Your meetings stay yours.

Contents

• Who we are
• The app
• Google Calendar and Google user data
• This website
• Sharing and third parties
• Security
• Retention
• Your rights
• Children
• Changes

Who we are

Acorn is a local meeting-notes app for Mac, made by RepEdge (“we”, “us”). Built on Anarlog (MIT). This policy covers the Acorn app and useacorn.app.

Privacy questions, access requests, and deletion requests: hello@useacorn.app.

The app

You can download and use Acorn without creating an account with us. Notes, transcripts, and recordings are stored on your machine. Meeting audio is not sent to Acorn or RepEdge in order to take notes.

Acorn may ask macOS for microphone, system audio, and accessibility so it can capture the meeting from your computer without joining it. Some features may also ask for Calendar, Contacts, or local network access through Apple’s permission prompts. Those macOS permissions are granted to the app on your Mac, not to our servers.

If you connect an AI provider with your own keys, the content you choose to send goes to that provider under your agreement with them. We do not receive those keys. We do not use your meeting audio, notes, or Google user data to train our own models.

Acorn periodically checks a public update feed to see if a newer version is available. That check does not include your notes, recordings, or Google Calendar data.

Connecting Google Calendar is optional. Acorn works without it. When you do connect, the practices in Google Calendar and Google user data apply.

Google Calendar and Google user data

If you choose to connect Google Calendar, Acorn uses Google’s OAuth 2.0 flow so you can authorize the app to read your Google Calendar. Authorization happens between you, Google, and the app on your Mac. We request only the narrowest Google Calendar scopes needed to show your meetings and attach notes to them.

What Google user data is accessed by Acorn

When you connect Google Calendar, Acorn accesses the following Google user data from the Google Calendar API and related Google identity APIs, as authorized by you:

• Basic Google account identifiers needed to show which account is connected, including your Google account email address and display name.
• Your calendar list: calendar names, identifiers, time zone, and whether a calendar is selected or primary.
• Calendar event data: event titles, descriptions, start and end times, locations, conference links (such as Google Meet URLs), organizer, attendee names and email addresses, response status, recurrence, and related event identifiers.
• OAuth access and refresh tokens that prove the app is allowed to call Google on your behalf. These tokens are stored on your Mac. We never receive your Google password.

Acorn does not access Gmail, Google Drive, Google Docs, Google Contacts via Google APIs, or other Google products unless you separately grant that access. Connecting Calendar does not grant us those scopes.

Calendar events can include sensitive information (for example medical, family, or employment appointments). Acorn treats Google Calendar contents as sensitive user data.

How Acorn uses Google user data

Acorn uses Google user data only to provide and improve the user-facing Calendar features in the app, specifically to:

• Show upcoming and recent meetings in Acorn.
• Match a live capture or note to the right calendar event (title, time, attendees, and meeting link).
• Pre-fill meeting titles and participant names on notes stored on your Mac.
• Keep the connected-account label accurate and refresh Calendar data while the connection remains authorized.

Acorn does not use Google user data for advertising, retargeting, analytics products, credit decisions, or sale. Acorn does not use Google user data to train generalized artificial intelligence or machine learning models. If you later send a note that includes calendar-derived details (such as a meeting title) to an AI provider you connected with your own keys, that send is initiated by you and is governed by that provider’s terms.

Acorn’s use of Google user data is limited to the practices in this policy. If that ever changes, we will update this policy and ask you to consent before using Google user data in a new way.

Sharing, transfer, or disclosure of Google user data

RepEdge does not receive your Google Calendar contents or Google OAuth tokens on its servers. Google user data is requested by the app on your Mac and stored there.

Acorn does not sell Google user data. We do not share, transfer, or disclose Google user data to advertising platforms, data brokers, information resellers, or other third parties for their own purposes.

We share, transfer, or disclose Google user data only:

• To Google, as required to operate the Calendar connection (token refresh and API requests you authorized).
• To an AI provider you connect with your own keys, and only when you choose to send content that may include calendar-derived details. We do not send Google user data to an AI provider in the background.
• If required by law, legal process, or to prevent harm, to the limited extent we actually hold the data (for example, an email you send us — not your Calendar contents, which we do not host).
• As part of a merger, acquisition, or sale of assets, and only with your explicit prior consent before Google user data would transfer.

RepEdge employees do not read your Google Calendar data. Humans are not allowed to access Google user data except with your affirmative agreement for a specific support case, to investigate security or abuse, to comply with law, or in aggregated form that cannot identify you.

Data protection mechanisms for sensitive data

Google Calendar data can be sensitive. Acorn protects it with the following data protection mechanisms:

• Least privilege. The app requests only Calendar scopes needed for the features above, not broader Google Workspace access.
• No password handling. Sign-in uses Google OAuth 2.0. Acorn never sees or stores your Google password.
• Encryption in transit. Calls to Google APIs use HTTPS / TLS.
• Local storage and encryption at rest. Calendar data and OAuth tokens stay on your Mac. Tokens are stored with the operating system’s protected storage (such as Keychain), not in our cloud.
• No Acorn cloud copy. We do not upload Google user data to RepEdge servers to provide Calendar features.
• Device access controls. Access is limited to the Acorn process on your signed-in Mac. We do not operate a multi-tenant Calendar database.
• Revocation. You can disconnect Google Calendar in Acorn and revoke access in your Google Account at any time.

You are also responsible for the security of your Mac (passcode, FileVault, and who can use the device), because that is where Calendar data and notes live.

Retention and deletion of Google user data

Acorn retains Google user data only while your Google Calendar connection is active, and only on your device:

• Cached calendar and event data is kept locally so the app can show meetings and match notes, then refreshed from Google while you remain connected.
• OAuth tokens are kept on your Mac until you disconnect, they expire, or you revoke access with Google.
• Notes you wrote in Acorn are yours and remain on your Mac even if they were titled from a calendar event. Deleting the Google connection does not delete your notes unless you delete those notes yourself.

