Privacy policy

For a summary of subprocessors, regions, encryption and retention, see Security and data handling.

Who runs Qarar

Qarar is a meeting-notes service operated by Kalemio and powered by the Kalemio API. Qarar has its own accounts: a Qarar account is separate from any Kalemio account. For privacy, account or deletion requests, email support@getqarar.com.

What we collect

Your account: your email address. The recordings you upload or record, with the meeting title, date and attendee names you enter. The transcript, speaker names, your edits and the AI notes. The notes you write yourself in a meeting’s notepad, with the point in the recording at which each line was written. Your account’s glossary of names and terms, including attendee names added to it automatically; the glossary stays until you delete its entries, even after the meeting is deleted. If you buy a paid plan, the payments section below says what Stripe and Qarar keep.

Operational logs record events such as a failed upload. They do not contain audio, transcript text or notes.

The operator’s internal analytics dashboard shows each meeting’s state, source, duration, error code and times under a pseudonymous account ID. It does not show your email address, meeting titles, attendee names, audio, transcript or notes, and only the operator can see it. It reads these values from the meeting records themselves and keeps no separate copy.

Site analytics: Qarar counts page views and steps such as viewing pricing, choosing a plan, starting checkout, finishing sign-in, adding a meeting and opening its notes. The counts are kept as daily totals per page, with coarse acquisition categories (source, channel and a recognized campaign) and one action detail such as the plan, the sign-in method or a meeting’s length range. They are tied to no cookie, IP address, account or meeting ID, and include no email address, meeting title or anything from a meeting. You can turn them off in “Analytics settings” at the bottom of every page; your browser keeps that choice in its local storage. After a server-confirmed paid purchase, Google Ads can receive an opaque transaction key, the amount and currency to measure the campaign. Its tag uses storage denied, with personalization disabled; meeting content, email and account identifiers are never sent. Analytics settings also stops this signal.

Activation steps: for a signed-in account, Qarar also records the first day the account reached each of these steps: creating it, adding a first meeting, a meeting failing to process or being tried again, its notes being retried or failing, its first finished notes with content, opening finished notes, a first share, someone opening a share, starting checkout and finishing it. Each is kept under a one-way code made from the account, never its email address or ID, with coarse acquisition categories (source, channel and a recognized campaign) and one action detail such as the plan, how a meeting was added or whether a failed meeting can be tried again, and nothing about any meeting. Under the same code Qarar keeps one label saying whether the account counts as a customer, as one of the operator’s own, staff, QA or test accounts, or as a possible alias of one; Qarar’s server works it out from the email address, which is not kept with it. The operator’s activation report counts accounts and meetings by these labels and shows only totals. Turning analytics off, or your browser’s Global Privacy Control signal, deletes these records and the label for the account and stops new ones. Until then they are kept without an expiry date.

Launch-news sign-up on the free meeting-minutes template closed on 1 October 2026. If you signed up before then, we keep only your email address, your language and when you signed up, use them only for what you agreed to, news about Qarar’s launch, and add them to no other marketing. We delete them when you ask at support@getqarar.com.

Signing in

You sign in with a one-time code sent to your email address, or with a passkey you added (below). Qarar does not offer Google or Microsoft sign-in at the moment; if it does, this page will first say what they share with Qarar.

Sign-in emails are sent through Cloudflare. A code expires after 10 minutes or when it is used, and we keep only a keyed hash of it. A signed-in browser holds a session cookie for 7 days, and a connected Mac holds a device token that stays valid for 90 days after it was last used; we store only a hash of each. A session also ends when you sign out, and in Settings you can sign out any Mac, or sign out everywhere at once.

Passkeys: you can also sign in with a passkey you add in Settings. Your device or password manager creates it and keeps its private key; Qarar stores only the passkey’s ID, its public key, the use counter the device reports, whether it syncs between your devices, and the name you give it. Your fingerprint, face or screen lock is checked on your device alone, so no biometric data leaves your device or reaches Qarar. When you remove a passkey in Settings we delete it and record the removal as a security event; delete it from your device’s password manager as well.

To limit abuse we count sign-in attempts per email address and per network (your IP address, or its /64 network for IPv6), under keyed hashes salted with the date, and delete these counters within a day. We keep your email address and linked sign-in methods for as long as you have an account.

Devices, sessions and seat protection

Trusted devices: when you sign in, your browser keeps a device cookie so Qarar recognises it next time; we store only a hash of it. For each browser or Mac we keep a label with only the browser family and operating system (for example Chrome on macOS, never the full browser string), the country Cloudflare reports for the connection, and when it was first and last seen. A device stays trusted until you remove it in Settings, stops counting 90 days after its last use, and its record is deleted 180 days after its last use. Up to 3 recently used devices are trusted; adding another takes a code sent to your email.

