Privacy Policy
This policy describes how Zapper (www.zapperapp.in) handles information when you register as a host, connect a Google account to create Google Meet meetings, or participate in voice-to-text transcription. Google sign-in for Meet creation is separate from your Zapper host login.
Information we collect
- Host account: name, email address, password hash, account and subscription status, trial dates, and authentication records needed to manage access.
- Meeting sessions: session identifiers, six-digit PINs, Google Meet links, host association, session status, timestamps and participant connection details needed to operate a session.
- Transcription: microphone or meeting audio transmitted for speech recognition, recognized text, session transcript segments, and finished downloadable transcript PDFs. A participant's Google email may be associated with a transcript when available.
- Google authorization: when a host chooses to connect Google, Zapper stores an encrypted Google OAuth refresh credential, the Google OAuth client association, and connection time in its server-side database. The short-lived authorization flow also temporarily stores verification state.
Google Meet account access — what we request and why
When you choose Create Session and Google authorization is needed, Google presents its own sign-in and consent screens. Zapper requests the Google Meet scope https://www.googleapis.com/auth/meetings.space.created to create a meeting space for that host. Zapper then retrieves the meeting URL and associates it with that host's Zapper session PIN. Future sessions may use that host's saved authorization without asking them to sign in again, until Google requires reconnection.
Zapper uses information obtained through Google APIs only for the user-requested Meet creation feature described here, in line with the Google API Services User Data Policy, including its Limited Use requirements. Zapper does not receive your Google password or two-step verification codes. The current integration does not request access to Gmail messages, Google Drive files, Google Calendar entries, or other Meet meetings in your account. Google access is associated with each Zapper host separately, not shared between hosts.
How we use this information
We use account data to authenticate hosts and administer trials/subscriptions; Google authorization only to create requested Meet rooms; session data to issue and validate PINs; and meeting audio and text to produce live captions, deliver those captions to PIN-connected Zapper participants, and generate stored transcript PDFs. Zapper does not use information obtained through Google APIs for advertising or for training generalized AI models.
When information is shared or processed
Google handles its own account authentication and Google Meet service. Zapper sends host microphone or participant-supplied meeting audio to Deepgram to generate transcription text. Hosting infrastructure providers process or store application data so Zapper can deliver the service. Session participants who redeem a valid PIN can receive session details and captions. An authorized host or administrator can access the session records or transcripts available to their account or role. We do not sell Google user data.
Creating a Google Meet URL does not automatically join the host to Meet or capture other attendees' audio. The browser microphone requires permission and an open Zapper dashboard tab; other participants' speech is processed only when supplied through an active Zapper capture connection.
How we protect sensitive information
We use the following technical measures to reduce the risk of unauthorized access, disclosure, alteration, or loss of information processed through Zapper, including information associated with Google Meet authorization:
- Encrypted data transmission: The production website and API use HTTPS (TLS). Audio and live-caption connections over the public network use secure WebSockets (WSS), and Zapper connects to the Google OAuth/Meet APIs and the transcription provider using encrypted network connections. These measures protect data while it travels between services.
- Encrypted Google authorization credentials: Each host's Google OAuth refresh token is encrypted before it is saved in Zapper's server-side database using AES-256-GCM authenticated encryption with a randomly generated initialization value. The encryption key is derived from a backend-only application secret. Google tokens and the OAuth client secret are not placed in the public website code or exposed to other hosts. Short-lived Google access tokens are used to make the requested Meet API calls and are not saved as persistent database records.
- Password protection: Zapper passwords are not stored in plaintext. They are stored as salted, one-way scrypt hashes for authentication.
- Controlled access: Zapper requires account authentication to access the host portal and saved transcripts. Server-side checks tie Google authorization and meeting records to individual host accounts. Host/admin roles, session-scoped authorization tokens, and PIN redemption rules restrict access to applicable operations and session captions. PINs should be shared only with intended participants.
- Limited Google access: Zapper requests the Google Meet meeting-creation permission only when needed. It does not request Gmail inbox, Google Drive, or Google Calendar access. We do not sell Google user data or use it for targeted advertising or generalized AI-model training.
- Server-side records: Account information, meeting links, transcript text, and transcript PDFs are maintained in the backend database and provided through authenticated application endpoints, not publicly browsable transcript links. The encryption statement above specifically applies to stored Google OAuth refresh credentials; it does not mean every transcript or PDF is individually encrypted at the application level.
Data retention, revocation, and deletion
The service retains a configurable number of recent completed sessions and transcripts. Older completed records may be removed as newer sessions are finalized; this is not a promise that all data is deleted after a fixed number of days. Active sessions are not removed by that history cleanup. Account information and Google connections may remain while the account is active, unless removed following an applicable privacy request or legal obligation.
You can revoke Zapper's Google access from your Google Account's third-party connections. Revocation stops future authorized API access but does not automatically erase existing Zapper sessions or transcript PDFs. To request deletion of your Google connection, stored transcripts, or account data, contact zapperapp.support@gmail.com. We may verify account ownership, and some records may need to be retained when legally required.
Your choices and requests
Google account connection is optional for automatic meeting creation. You can revoke Zapper's Google access at Google Account → Third-party connections. After revocation, Zapper may need to reconnect before creating another meeting. Revoking Google access does not by itself delete saved Zapper transcript records.
To request access to, correction of, or deletion of account information, stored transcript records, or Zapper-held Google authorization data, email zapperapp.support@gmail.com from your registered account email. Specify whether you want Google disconnection, transcript deletion, account deletion, or a copy of your information. We may verify your account ownership before acting. Deletion may be subject to legitimate security, billing, or legal retention obligations.
Meeting consent and third-party services
Hosts must notify meeting participants and obtain any legally required consent before capturing or transcribing speech. Participants should not share confidential material unless they are authorized. Google's own privacy terms govern use of Google Meet and Google sign-in. This policy describes the separate handling of information by Zapper.
Contact and policy updates
For privacy questions, complaints or data requests, contact zapperapp.support@gmail.com. We update this page when our product or data practices materially change and will publish the revised date above.