Privacy Policy

Effective Date: March 30, 2026

This Privacy Policy describes how WEIRTECH ("we," "us," or "our") collects, uses, and protects information when you use the Shoulder Surf application and related services (the "Service"). We are committed to transparency about your data, and this policy explains exactly what information leaves your device and what stays local, based on how you choose to use the Service.

1. Your Privacy Level Is Your Choice

Shoulder Surf offers three modes of operation, each with a different data footprint. You control which mode you use, and you can change modes at any time.

2. Information We Collect

2.1 Information You Provide

• Your Apple ID (used for authentication via Sign in with Apple)
• Subscription and billing information (processed by Apple; we do not receive your payment details)
• Any content you manually add to your AI memory profile
• Project names and organizational labels you create

2.2 Information Collected Automatically (Shoulder Surf AI Mode Only)

When using Shoulder Surf AI, the following information is processed through our servers:

• Meeting transcripts generated from audio captured by your device microphone
• Images captured by your device camera during meetings (when you enable this feature)
• Rolling meeting summaries generated by AI
• Your queries to the AI and the AI's responses
• AI memory profile data (facts the AI learns about you across sessions, organized into identity, preferences, traits, and experience categories)
• Meeting metadata including start time, end time, duration, and project tags

2.3 Information We Do Not Collect

• Raw audio files (these remain on your device at all times)
• Contacts, calendar data, or other personal information from your device
• Location data
• Usage analytics or behavioral tracking data
• Your API keys (in BYOAPI mode, keys are stored locally in your device's Keychain). For a detailed explanation of our key protection measures, see How we protect your API keys.

3. How We Use Your Information

When you use Shoulder Surf AI, we process your information for the following purposes:

• To provide AI-powered meeting transcription, summaries, and insights by routing your content to Anthropic's Claude for processing
• To maintain your AI memory profile so the AI can provide increasingly personalized and contextually relevant assistance across sessions
• To store meeting metadata so you can browse and search your meeting history

We do not use your meeting content, transcripts, or AI memory data to train AI models, for advertising purposes, to build profiles for sale to third parties, or for any purpose other than providing the Service to you.

4. Third-Party Services

4.1 Anthropic (Shoulder Surf AI Mode)

When you use Shoulder Surf AI, your meeting transcripts, images, and query context are processed by Anthropic's Claude AI through our cloud proxy. Anthropic's handling of this data is governed by Anthropic's privacy policy and usage policies. We recommend reviewing Anthropic's policies at anthropic.com.

4.2 Your Chosen Provider (BYOAPI Mode)

When you use your own API key, your data is sent directly from your device to the provider you have configured (such as OpenAI, Anthropic, or Google). We are not involved in this data transmission. Your relationship with that provider is governed by your own agreement with them.

4.3 Apple

We use Sign in with Apple for authentication. Apple processes your subscription billing. If you enable iCloud backup for local meeting recordings, Apple handles that storage. Apple's privacy policy governs their handling of your data.

4.4 Google Cloud Platform

Our cloud infrastructure runs on Google Cloud Platform. Google acts as our infrastructure provider and processes data on our behalf under our data processing agreement. Google Cloud Platform maintains SOC 2 Type II and ISO 27001 certifications.

5. Data Security

We take the security of your data seriously. Our security practices include:

• All data transmitted between your device and our servers is encrypted in transit using TLS
• Our cloud infrastructure is hosted on Google Cloud Platform, which maintains SOC 2 Type II, ISO 27001, and additional security certifications
• AI processing is handled by Anthropic, which maintains SOC 2 Type II and ISO 27001 certifications
• API keys stored on your device are secured using the iOS Keychain
• Authentication is handled through Sign in with Apple's secure authentication framework

No method of electronic transmission or storage is 100% secure. While we leverage industry-leading infrastructure providers and follow security best practices, we cannot guarantee absolute security. We will notify you of any data breach that affects your personal information in accordance with applicable law.

6. Data Retention

We retain your cloud-stored data (AI memory profile and meeting metadata) for as long as your account is active. You can delete individual AI memory entries at any time through the Memory Viewer. You can request complete deletion of your cloud-stored data by contacting us at support@shouldersurf.com or by deleting your account through the app. Upon deletion request, your cloud data will be removed within 30 days. Data stored locally on your device is retained until you delete it through the app's Data & Privacy settings.

7. Your Rights and Choices

You have the following rights regarding your data:

• Access and portability: You can view all data the AI has learned about you through the Memory Viewer. You can export your meeting data through the app's Data & Privacy settings.
• Correction: You can edit any AI memory entry through the Memory Viewer to correct inaccurate information.
• Deletion: You can delete individual AI memory entries, individual meeting records, or all of your data. You can request deletion of cloud-stored data at any time.
• Mode switching: You can switch between on-device, BYOAPI, and Shoulder Surf AI modes at any time, giving you direct control over what data leaves your device.
• Opt out of cloud processing: You can use Shoulder Surf entirely on-device (on supported hardware) or with your own API key, in which case no data is transmitted to or stored on our servers.

8. International Users and GDPR

If you are located in the European Economic Area, United Kingdom, or other jurisdiction with data protection laws, you have additional rights including the right to access, rectify, port, and erase your personal data, the right to restrict or object to processing, and the right to lodge a complaint with your local data protection authority.

Our legal basis for processing your data (when using Shoulder Surf AI) is the performance of our contract with you (providing the Service) and your consent (which you provide during onboarding before any cloud processing begins).

Data processed through Shoulder Surf AI may be transferred to servers located in the United States. By using Shoulder Surf AI, you consent to this transfer. You may avoid international data transfer entirely by using the on-device or BYOAPI modes.

9. Children's Privacy

Shoulder Surf is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by other reasonable means before the changes take effect. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: