5 things cloud notetakers do with your meeting audio

Hit record on a cloud notetaker and the interesting part starts after the meeting ends — when your audio leaves your machine. None of the five things below are secret; every one is documented on a vendor page or in public reporting. We make QuickSpeak, a tool whose answer to all five is "nothing, because nothing is uploaded," and we've linked our comparisons throughout — but the point of this list is the questions, not our product.

1. It trains their models

The biggest split in the category, and the one pricing pages never mention. Otter's privacy page says it uses "a proprietary method to de-identify user data before training our models" — training on customer meetings is the default, and as of our last check the page doesn't document an opt-out toggle. Fathom trains its in-house models on de-identified meeting content by default too, though it documents an opt-out in settings. Fireflies sits at the good end: it contractually prohibits training on customer data, for itself and its vendors. All three statements come from their own pages, linked in our Otter and Fireflies write-ups. The question to ask any vendor: is training default-on or default-off, and where's the switch?

2. It keeps the recording long after the meeting ends

The transcript you see implies a copy that persists. Where it lives, in which region, and on what clock is each vendor's retention policy: Otter's free tier holds only your 25 most recent conversations, tl;dv's free plan ages data out at about three months, Fireflies markets "0-day retention" of your content on its own systems. Some of these are features, not threats — history is the product for team tools. But "deleted" should mean something you can verify, and on a cloud service it's a policy you read rather than a file you remove. Local tools invert this: the recording is a file on your disk, and deleting it is deleting it.

3. It hands your speech to subprocessors

"We don't sell your data" is rarely the relevant promise, because the interesting transfers happen inside the vendor's own pipeline. Granola's security page — admirably specific about this — says real-time transcription runs through third-party providers and notes are written by OpenAI or Anthropic models, even though the raw audio isn't stored. Fathom's privacy policy names its model providers and states they're contractually barred from training on your content. Count the machines your meeting touches before you decide whether you're comfortable: vendor, transcription provider, LLM provider, cloud host. A local pipeline touches one.

4. It widens your legal exposure to include theirs

Once a copy of the recording exists on vendor infrastructure, legal process aimed at the vendor can reach your meeting — and your participants learn about it from the vendor's compliance desk, not from you. This isn't hypothetical: in August 2025 a class action was filed against Otter alleging its bot recorded private meetings without all participants' consent (Otter disputes the claims; the case is ongoing — NPR). Whatever its outcome, the theory illustrates the structure: a third party holds the recording, so a third party carries the obligations and the risk. For calls where that's unacceptable — NDA'd client work, therapy, source-protected journalism — removing the third party is the whole fix.

5. It auto-joins your next calls

The capture side of the deal: connect a calendar, and tools like Fireflies and Otter send a recording bot to every scheduled meeting by default — an opt-out, not an opt-in. Participants see a new name in the list; some organizations block it; sysadmins write angry threads about it. Bloomberg called the phenomenon "the uninvited meeting guest." A bot is also, to be fair, a walking disclosure — everyone can see the call is recorded, which is more than a silent extension ever shows. The point isn't that bots are evil; it's that auto-join means your tool decides when other people get recorded. If that's not what you want, the bot-free field is now seven tools deep.

The five questions this list leaves you with

1. Is my content used for training — and is that the default?
2. How long does the recording live, where, and in which region?
3. Which subprocessors touch my audio, and under what terms?
4. What happens when legal process reaches the vendor?
5. Does the tool join calls on its own, or only when I say so?

Ask them before you adopt, not after. And if any answer bothers you: the alternative architecture exists, it's a speech model running in your browser, and it's how QuickSpeak works — free to record and transcribe, unlimited, with 14 days of full Pro and no card.