Privacy Policy

Fastrepl, Inc. ("Char," "we," "our," or "us") operates the Char application and the websites at char.com and its subdomains (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service, you agree to this Policy.

If you have any questions, contact us at privacy@char.com.

1. Char is local-first by design

Char is a desktop application that stores your notes, transcripts, and related content on your device by default. Cloud features — managed AI, sync, integrations, billing, and account services — are optional and only activate when you connect an account or enable a specific feature. When you disable cloud features or sign out, your local data remains on your device and is not affected.

We designed Char so that:

Your notepad lives on your machine. Your raw note content is not uploaded to our servers unless you enable a cloud feature that requires it (such as managed AI or sync).
Delegation is deliberate, not default. Char asks before sending data to an agent, integration, or cloud provider.
You can see what each agent is doing and stop it at any time. Nothing leaves your context invisibly.

2. Information we collect

2.1 Information you give us

Account information — name, email address, and authentication credentials when you create an account.
Billing information — for paid plans, billing name and address. Card numbers are handled directly by our payment processor (Stripe) and are not stored on our servers.
Communications — when you contact support, reply to surveys, or send us feedback.
Integration content — when you connect a third-party service (such as Google Calendar, Slack, GitHub, or Linear), Char accesses the data you authorize that integration to share. You can revoke any integration at any time from in-app settings.

2.2 Information generated by your use of Char

Meeting audio and transcripts — if you choose to record a meeting, Char captures audio from your device (and, where you opt in, from a meeting bot) to produce a transcript. Audio is processed transiently for transcription and is not retained on our servers after the transcript is delivered, unless you explicitly enable cloud storage of recordings.
AI prompts and outputs — when you use a managed AI feature, the relevant prompt context (selected notes, transcript snippets, or chat messages) is sent to the cloud AI model you have selected and returned to you. We do not use your prompts, transcripts, or notes to train our own AI models, and our model providers are contractually prohibited from using them to train theirs.
Screen and application context — Char can capture limited screen and application activity to help surface tasks (for example, "you spent 45 minutes on this doc"). This capture happens on your device. Char never streams your screen continuously to our servers.

2.3 Information collected automatically

When you use the Service we collect:

Usage and product telemetry — pseudonymous event data about how the application is used (feature opens, AI invocations, errors). We design events to avoid raw note content.
Device and log data — operating system, application version, IP address, crash reports, latency, and error events.
Web analytics — when you visit char.com or our subdomains, we collect interaction metadata (pages viewed, clicks, referrers, approximate location derived from IP) where allowed by your cookie and Global Privacy Control settings.
Cookies — we use cookies for essential functions (authentication), preferences, and (where you allow) analytics. You can manage cookies through your browser or the cookie controls on our website.

3. How we use your information

We use your information to:

Provide, operate, and improve the Service.
Authenticate you and secure your account.
Process payments, manage subscriptions, and prevent fraud.
Send transactional messages (account, billing, and service notices).
Send product updates and marketing communications, where you have not opted out.
Respond to your questions and provide support.
Diagnose errors, improve quality, and prevent abuse.
Comply with legal obligations.

We do not sell, rent, or trade your personal information. We do not use your notes, transcripts, prompts, or other Customer Content to train AI models, and our subprocessors are contractually prohibited from doing so.

4. Subprocessors

We use a small number of trusted vendors to run the Service. Each is bound by a data processing agreement and processes data only as needed to deliver the function below.

Vendor	Purpose	Data category
Amazon Web Services (AWS)	Cloud hosting and storage (US region)	All cloud-stored Customer Content and account data
Stytch	Authentication and identity	Email, authentication tokens, device metadata
Stripe	Payment processing	Billing details, card data (handled by Stripe directly)
Recall.ai	Meeting bots for video calls	Meeting audio (transient), meeting metadata
Deepgram	Speech-to-text transcription	Audio (transient), transcripts
Anthropic, OpenAI	Cloud AI models	Prompt context you choose to send to AI features
Nango	Integration broker for third-party apps	OAuth tokens, integration metadata
Loops	Transactional and marketing email	Email address, message metadata
PostHog	Product analytics	Pseudonymous event data
Sentry	Error monitoring	Error traces, device metadata
Google Analytics, Microsoft Clarity	Website analytics	Web interaction metadata (with consent where required)

We may add, remove, or replace subprocessors as the Service evolves. The current list is maintained on this page; material changes will be announced via email or in-app notice before they take effect.

