Privacy Policy

Effective Date: October 9, 2026

This Privacy Policy describes how WEIRTECH ("we," "us," or "our") collects, uses, and protects information when you use the Shoulder Surf application and related services (the "Service"). We are committed to transparency about your data, and this policy explains exactly what information leaves your device and what stays local, based on how you choose to use the Service.

1. Your Privacy Level Is Your Choice

Shoulder Surf offers three modes of operation, each with a different data footprint. You control which mode you use, and you can change modes at any time.

2. Information We Collect

2.1 Information You Provide

• Your Apple ID (used for authentication via Sign in with Apple)
• Subscription and billing information (processed by Apple; we do not receive your payment details)
• Any content you manually add to your AI memory profile
• Project names and organizational labels you create

2.2 Information Collected Automatically (Shoulder Surf AI Mode Only)

When using Shoulder Surf AI, the following information is processed through our servers:

• Meeting transcripts generated from audio captured by your device microphone
• Images captured by your device camera during meetings (when you enable this feature)
• Rolling meeting summaries generated by AI
• Your queries to the AI and the AI's responses
• AI memory profile data (facts the AI learns about you across sessions, organized into identity, preferences, traits, and experience categories)
• Meeting metadata including start time, end time, duration, and project tags

2.3 Usage Statistics (all modes)

Shoulder Surf sends usage statistics so we can see how the app is used, find problems, and measure which ads lead to subscriptions. This happens in every mode, including on-device and bring your own key.

What is sent: when the app opens; when a meeting starts and stops, how long it ran and why it ended; a check once a minute while a meeting is running, with how long it has run and whether it's paused; if a meeting picks up again after the app closed unexpectedly, which earlier meeting it continues; which AI model you picked; how far you got through setup and how long each step took; and a diagnostic note if a downloaded settings file fails to load. Each of those carries an identifier for this install, which resets when you delete the app, along with your app version and build, iOS version, device model, app language, whether you installed from the App Store or TestFlight, and your Shoulder Surf AI account ID when you are signed in.

Once, on first launch, we ask Apple for an Apple Ads attribution token, so we can tell which ad led to an install or a subscription. There is no advertising identifier, no App Tracking Transparency prompt, and no tracking of you across other apps or websites.

Never sent: transcripts, recordings, meeting content, names, or email addresses.

We do not sell this data and we do not use it to target ads at you. You can turn it off at any time in Settings, under Privacy & About, using the Usage statistics switch. Turning it off also stops the Apple Ads attribution described above.

2.4 Information We Do Not Collect

• Raw audio files (these remain on your device at all times)
• Contacts, calendar data, or other personal information from your device
• Location data
• Your API keys (in BYOAPI mode, keys are stored locally in your device's Keychain). For a detailed explanation of our key protection measures, see How we protect your API keys.

3. How We Use Your Information

When you use Shoulder Surf AI, we process your information for the following purposes:

• To provide AI-powered meeting transcription, summaries, and insights by routing your content to Anthropic's Claude for processing
• To maintain your AI memory profile so the AI can provide increasingly personalized and contextually relevant assistance across sessions
• To store meeting metadata so you can browse and search your meeting history

We do not use your meeting content, transcripts, or AI memory data to train AI models, for advertising purposes, to build profiles for sale to third parties, or for any purpose other than providing the Service to you.

4. Third-Party Services

We share your data only with the providers listed below, and only to provide the Service. Each is bound by terms that protect your data at least as well as this policy.

4.1 Anthropic (Shoulder Surf AI Mode)

When you use Shoulder Surf AI, your meeting transcripts, images, and query context are processed by Anthropic's Claude AI through our cloud proxy. Anthropic's handling of this data is governed by Anthropic's privacy policy and usage policies. We recommend reviewing Anthropic's policies at anthropic.com.

4.2 Your Chosen Provider (BYOAPI Mode)

When you use your own API key, your data is sent directly from your device to the provider you have configured (such as OpenAI, Anthropic, or Google). We are not involved in this data transmission. Your relationship with that provider is governed by your own agreement with them.

4.3 Apple

We use Sign in with Apple for authentication. Apple processes your subscription billing. If you enable iCloud backup for local meeting recordings, Apple handles that storage. Apple's privacy policy governs their handling of your data.

4.4 Google Cloud Platform

Our cloud infrastructure runs on Google Cloud Platform. Google acts as our infrastructure provider and processes data on our behalf under our data processing agreement. Google Cloud Platform maintains SOC 2 Type II and ISO 27001 certifications.

5. Shoulder Surf Companion for Mac and Windows

Mac

The companion is an accessory to Shoulder Surf on iPhone. It captures the meeting audio playing on your Mac, and your own voice from the Mac's microphone as a separate track, and sends both to your paired iPhone over your local network, encrypted in transit. The companion does not send audio, screen previews, screenshots, or anything said in a meeting to our servers.

Nothing is recorded on the Mac. Audio, screen previews and screenshots are captured and sent, never written to disk.

macOS asks for Screen Recording permission because that is the only way an app can capture the audio playing on your computer. The companion uses it for three things, all started from your paired iPhone: the meeting audio, during a session your iPhone starts; small previews of your displays, so you can pick one on your iPhone; and, while a Mac screen is picked as the session's view, a preview of that screen refreshed about every 3 seconds, plus a full-resolution screenshot each time you tap to capture. Previews are up to 1600 pixels wide, never include the cursor or the companion's answer window, and go only to your paired iPhone over your local network, encrypted. Your iPhone shows them and then discards them: they are never saved, never added to the meeting and never sent to any AI model. A screenshot you tap to capture is saved with the meeting like a photo from the camera, and the sections above on photos and AI apply to it. Nothing is captured unless a session is running on your iPhone.

