🔐 SlideGist Privacy Policy
Last Updated: October 7, 2026 Effective Date: October 7, 2026
This Privacy Policy describes how SlideGist ("we", "us", or "our") — operated by an independent developer based in Hong Kong — collects, uses, and shares information about you when you use SlideGist (the "Service") on iOS, Android, or the Web.
SlideGist lets you record a talk or meeting while photographing the slides, and turns the two into a summary, a restored deck, or an editable deck. We collect the minimum information needed to do that.
1. Information We Collect and How We Use It
1.1 Account Information
When you register or sign in, you provide an email address (or a third-party identifier such as an Apple ID or Google Account). Authentication is handled by Supabase Auth. Authentication tokens are stored encrypted on your device via MMKV.
You may close your account at any time via Settings → Account → Delete Account in the app, or at https://slidegist.ai/en/account on the web. After deletion we delete or anonymize the data associated with your account, except where retention is required by law.
1.2 Content You Create
To provide core functionality, we store the content you create:
- Audio recordings — uploaded in chunks for transcription.
- Photos — slide and whiteboard photos, uploaded so you can review them and so our AI can extract their text and structure.
- Transcripts — produced from your recordings by our speech-to-text providers, including live transcripts produced while you are still recording.
- Notes — text and images you type, paste, or share into the Notes feature.
- AI-generated outputs — summaries, live hints, share images, restored decks (PDF), and generated decks (.pptx) derived from your content.
- Knowledge base entries — notes and documents you import (Markdown, ZIP, flomo export), together with the vector embeddings we compute from them so the knowledge base can find related entries.
- Tags, goals, and review metadata — labels you apply, goals you set, and review-session statistics.
1.3 Links You Share Publicly
When you create a share link for a project, the content behind that link — title, summary, transcript excerpts, and images you chose to include — becomes readable by anyone who has the link, without signing in, at https://slidegist.ai/p/<id>. The page also publishes OpenGraph metadata (title, description, preview image), so a link pasted into a chat app or social network will show a preview, and a link posted publicly may be indexed by search engines.
Creating a project share link is separate from access to stored files. Some files, including project photos and generated outputs, are stored in public Storage buckets. Anyone who obtains the exact URL of an object in those buckets can access it without signing in, whether or not you created a project share link. You can revoke a project share page in the app, but that does not revoke an object's URL. Removing an object or changing its bucket access can stop future access; we cannot recall copies already downloaded or cached.
1.4 Subscriptions, Credits, and Referrals
If you subscribe to a paid plan, transactions are processed by the Apple App Store, Google Play, or Stripe (via RevenueCat for the mobile stores). We do not receive or store your full payment card number or bank account. We retain only what is needed to keep your subscription accurate: subscription state, plan, billing cycle, store-issued transaction IDs, and expiry dates.
We also keep a credit ledger — grants, purchases, and the credit cost of each operation you run — so that the balance shown in the app can be audited. If you use an invite code or refer another user, we record the relationship between the two accounts in order to award the referral credits and to detect abuse.
1.5 Device and Log Information
To operate the Service, detect abuse, and diagnose failures, we automatically collect:
- Device model, OS version, screen size, locale
- IP address and network type
- App version, server-side request and error logs, and per-operation timing and outcome records
We do not embed any third-party analytics, advertising, or attribution SDK, and we do not build advertising profiles. Crash reports collected by the Apple App Store or Google Play are governed by those platforms' own policies, not by ours.
1.6 Notifications
When you enable features such as review reminders, we send local notifications at the times you choose. While a recording is running, Android shows an ongoing notification for the foreground service that keeps the microphone alive — you can stop the recording from it at any time.
1.7 Service Improvement
We may use de-identified, aggregated usage data — which does not identify you — to improve our algorithms and prompts. We do not use the content of your recordings, photos, or notes to train AI models, and we do not permit our AI providers to train on it, without your explicit consent.
1.8 Sensitive Information
The Service necessarily handles material that may be sensitive: audio recordings of conversations, photographs taken in rooms you are in, transcripts, and the AI output derived from them. Recordings may capture the voices of people other than you. Please consider what you record and upload, and see §3.4 of our Terms of Service for your obligations toward those people.
2. How We Share Information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as described below.
2.1 Service Providers
We use the processors listed in §6 to run the Service. In particular:
- Speech-to-text providers receive your audio, in chunks or as a live stream.
- AI model providers and API aggregators receive your transcripts, extracted photo text, and the prompts built from them, in order to return summaries, hints, images, and slide layouts.
- Payment processors receive the identifiers needed to bill and validate a subscription.
These providers act on our instructions and may not use your content for their own purposes.
2.2 Legal Requirements
We may disclose information where we believe in good faith that disclosure is required by applicable law, regulation, legal process, or a valid governmental request.
2.3 Business Transfers
If we undergo a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will require the new owner to honor this Policy or give you notice of any change.