When you use Char to record or transcribe a meeting, you are responsible for obtaining consent from all participants as required by the recording laws of the jurisdictions involved. Some jurisdictions require the consent of all parties; others require notice or one-party consent. Char provides surfacing tools (visible indicators, consent notices for bot-based recording), but the legal obligation to obtain consent rests with you.

We share information only as described here:

With our subprocessors as listed above, to deliver the Service.
With your direction, when you connect an integration or share content with another user.
With your employer or workspace administrator, where you signed up using an organization-provisioned email address or are part of a paid team plan. In that case, the administrator can manage your access, billing, and account settings. Your raw note content is not transferred to the administrator without your consent.
For legal reasons, when we receive a valid legal request, or to protect the rights, safety, or property of Char, our users, or the public. We will push back on overbroad requests where appropriate and, where legally permitted, give you notice.
In a corporate transaction, such as a merger, acquisition, or sale of assets. Your data remains subject to this Policy, and we will provide notice of any material change in handling.

We do not sell your personal information.

7. Data retention

Account data — retained while your account is active. Deleted within 30 days of account deletion, except where we are required to retain it for legal, tax, or fraud-prevention purposes.
Cloud-stored notes, transcripts, and integration data — retained while your account is active or until you delete them. Deleted within 30 days of account deletion.
Meeting audio — processed transiently for transcription. Not stored on our servers after the transcript is delivered, unless you explicitly enable cloud storage of recordings.
Local data — stored on your device. Not affected by account deletion. You can delete it through your operating system at any time.
Logs, telemetry, and analytics — typically retained for up to 12 months in pseudonymous form.
Billing records — retained for the period required by applicable tax law (typically 7 years).

8. Your rights

Depending on where you live, you may have the following rights:

Access — request a copy of the personal information we hold about you.
Correction — ask us to correct inaccurate or incomplete information.
Deletion — ask us to delete your account and personal information.
Portability — receive a machine-readable copy of data you provided.
Objection and restriction — object to certain processing or ask us to restrict it.
Withdrawal of consent — where processing is based on consent, withdraw it at any time.
Marketing opt-out — unsubscribe from marketing emails using the link in any marketing message, or by emailing privacy@char.com.

To exercise any of these rights, email privacy@char.com with "Privacy Request" in the subject line. We may ask for information to verify your identity. We will respond within the period required by applicable law (typically 30 days).

If you are located in the EEA, UK, or Switzerland, our legal bases for processing your information are:

Contractual necessity — to provide the Service you have asked for.
Legitimate interests — to operate, secure, and improve the Service, and to communicate with you about it, balanced against your rights.
Consent — for marketing emails and non-essential cookies, where applicable.
Legal obligation — to comply with laws that apply to us.

You have the right to lodge a complaint with your local supervisory authority.

When we transfer personal data out of the EEA, UK, or Switzerland to the United States or other countries, we rely on appropriate safeguards (such as Standard Contractual Clauses) where required.

8.2 California residents (CCPA / CPRA)

If you are a California resident:

You may request that we disclose the categories and specific pieces of personal information we have collected about you.
You may request that we delete personal information we have collected from you.
You may request to correct inaccurate personal information.
You may opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising. Char does not sell or share personal information for cross-context behavioral advertising.
You have the right not to receive discriminatory treatment for exercising any of these rights.

We honor Global Privacy Control (GPC) signals on our website as a request to opt out of non-essential tracking.

9. Security

We use industry-standard technical and organizational measures to protect your information, including:

TLS encryption in transit.
Encryption at rest for cloud-stored Customer Content.
Role-based access controls and the principle of least privilege for our team.
Regular review of subprocessors and access patterns.
Error monitoring and security incident response procedures.

No method of transmission or storage is perfectly secure. If we become aware of a security incident that affects your information, we will notify you as required by applicable law.

10. International transfers

Our Service is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. and other countries where our subprocessors operate. By using the Service, you understand that your information will be processed in countries that may have different data protection laws than your own. Where required, we use Standard Contractual Clauses or other valid transfer mechanisms.