Seat protection: a seat is for one person, so Qarar records signs of a seat used by several people: a new device, a change of country within 2 hours, many networks in one day, and two recordings or uploads at once. Networks are recorded as keyed hashes salted with the date, so the same network cannot be linked from one day to the next. These records are used only to protect seats, never for advertising. Security events are deleted after 90 days, and network hashes after 30 days. They can lead to a suggestion to add a seat. No automated signal ever locks or restricts an account: any restriction is decided by a person, who tells you how to restore access.

Recording and uploading: while you record or upload, Qarar keeps when it started, its latest heartbeat, when it ended and which device sent it, so that one seat captures one meeting at a time. These records are deleted after 30 days.

Sharing and activity

Sharing a meeting: you can share one meeting with members of your workspace, with a guest by email, or through a view-only link. A guest signs in with the address you entered and sees only that meeting, never the rest of the workspace; the workspace’s owners and admins can see the guest’s email address. Anyone with a view-only link can read that meeting’s title, date, transcript, speaker names and notes, and hear its audio only if the link includes it; a link shows nothing else from the workspace. A link lasts 7 days by default, its creator can pick one of 1 day, 7 days, 30 days, or no expiry instead, and it can be turned off at any time. We store only a hash of its address.

Your notepad is private: only you see it and its enhanced notes, which include your original lines. If you choose to share them, everyone who can open the meeting can read both, including through a view-only link. Turning sharing off hides both from other readers again.

Activity: Qarar records who shared a meeting, opened it through a link or edited it in a workspace, so the workspace’s owners and admins can see it. These records are kept for the life of the workspace and deleted 90 days after the workspace is deleted.

Emails about sharing: when a meeting is shared with you, your access to it changes or it stops being shared, Qarar emails you once about it.

Emails and integrations

Emails: Qarar emails you for sign-in, invitations, shared meetings, and minute and seat notices, and, unless you turn them off in Settings, a recap once when a meeting’s notes are first ready and a daily reminder on days when a task assigned to you is due. All of them are sent through Cloudflare.

Recaps you send: you can email a meeting’s recap (summary, decisions and tasks, with a link if your plan allows) to addresses you confirm one by one. Each person gets a separate message, Qarar keeps the addresses with the meeting so you can pick them again, and it adds them to no mailing list.

Integrations: a workspace owner or admin can connect a Slack or Microsoft Teams channel or a signed webhook (for example to Zapier). Each destination then receives, as the owner or admin set it up, the meeting title, summary, decisions, tasks, owner names and the email addresses of whoever a task is assigned to, or only ids and counts at the minimal level. The transcript and audio are never sent. Your team chooses and controls those destinations, and the webhooks page spells out exactly what is sent.

Payments

Stripe processes Qarar’s payments, on an account that belongs to Qarar alone. Qarar gives Stripe your account email and, for a shared workspace, its name. Stripe collects your card, your billing address and any tax ID you enter, to take the payment and work out tax; card details never reach Qarar.

Qarar keeps the Stripe customer and subscription IDs, the plan, how often it is billed, the number of seats, the billing period and whether a payment is due. If you invite people to seats that are not paid for yet, we keep their email addresses until the seats are paid or the payment window closes. Stripe keeps invoices and receipts under its own policy, and Qarar keeps billing records for 7 years for tax.

Calendar and voice profile

Calendar: if you connect your calendar, we store the secret iCal address you paste encrypted and bound to your account, never show it again and never write it to logs. Qarar reads the calendar only when you connect it and when you open the new-meeting card, takes only the events from the past three hours and the next day, and keeps none of them; an event’s title, location, attendee names and attendee email addresses are stored only if you pick it for a meeting, and the addresses are used only to suggest recap recipients. We also keep the calendar’s host (such as calendar.google.com), when it was last read and whether that failed. Disconnecting the calendar deletes its address.

Voice profile: this is opt-in, and made only when you pick “This is me” for a speaker in one of your meetings and agree. We keep a voice print, a list of numbers describing how your voice sounds that is not a recording and cannot be played, with the name you chose, how much of your speech it was learned from and when you agreed. It is used only to name the speaker who sounds like you in meetings you create, is never compared with other people’s meetings and is never sent to an AI model. You can undo each naming, and the voice print stays until you delete it in Settings.

How a meeting is processed

Your audio is stored in private Cloudflare storage and transcribed by Kalemio’s transcription service. It is never sent to an outside AI provider. Your glossary entries and the attendee names you enter go to the transcription service with each chunk of audio, as hints for spelling names correctly.

