Privacy Policy

1. Information We Collect

Account and profile information

When you create or use a Tofia account, we may process your name, email address, authentication identifiers, account session tokens, subscription status, app settings, language preferences, and support messages.

Meeting and practice data

Tofia may process meeting audio, live transcripts, translations, summaries, action items, coaching feedback, meeting titles, attendees, and user-provided meeting context when you use real-time meeting, translation, summary, or practice features.

Legacy Chrome extension browser context

When the Tofia Chrome extension was available, it could process audio from the browser meeting tab you choose, optional microphone audio, live transcripts, translations, meeting summaries, meeting titles, and the title and URL of browser tabs used to identify supported meeting pages. The retired Chrome extension did not read arbitrary page content or files.

Local app and device information

The desktop app may process local app settings, diagnostics, app version, operating system, microphone or system-audio device choices, virtual audio driver status, and crash or error information needed to operate and improve the product.

Integrations

If you connect optional integrations, Tofia may process data from those services, such as Google Calendar events, Google Drive or Google Docs content, Gmail message metadata or message content, and related OAuth tokens. Integration data is accessed only after you connect the integration and only to provide the requested feature.

2. Google Workspace API Data and Limited Use

When you connect Google Calendar, Tofia requests read-only access to calendar events. Tofia may access event and calendar identifiers, titles, descriptions, start and end times, all-day status, locations, attendee email addresses and response status, event status, Google Calendar links, and video-meeting links. Tofia uses this data only to display your calendar events, schedule the reminders you enable, and open a meeting or calendar link that you choose. Starting the assistant from Calendar does not transfer event details to AI meeting context. Tofia does not use this permission to create, modify, delete, or send invitations for Google Calendar events.

The current desktop Calendar connection stores Google OAuth credentials in protected application storage on your device and does not register cloud calendar synchronization. Viewing an event or opening the assistant from Calendar does not create a cloud meeting record. Disconnecting this connection removes its local credentials and requests revocation of its Google authorization when available; it does not modify the original Google Calendar events.

Previous versions may have stored calendar-sync credentials and event-derived records in access-controlled Tofia cloud storage. The legacy cloud importer is disabled in the current production service. Calendar-linked records are blocked from AI meeting loading, report inputs, and assistant context, including recovery and cached fallbacks. Historical records and deletion requests remain subject to the retention and deletion practices described below.

Tofia does not sell Google Workspace API data, use it for advertising, or use raw, aggregated, anonymized, or derived Google Workspace API data to develop, improve, or train generalized AI or machine-learning models. Calendar browsing, reminders, and meeting-link features do not send event details to AI providers. The use of raw or derived user data received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Retired Chrome Extension Privacy and Permissions

The Tofia Chrome extension was a browser-based meeting assistant. It opened a side panel, supported Tofia account sign-in, captured audio from the selected browser meeting tab after you started a session, could capture microphone audio after permission was granted, and connected to Tofia cloud services for transcription, translation, summaries, reports, billing, support, and account features. The permissions below describe that retired service and do not indicate that it is currently available.

Protections for legacy Chrome extension data

• It does not sell or share browser data for advertising.
• It does not use browser content to train AI models.
• It does not collect Chrome browsing history.
• It does not read every page automatically in the background.
• It does not request local network bridge access, desktop screen capture, page injection, or broad active-tab permissions.
• It does not execute remote code; extension code is bundled with the extension package.

4. How We Use Information

We use information to:

• provide live transcription, translation, summaries, reply suggestions, and coaching;
• process the browser meeting tab audio, optional microphone audio, meeting title, and tab URL needed for a meeting session;
• sync app state, account status, settings, report history, and user preferences;
• operate connected integrations that you authorize;
• maintain security, prevent abuse, debug issues, and improve reliability;
• respond to support requests and product feedback.

5. How Information Is Shared

We share information only as needed to operate Tofia, comply with law, protect users, or complete actions you request. Depending on the feature, information may be processed by:

• AI, speech-to-text, and translation providers used to generate transcripts, translations, summaries, and responses;
• cloud hosting, database, authentication, and storage providers used to run Tofia;
• error monitoring and analytics providers used to diagnose crashes and product reliability issues;
• payment processors if you purchase a paid plan;
• connected third-party services such as Google, only after you authorize the integration.

We do not allow these processors to use your sensitive Tofia content for their own advertising or model-training purposes.

6. Storage and Retention

Some information is stored locally on your device, including extension settings, account session state, app settings, notification preferences, and local conversation state. If you use account sync, cloud history, integrations, shared summaries, or support features, related records may be stored in Tofia cloud systems.

Local desktop meeting audio follows a default 30-day cleanup policy. Cleanup runs when a new recording starts, rather than on a timer exactly 30 days later. A 5 GiB local audio storage limit may also remove older completed recordings sooner to make room for new audio.

Cloud meeting history, transcripts, reports, notes, and event-derived meeting records are not automatically deleted after 30 days. They are retained until you delete the associated meeting or request deletion, subject to the history limit: cloud history keeps the latest 200 completed meetings per account, and older completed meeting records are removed when this limit is exceeded.

Disconnecting Google Calendar stops future access through that connection, but does not automatically delete meeting records you previously saved. You can request deletion by contacting us at support@tofia.ai. Data may be retained where needed to comply with law, resolve disputes, or maintain security.

7. Security

We use technical and organizational safeguards designed to protect personal information, including encrypted transport for cloud services, scoped OAuth access for integrations, local browser-extension storage for account session state, access controls, and data minimization. No method of storage or transmission is perfectly secure, but we work to limit collection and access to what is needed for Tofia to function.

8. Your Choices

• You can choose not to start browser tab audio or microphone capture.
• You can remove Chrome extension permissions in Chrome settings.
• You can disconnect Google or other integrations from the Tofia app.
• You can delete local extension conversations or clear app data from your device.
• You can request account, meeting, or support-data deletion by emailing us.

9. Children

Tofia is intended for professional and educational use by adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy as Tofia changes. If we make material changes, we will update the date at the top of this page and provide additional notice when appropriate.