and transcripts are never sent.
4. Parlo Cloud meeting notes (your choice at setup).When you pick Parlo Cloud, the transcript text of a meeting is sent to Parlo's relay once, when the recording ends, to write the notes. What is sent: the transcript, the meeting's title, start and end time, the names of the speakers as they appear in the transcript, and the attendee names from the calendar invite when there is one. Never the audio. The relay passes that text to OpenAI, which runs the model (currently gpt-6-luna), and streams the notes back to your Mac. The relay stores no transcript, metadata or notes at all; the only thing it writes is a per-day counter of calls and token totals against a salted hash of your license, used for fair-use limits. OpenAI's standard API terms apply to the model call: your text is not used to train models and is deleted within 30 days, retained only for abuse monitoring in the meantime; we have no zero-data retention agreement, so that 30 days is the term that applies. Requests are authenticated with the license Parlo already holds, so no account details travel with them. The Meetings window always shows which path wrote the notes on screen, and you can switch to on-device only in Settings → Meetings at any time. If the relay fails, Parlo falls back to the on-device model and tells you so. Follow-up drafts work the same way: when you ask for one, the meeting's notes (not the transcript), its title and date, and the names of the people it's addressed to are sent to the relay to write the draft, and nothing is stored. Email addresses from the calendar invite never leave your Mac: the draft opens in your own mail app, and Parlo never sends it.
5. Cloud meeting notes with your own key (opt-in).Instead of Parlo Cloud, you can send the transcript to a notes provider you choose (OpenAI, Anthropic, or a custom endpoint) using an API key you provide; that provider's terms apply and Parlo's relay is not involved. If it fails, Parlo falls back to the on-device model and tells you so.
6. Google Drive sharing (opt-in). If you enable it, Parlo uploads meeting notes, transcripts, and meeting metadata to a Google Drive folder you choose. It uses Google's most limited permission (drive.file): it can only create and update its own files. Recordings never leave your Mac.
7. "Polish" hand-off (explicit action). Clicking Polish opens the transcript in your own ChatGPT or Claude account. This is a deliberate action you take to send content to a service you control.
8. Waitlist & alpha emails. The email address you submit on parlohub.com is stored securely and used only for your invite and occasional product updates. Never shared, unsubscribe anytime.

Data stored locally on your Mac is retained until you delete it — deleting a meeting from the Meetings window removes its files. Uninstalling the app and removing its folders in Documents / App Support deletes everything local. Waitlist email addresses are retained until you unsubscribe; unsubscribing removes you from future mailings.