Minu

Privacy Policy

Effective 14 August 2026 · Version 1.1

Minu records meetings you are physically in, and turns them into notes. Doing that means handling the voices of people who never installed it, so this policy is written for them as much as for you.

The short version: recordings, transcripts and notes are stored on your phone. Audio is sent to a transcription service and deleted the moment the words come back. If you switch backup on, a second copy of the recording is kept on our server so it can come back on a new phone — and it is deleted when you delete the meeting. Your notes and transcripts are encrypted before they ever leave the device. Nothing is sold, nothing is used for advertising, and nothing is used to train anyone's models.

1. Who this covers

Two groups, and the second is the one most policies forget:

You — the person who installed Minu and pressed record.
Everyone else in the room. Their voices are in the recording. They did not install anything, did not agree to this document, and are still data subjects with rights under the Philippine Data Privacy Act. Section 8 is written for them.

2. Recording requires everyone's agreement — this is not optional

Philippine law

Republic Act 4200 makes it a criminal offence to record a private conversation without the authorisation of everyone taking part — and the Supreme Court held in Ramirez v. Court of Appeals (G.R. 93833, 1995) that this applies even to a participant recording their own conversation.

The same section reaches possessing such a recording, replaying it, and furnishing transcriptions of it.

Minu is built around that, structurally rather than as a disclaimer:

The microphone cannot be opened until every person present has been listed and has agreed.
Each person then says their name and agrees aloud, inside the recording, and Minu stamps the moment they did.
If anyone refuses at any point, the recording is deleted rather than stopped.
If the microphone is paused, resuming asks whether the room changed — because agreement given before a gap says nothing about who is in the room after it.

There is no setting that turns this off, and there is no way to reach the microphone that skips it.

3. What Minu holds

What	Where it lives	Why
Audio recordings	Your phone; also on our server if backup is on, until you delete the meeting	The recording itself, and putting it back on a new phone
Transcripts	Your phone; encrypted copy if backup is on	What was said
Notes	Your phone; encrypted copy if backup is on	What you came for
Consent record — names, and the second each person agreed	Your phone; encrypted copy if backup is on	Evidence the recording was lawful. Required by the law above
Your settings, tags and vocabulary list	Your phone	Preferences
Account identifier	Our server, if you sign in	Finding your backup again on a new phone
Minutes used and minutes left	Our server, if you sign in	The free hour, and the monthly allowance
Purchase status	RevenueCat, Apple, Google	To know whether a subscription is active

Signing in, and what an account is

Minu works without an account: recording, consent, your library, editing notes and sending them as text are all local and need no sign-in. Signing in exists to make a backup restorable — the encryption key lives on your phone, so without an account a new phone has no way to find your meetings. It is also where your free hour is remembered, so that reinstalling the app does not hand out another one.

You sign in with Apple or Google, and Minu never receives or stores your email address, your name, or a password. What our server keeps is a one-way cryptographic hash of the identifier your sign-in provider gives us — a string of characters that cannot be turned back into you, and that is the same every time you sign in so your backup can be found again.

Minu does not collect location, contacts, photos, browsing activity, device advertising identifiers, or anything else it does not need. There is no analytics SDK and no advertising SDK in the app.

4. Where recordings go, and who else sees them

To turn speech into notes, audio has to be transcribed, and that happens on a service outside your phone. These are every third party involved:

Service	Receives	For
OpenRouter (routing to a speech-recognition and a language model)	Meeting audio, and the transcript	Transcription, and writing the notes
Minu's own server	Audio, if backup is on; encrypted transcripts, notes and consent records it cannot read	Transcription, and holding your backup
RevenueCat	Purchase receipts, an anonymous install identifier	Checking whether a subscription is active
Apple / Google	Payment details, which Minu never sees	Taking payment
Apple / Google sign-in	They confirm to us that you signed in. We receive an identifier and store only a one-way hash of it — never your email or name	Finding your backup on a new phone

No recording is ever sold, shared with advertisers, or used to train anyone's models. The transcription service processes each request and does not retain the audio for its own purposes.

Minu will disclose a recording to law enforcement only where a Philippine court order or a valid legal process compels it — and note that under RA 4200, a recording made without everyone's agreement is generally inadmissible as evidence in the first place.

5. How long things are kept

You choose, per install, in Settings:

Delete after the notes are written — the audio goes as soon as the transcript exists.
Keep for 30 days — the default.
Keep until I delete it — nothing is removed automatically.