3. International Data Transfers
Our backend — database, storage, Edge Functions — is provided by Supabase, on servers located in the United States. Our AI and speech providers operate in the United States, the European Union, and Asia. By using the Service you understand that your data is transferred outside your country of residence.
For users in the European Economic Area, the United Kingdom, or Switzerland, we rely on the Standard Contractual Clauses approved by the European Commission, together with supplementary measures, as the lawful basis for these transfers.
4. Data Retention
- Content you create is kept until you delete it or close your account.
- Deleted content is removed from active storage on deletion and purged from backups within 30 days.
- Account deletion removes or anonymizes your account data within 30 days.
- Billing and credit-ledger records are retained for as long as required for tax, accounting, and dispute-resolution purposes, after which they are deleted or anonymized.
- Server logs are retained for up to 90 days.
5. Security
- In transit: all client-server traffic uses HTTPS/TLS; live transcription uses WSS.
- At rest: data is encrypted at rest; authentication tokens are encrypted on-device via MMKV.
- Database access control: Row-Level Security (RLS) limits access to database records according to account ownership. This does not restrict files stored in public Storage buckets. Anyone with an exact public object URL can access that file without signing in; project share links are separate and expose the content described in §1.3.
- Backups: periodic backups guard against data loss.
No system is perfectly secure. In the event of a personal-data breach we will notify affected users, and any supervisory authority, as applicable law requires.
6. Processors and Third-Party Services
| Service | Provider | Purpose |
|---|---|---|
| Supabase | Supabase Inc. (US) | Authentication, database, file storage, Edge Functions |
| OpenAI | OpenAI L.L.C. (US) | Language models, transcription, image generation |
| AI API aggregators | Third-party API proxies (US) | Routing model requests to the providers above and to comparable models |
| Deepgram | Deepgram Inc. (US) | Live speech-to-text |
| iFlytek | iFlytek Co., Ltd. (CN) | Live speech-to-text |
| Volcengine | Beijing Volcano Engine Technology Co., Ltd. (CN) | Live speech-to-text |
| ElevenLabs | ElevenLabs Inc. (US) | Speech processing |
| Replicate | Replicate Inc. (US) | Image models used by the photo-repair and slide tools |
| RevenueCat | RevenueCat Inc. (US) | Subscription state for the mobile stores |
| Apple App Store | Apple Inc. (US) | iOS subscription billing |
| Google Play Billing | Google LLC (US) | Android subscription billing |
| Stripe | Stripe Inc. (US) | Web subscription billing |
| Expo | Expo Inc. (US) | Over-the-air app updates |
Which speech and model providers handle a given request depends on the feature and on server-side configuration. Each provider has its own privacy policy, and where required we have entered into data processing agreements with them.
7. Your Rights
You have the right to:
- Access and portability — request a copy of your data, or export it from the in-app knowledge base export.
- Rectification — edit or correct the content you have created.
- Erasure — delete individual items, or close your account.
- Restriction and objection — limit or object to particular processing.
- Withdraw consent — revoke the camera, microphone, photo, or notification permission at any time in your device settings.
Exercise these rights directly in the app, or email privacy@slidegist.ai. We respond within 30 days.
7.1 EEA / UK Residents (GDPR)
Our legal bases are (a) performance of a contract — providing the Service you signed up for; (b) legitimate interests — security, abuse prevention, and service improvement; and (c) consent — for optional features such as push notifications. You may lodge a complaint with your local supervisory authority.
7.2 California Residents (CCPA/CPRA)
You have the right to know what personal information we collect, and to delete, correct, and limit its use. We do not sell or share personal information for cross-context behavioral advertising. Email privacy@slidegist.ai to exercise these rights; we will not discriminate against you for doing so.
8. App Permissions
iOS: camera, photo library, microphone, notifications.
Android: CAMERA, RECORD_AUDIO, MODIFY_AUDIO_SETTINGS, POST_NOTIFICATIONS, FOREGROUND_SERVICE, FOREGROUND_SERVICE_MICROPHONE.
The two foreground-service permissions exist for one reason: so that a recording keeps running when you lock the screen or switch to another app. The microphone is only ever active during a recording you started, and Android shows a notification for the whole time it is.
You may grant or revoke any permission in your device's system settings.
9. Children
SlideGist is intended for users 18 years of age and older and is not directed at children. We do not knowingly collect personal information from anyone under 13 (or under 16 in the European Economic Area, unless your member state permits a lower age down to 13). If you believe a child has provided us with personal information, contact privacy@slidegist.ai and we will delete it.
10. Changes to This Policy
We may update this Policy. Material changes will be announced by in-app notice or email at least 30 days before they take effect. The "Last Updated" date above reflects the most recent revision.
11. Contact
- General: hi@slidegist.ai
- Privacy: privacy@slidegist.ai
- Website: https://slidegist.ai
We respond to inquiries within 30 days.
最后更新：2026-10-07