To delete Google user data from Acorn:

• Disconnect Google Calendar in the app. Acorn then deletes locally stored Google Calendar data and OAuth tokens associated with that connection.
• Revoke Acorn in your Google Account under Third-party access. Google will stop issuing new access; disconnecting in the app still removes the local copy.
• Delete Acorn’s local data or uninstall the app to remove remaining on-device copies.
• Email hello@useacorn.app if you need confirmation of deletion. We cannot delete Calendar data we never received on our servers; we can help you remove the local connection and confirm we do not hold a cloud copy.

Google retains your underlying Calendar data according to Google’s privacy policy. Deleting the Acorn connection does not delete events from Google Calendar itself.

Limited Use of Google user data

That means, among other things:

• Google user data is used only to provide or improve prominent, user-facing Calendar features in Acorn.
• We do not transfer Google user data except to operate those features with your consent, for security, to comply with law, or as part of a corporate transaction with your prior consent.
• We do not sell Google user data, use it for ads, or use it to determine creditworthiness.
• Humans at RepEdge do not read your Google user data except in the limited cases Google’s Limited Use rules allow.

This website

useacorn.app is a static download site. It does not sign you in or collect meeting data, notes, or Google user data.

The host may keep ordinary request logs, such as IP address, browser type, date and time, referring URL, and the pages requested. We use that information to operate, secure, and debug the site — not to profile you for advertising.

If you email us, we keep that correspondence so we can reply and keep a record of the request. We do not use it for marketing.

Cookies, tracking, and sale of data

This website uses Google Analytics (measurement ID G-LSD42JDDEJ) to understand how people use useacorn.app: pages viewed, approximate location, device and browser, and how visitors arrive. Google Analytics sets cookies and may receive your IP address. We use that information to operate and improve the site. This website does not set advertising cookies and does not use advertising or social pixels. We do not sell or share personal information as those terms are used in the California Consumer Privacy Act (CCPA) as amended by the CPRA, and we do not engage in cross-context behavioral advertising. Because we do not sell or share, there is no “Do Not Sell or Share” opt-out to process; we also honor Global Privacy Control (GPC) signals by not selling or sharing in the first place.

Sharing and third parties

Besides the Google practices above, we use:

• Website hosting and content delivery for useacorn.app, which may process request logs as described.
• Google Analytics, to measure visits to this website as described above. That does not include your notes or Google Calendar data.
• Email, to receive and respond to messages you send us.
• Apple notarization and software-update infrastructure as needed to ship the Mac app. That does not include your notes or Google Calendar data.
• AI providers you choose, only with keys you supply and content you elect to send.

We do not sell personal information. We do not share it for cross-context behavioral advertising.

Security

We take reasonable technical and organizational measures appropriate to a local-first app: TLS for network traffic we control, protected on-device storage for secrets, least-privilege permissions, and no Acorn account database of meeting or Calendar contents. No method of transmission or storage is perfectly secure. If we become aware of a breach affecting personal information we hold, we will notify you and regulators as required by law.

How long we keep information

We keep as little as we can, for as short as we can:

• On your Mac: notes, transcripts, recordings, and connected Calendar data until you delete them, disconnect the source, or remove the app.
• Website logs: typically up to 90 days, unless we need a record longer to investigate security or abuse.
• Email you send us: for as long as needed to handle your request, then a reasonable archive period (generally up to 24 months) unless a longer period is required by law.
• Google user data: only on your device while connected, as described in retention and deletion of Google user data.

Legal bases (EEA, UK, and similar laws)

Where a legal basis is required, we rely on:

• Consent — connecting Google Calendar, granting macOS permissions, and sending content to an AI provider.
• Contract — providing the app and site you asked to use, including downloads and support.
• Legitimate interests — operating a secure website, answering email, and checking for app updates, in ways that do not override your rights.
• Legal obligation — when the law requires us to keep or disclose information.

We do not require special-category data. Calendar events may incidentally include it. We do not use that data except as part of showing the event you authorized the app to read, on your device.

We do not make solely automated decisions that produce legal or similarly significant effects about you.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export personal information; to restrict or object to processing; to withdraw consent; and to lodge a complaint with a data protection authority. California residents also have rights to know, delete, correct, and to opt out of sale or sharing of personal information, and to limit use of sensitive personal information. We do not sell or share personal information, and we use sensitive information (including Google Calendar contents on your device) only to provide the features you requested.

Because Acorn does not create an account and does not host your notes or Google Calendar data, most of those rights are exercised on your Mac: open, edit, or delete notes; disconnect Calendar; uninstall the app. For information we do hold (such as email you sent us), write to hello@useacorn.app. We will not discriminate against you for exercising your rights. We may need to verify the request. You may use an authorized agent where the law allows.

EEA and UK users may complain to their local supervisory authority (for example the ICO in the UK). Canadian users may contact us for access and correction under PIPEDA.

International transfers

Meeting and Google Calendar data used in the app are processed on your device. This website and email may be processed in the United States or wherever our host and mail provider operate. Where required, we rely on contractual protections and the fact that you are contacting a US-based team.

Children

Acorn is not directed at children, and we do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK). We do not use Google Sign-In or Google APIs in a child-directed product. If you believe a child has provided us information, email hello@useacorn.app and we will delete what we hold.

Changes

We will update this page when our practices change, including if Acorn begins using Google user data in a new way. The “Last updated” date below is the effective date. For material changes to Google user data practices, we will prompt you to review the update before those new uses apply.

Questions: hello@useacorn.app.

Last updated September 27, 2026.