That setting governs the copy on your phone. On our server there are two different copies of a recording, and they are kept for different lengths of time:

The copy sent for transcription is deleted the moment the words come back. It is not kept for tuning, quality review, or anything else. This is true whether or not backup is switched on, because transcription is the reason it was sent.
If backup is on, a second copy is kept for as long as the meeting exists. That is what lets a recording come back on a new phone, so that tapping a note still plays the moment it came from. Deleting the meeting deletes this copy too, on the server as well as on the phone.

Signing out stops this phone sending anything further. It does not remove what has already been backed up — signing in again reaches the same meetings, which is what an account is for. To remove them, delete the meetings or delete the account.

One thing is deliberately never deleted by a retention setting: the short piece of audio in which everyone agreed to be recorded.

That fragment is the proof the recording was lawfully made. Deleting the audio while keeping the transcript would leave you holding exactly the artefact the law names, having destroyed the only evidence that making it was allowed. Deleting the whole meeting removes it too.

6. Encryption — what is true and what is not

Minu is not end-to-end encrypted, and does not claim to be. An app that transcribes speech on a server has to let that server read the audio; anyone claiming otherwise is either transcribing on the device or describing something they do not do.

What is actually true:

Your transcripts and notes are encrypted on your phone with AES-256-GCM, using a key held in the device's secure hardware store, before they are sent anywhere. Our server holds bytes it cannot read.
Audio is encrypted in transit and at rest, but is readable by the transcription service, because that is the only way to transcribe it. The copy sent for transcription is deleted the moment the words come back. The backup copy, if you have switched backup on, is not encrypted with your device key — it has to stay readable to be restored and re-transcribed — so it is protected by the server's own storage encryption and by nothing else. That is the honest limit of this design and we would rather state it than imply otherwise.
The encryption key never leaves your device. A consequence worth knowing: if you lose the phone, the encrypted copies on our server cannot be recovered by us or by anyone else.

7. Deleting things

Every meeting offers three separate deletions, because they are three different decisions:

Delete the recording — the audio goes; your notes and transcript stay.
Delete the transcript — the word-for-word record goes; your notes stay.
Delete the meeting — everything, including the consent record and every copy on our server.

Settings also carries Delete every meeting. Deletion removes files, not database flags, and Minu tells you if a file could not be removed rather than showing a reassuring tick.

Deleting your account

If you signed in, Settings carries Delete account. It removes everything our server holds for you: every meeting, every encrypted transcript and note, your wrapped backup key, and your minutes balance. Meetings on your phone are untouched — deleting them is the separate, equally explicit act above.

One small record is deliberately kept after you delete your account, and we would rather say so than leave it unmentioned.

It is a single date, stored against the one-way hash of your account identifier, recording that this account was once given the free hour. Nothing else — no meeting, no name, no email, no address, nothing that can be read back into a person.

It exists because the account identifier is derived the same way every time, so without it, deleting an account and signing in again would hand out another free hour, indefinitely. If you would like that record removed as well, write to us at the address in section 11 and we will remove it.

8. If you were recorded and did not install Minu

You have rights over a recording of your voice under the Data Privacy Act of 2012 (RA 10173), whether or not you use this app: to be informed, to access, to correct, to object, to have the data erased or blocked, to data portability, and to be indemnified for damages.

Practically, the person who made the recording holds it — it is on their phone, they decided to record, and they decide what happens to it. So ask them first; they can delete it in a few seconds, and the app makes that easy on purpose.

If that does not resolve it, or you cannot reach them, write to the address in section 11 with enough detail to identify the meeting, and we will act on the copies we are able to reach and tell you plainly what we cannot.

You may also complain to the National Privacy Commission — privacy.gov.ph — at any time, without going through us first.

An honest note about roles. The person who pressed record decides what is recorded, why, and who is in the room; on the ordinary reading of RA 10173 that makes them the personal information controller for the meeting, and Minu the processor acting on their instructions. Minu does not treat that as a way of avoiding responsibility — the section above stands regardless.

9. Children

Minu is built for working adults and is not directed at children. It is not knowingly made available to anyone under 18, and no age is collected — signing in with Apple or Google tells Minu nothing about it. If a recording of a child has been made through Minu and you are their parent or guardian, write to us and it will be removed from everything we can reach.

10. Changes to this policy

If this changes in a way that affects what happens to a recording, the new version will be published here with a new effective date, and the app will say so before the change applies to anything new. Older versions remain in the public repository's history.

11. Contact

Minu is built and operated by Jheremiah Figueroa, an individual developer in the Philippines.

For anything in this policy — access, correction, deletion, or a question about a recording you appear in:

figueroa.jheremiah@gmail.com

Requests are answered within 15 working days, which is the period the National Privacy Commission expects.