The companion does send usage events to our servers: when it starts, when it pairs with your iPhone, and when a meeting starts and stops, including how long it ran and an identifier for that meeting session. Each event carries an identifier for this installation, kept in the app's preferences on your Mac, along with the app version and build, your macOS version, your Mac's processor type, and the app's language. If usage statistics are turned on in the Shoulder Surf iPhone app, your iPhone may also report the pairing, which associates this installation with your Shoulder Surf account. We never receive audio, screen previews, screenshots, anything said in a meeting, your name, or your email address through these events. The companion has no setting to turn them off.

The companion has no account and never signs in. Pairing uses a key stored in your keychain, carried between your own devices by iCloud Keychain when they share an Apple Account, or a six-digit code you type once. The six-digit code is stored locally in app preferences.

Windows

Shoulder Surf Companion for Windows runs on Windows 10 (version 2004 or later) and Windows 11. Like the Mac companion, it is an accessory to Shoulder Surf on iPhone. While a meeting you started on your iPhone is running, it captures the audio playing on your PC, and your own voice from the PC's microphone as a separate track, and sends both only to your paired iPhone over your local network, encrypted in transit with a key based on your six-digit pairing code. It also sends small previews of your displays so you can pick one on your iPhone, and while a PC screen is picked as the session's view, a preview of that screen refreshed about every 3 seconds, up to 1600 pixels wide, plus a full-resolution screenshot each time you tap to capture. Previews never include the cursor or the companion's answer window. Your iPhone shows them and then discards them: they are never saved, never added to the meeting and never sent to any AI model. The companion does not send audio, screen previews, screenshots, or anything said in a meeting to our servers.

Windows asks for permission to use the microphone, which you can change at any time in Settings > Privacy > Microphone.

The Windows companion sends the same kind of usage events to our servers: the first time it starts, when it pairs with your iPhone, and when a meeting starts and stops, including how long it ran and your iPhone's identifier for that meeting session. Each event carries a random identifier for this installation, the platform, your PC's processor type, the app version and build, your Windows version, and the app's language. If usage statistics are turned on in the Shoulder Surf iPhone app, your iPhone may also report the pairing, which associates this installation with your Shoulder Surf account. We never receive audio, screen previews, screenshots, anything said in a meeting, your name, or your email address through these events. The companion has no setting to turn them off.

The Windows companion has no account and never signs in. Its settings (your pairing code, the installation identifier, and window preferences) and a diagnostic log are stored only on your PC, in the app's own folder. Uninstalling the companion removes them.

6. Data Security

We take the security of your data seriously. Our security practices include:

• All data transmitted between your device and our servers is encrypted in transit using TLS
• Our cloud infrastructure is hosted on Google Cloud Platform, which maintains SOC 2 Type II, ISO 27001, and additional security certifications
• AI processing is handled by Anthropic, which maintains SOC 2 Type II and ISO 27001 certifications
• API keys stored on your device are secured using the iOS Keychain
• Authentication is handled through Sign in with Apple's secure authentication framework

No method of electronic transmission or storage is 100% secure. While we leverage industry-leading infrastructure providers and follow security best practices, we cannot guarantee absolute security. We will notify you of any data breach that affects your personal information in accordance with applicable law.

7. Data Retention

We retain your cloud-stored data (AI memory profile and meeting metadata) for as long as your account is active. You can delete individual AI memory entries at any time through the Memory Viewer. You can request complete deletion of your cloud-stored data by contacting us at support@shouldersurf.com or by deleting your account through the app. Upon deletion request, your cloud data will be removed within 30 days. Data stored locally on your device is retained until you delete it through the app's Data & Privacy settings.

8. Your Rights and Choices

You have the following rights regarding your data:

• Access and portability: You can view all data the AI has learned about you through the Memory Viewer. You can export your meeting data through the app's Data & Privacy settings.
• Correction: You can edit any AI memory entry through the Memory Viewer to correct inaccurate information.
• Deletion: You can delete individual AI memory entries, individual meeting records, or all of your data. You can request deletion of cloud-stored data at any time.
• Mode switching: You can switch between on-device, BYOAPI, and Shoulder Surf AI modes at any time, giving you direct control over what data leaves your device.
• Opt out of cloud processing: You can use Shoulder Surf entirely on-device (on supported hardware) or with your own API key, in which case no data is transmitted to or stored on our servers.

9. International Users and GDPR

If you are located in the European Economic Area, United Kingdom, or other jurisdiction with data protection laws, you have additional rights including the right to access, rectify, port, and erase your personal data, the right to restrict or object to processing, and the right to lodge a complaint with your local data protection authority.

Our legal basis for processing your data (when using Shoulder Surf AI) is the performance of our contract with you (providing the Service) and your consent (which you provide during onboarding before any cloud processing begins).

Data processed through Shoulder Surf AI may be transferred to servers located in the United States. By using Shoulder Surf AI, you consent to this transfer. You may avoid international data transfer entirely by using the on-device or BYOAPI modes.

10. Children's Privacy

Shoulder Surf is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by other reasonable means before the changes take effect. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: