SECURITY
The point of a shared record is that neither of you can quietly change it.
Everything below is enforced in the database, not promised in an interface. Where something is not yet true, it says so.
Read the consent guideWHAT IS GUARANTEED
The log is append-only
Every action — a recording started, a summary generated, an appointment removed — is written to a hash-chained log. Entries cannot be edited or deleted, and each one carries the fingerprint of the one before it, so a gap is visible.
The transcript cannot be rewritten
Lines are insert-only at the database level, enforced by a trigger rather than by the app being well behaved. Nobody — including us — edits a line after it lands.
Nothing can be removed quietly
On a record held by two people, removing an appointment does not destroy it. It leaves the lists, keeps a permanent entry naming who did it, notifies everyone else, and can be put back by any of them.
The record itself cannot be destroyed by one person
A single account holder cannot delete a record that two people share. That one is a flat refusal, not a disclosure — because there is nothing left to disclose it to.
Access is scoped in the database
Row-level security decides what you can see, not a filter in application code. A missing check in a page cannot leak someone else's record, because the page never had it.
Sign in with your face or fingerprint
Passkeys, so there is no password to reuse, phish, or find written down. Tied to the device you set it up on.
The guarantee is not that nothing can be removed. It is that nothing can be removed quietly.
CONSENT
We close the door in the states that ask us to.
Fourteen states require every person in a conversation to agree before it is recorded. In those states the app does not record — it asks which state you are in before your first appointment, and if the answer is one of them it offers shared notes instead. Everywhere else, the app still hands you a sentence to say out loud, because a recording nobody was told about is not one we want to have made.
That list is the conservative reading of the law and it deliberately over-blocks. The consent guide explains it state by state.
HONESTLY
What we do not claim.
This is a private beta and it is not yet for sensitive records. That line is on the front page for a reason. If disclosure of a particular appointment would be seriously harmful to you, wait.
We are not a HIPAA covered entity. You are recording your own appointment, which is a thing you are generally entitled to do; we hold the result for you. That is a different legal posture from a hospital's, and it is not a weaker promise dressed up — it is a different promise, and you should know which one you are getting.
We have not been independently audited. The protections above are real and you are welcome to test them, but no third party has yet signed their name under that sentence.
Transcription is imperfect, and the summary is a convenience. The transcript is the record. Where the model is unsure it is built to say so rather than to guess, but the word-for-word text is what you should rely on, and it is one tap from every summary.
FOUND SOMETHING?
Tell us before you tell anyone else.
Write to masonhenry1@gmail.com. We will not threaten you, and we will credit you if you want to be credited.