To write the notes, the transcript text with its speaker names, the meeting title, date and attendee names are sent through OpenRouter to an AI model. To correct the spelling of names, the same text is sent with your glossary entries and their hints through OpenRouter to GPT-6 Luna from OpenAI (openai/gpt-6-luna). The notes are then written from the corrected text. Part of the same text, the attendee names and any title you gave are also sent through OpenRouter to GPT-6 Luna from OpenAI (openai/gpt-6-luna) to suggest the kind of meeting (a sales call, a standup and so on) and, if you left the title empty, to name it. A suggested type never replaces one you chose, and changing the type never changes the transcript. The audio is never sent to the model.

With AI notes on, the notes you write in the notepad are sent the same way to the notes model, with when each line was written, so it can expand them from the transcript into enhanced notes and give them priority in the other notes. Your lines stay exactly as you wrote them; the model never changes them. With AI notes off, your notepad is never sent to any model.

WhatsApp voice notes

When you import a WhatsApp chat export, Qarar reads it in your browser, on your device. It looks only at the lines for voice notes and takes each note’s sender name, send time and audio file from them. The chat’s messages, its other attachments and the chat text file are never uploaded.

What is uploaded is the audio of the voice notes you choose, their sender names (which you can edit first) and their send times. They are stored and processed like any other meeting: the sender names become speaker names, and with AI notes on they reach the notes model as described below.

The notes model does not keep your data

Notes are currently written by GPT-6 Luna from OpenAI (openai/gpt-6-luna) and Gemini 3.8 Flash from Google (google/gemini-3.8-flash). The second model is used only when the first returns an empty answer. The first model also corrects glossary spellings and suggests the meeting’s title and type. Qarar sends every request to a model through OpenRouter with zero data retention required: OpenRouter routes the request only to a provider that has committed not to store the prompt or the output after answering and not to use them to train models. If no such provider is available, the request fails and Qarar tries again later; it is never sent to a provider that keeps data. This covers everything sent to the model: your transcript text, speaker names, meeting title, date and attendee names, glossary entries and their hints, what you wrote in the notepad and the generated notes.

Notes are written only for meetings with AI notes on, which is the default. Turn AI notes off when you upload or record a meeting, and its transcript is never sent to the notes model or corrected with the glossary. If you leave its title empty, Qarar names it by date and time, without any model.

If we change the notes model, we update this page before the change takes effect.

What Qarar and Kalemio do not do

We do not use your audio, transcripts, edits or notes to train our own models. We do not sell your data or use it for advertising. This site does not use advertising cookies. The limited Google Ads purchase measurement described above never receives meeting content.

How long we keep meeting audio

In Settings you choose how long meeting audio is kept: 7, 30, 90, or 365 days after the transcript is ready. The default is 30 days. When that period ends, the audio is deleted. The transcript, notes and your notepad stay until you delete the meeting, which you can do at any time; deleting it removes its audio, transcript, notes and notepad. While you write, your browser keeps a copy of the notepad on your device until Qarar has saved it, then removes it; if a recording never finishes uploading, its notes stay in the browser until you copy or discard them.

If processing fails for a temporary reason after the upload finished (the transcription service could not be reached or failed to finish part of it, a step timed out, or the meeting waited too long in the queue), Qarar keeps the audio so the meeting’s creator can try again without uploading it again. It is kept for the period its creator chose in Settings, counted from the failure, then deleted, and until then it is used only to try again, never played back or shared. A meeting can be tried again up to 3 times, and each try counts against the plan like a new upload. If a try succeeds, the period then counts from when the transcript is ready; if it fails again for a temporary reason, the period starts over from that failure. Any other failure, and any failure once no tries are left, deletes the audio straight away, for example a silent recording, a recording longer than the plan allows, audio that cannot be read, a recording in which no speech was found, or an upload that never finished. Whatever the failure, the pieces of transcript, the voice data used to tell speakers apart and the copies of audio sent for transcription in that attempt are deleted straight away.

If you ask us to delete your account, we delete your meetings, email address, sign-in methods, sessions and connected devices with it. Billing records are kept for 7 years, as tax law requires.

Recording consent

Before each upload or recording, you confirm that everyone in the meeting, including the senders of any voice notes you upload, agreed to be recorded and transcribed. Recording laws differ between countries, including the UAE, Saudi Arabia and Egypt, and you are responsible for getting the consent the law requires.

Your requests

You can ask for a copy of your data, a correction or deletion by emailing support@getqarar.com from your account address.

Changes

We update this page when our practices change and show the date of the last change below.

Last updated: October 5, 2026