Avocet

Privacy policy

What avocet.dev collects, why, who helps us run it, and what you can ask us to do.

Last updated:

This policy covers the avocet.dev website and its waitlist. It also explains what the Avocet app sends over the network, because the short answer is: very little, and never your meetings.

Who we are

Avocet is made by Chris Gmyr, a sole proprietor in North Carolina, USA. In this policy, "we", "us" and "our" mean Chris Gmyr, trading as Avocet. We decide how the personal data described here is used, so under the GDPR we are its controller.

You can reach us about anything in this policy at [email protected].

What the waitlist collects

The waitlist form asks for your email address and nothing else. When you submit it, we store:

  • your email address;
  • which form you used, the one at the top of the page or the one at the bottom;
  • the version of the consent text shown with the form;
  • a keyed hash of your IP address, used to limit repeated signups from one address (we store the hash, not the IP address);
  • when you signed up, when we sent you a confirmation email, and when you confirmed;
  • the ID our email provider gives your contact record.

The form also has a hidden field that catches bots. Anything typed into it is thrown away.

We may send you one email asking you to confirm your address. The link in it works for 7 days. Only after you confirm do we add your address to our mailing list at Resend, our email provider. We use your address only to email you about Avocet, and every email we send from that list has an unsubscribe link.

What every visit shares

When you load a page, our hosting and network providers receive your IP address, your browser type and the page you asked for. That is how a website reaches you.

The site keeps a short session, for up to 2 hours, so its forms can guard against cross-site request forgery. Our server may store your IP address and browser type with that session. A counter of recent signup attempts, keyed by the hashed IP address, lasts one minute.

We use Laravel Nightwatch to see how the site performs and to catch errors. It receives the page address, your browser type, timings and error details. We remove your IP address, and the request headers that carry it, from what it records about each page load. We mask email addresses in the error reports it records. A normal signup, including a repeat or double submit, does not produce an error that contains your email address.

The site runs no analytics, advertising or tracking scripts, and we do not build profiles of visitors.

Cookies

The site sets these cookies:

  • XSRF-TOKEN, set by avocet.dev: protects forms against cross-site request forgery. Lasts 2 hours.
  • avocet-session, set by avocet.dev: keeps your session so the waitlist form works. Lasts 2 hours.
  • __cf_bm, set by Cloudflare: tells people from bots to protect the site. Lasts 30 minutes.
  • _cfuvid, set by Cloudflare on some responses: helps Cloudflare apply rate limits fairly to visitors who share an IP address. Deleted when you close your browser.

All four are strictly necessary for the site to work and stay secure, so we do not ask for consent to them. We set no analytics or advertising cookies. You can block cookies in your browser, but the waitlist form may then stop working.

The Avocet app

Avocet records, transcribes and matches speakers on your Mac. Your audio and transcripts never leave your Mac, and we never receive them.

The app contacts a server only in these cases:

  • Model downloads. It downloads its transcription and speaker models during setup, and again only if you verify or re-download them in Settings.
  • Update checks. When automatic update checks are on, which is the default, the app asks updates.avocet.dev whether a newer version exists. You can turn this off in Settings > About, and use Check now to check yourself. A check reveals your IP address to the server that answers it. The app uses your current version and Mac architecture on your Mac to choose an update. Meeting audio and transcripts are not sent.

Who helps us run the site

These providers process personal data for us:

  • Laravel Cloud hosts the website and its database, in the United States.
  • Resend sends our emails and holds our mailing list.
  • Laravel Nightwatch monitors the site's performance and errors, as described above.
  • Cloudflare runs our DNS, sits in front of avocet.dev to protect it, and serves updates.avocet.dev.
  • Google Workspace hosts the [email protected] inbox, so it holds any email you send us.

We do not sell your personal information or share it for cross-context behavioral advertising, as California law defines those terms.

International transfers

Our providers are US companies, and our site database is in the United States. If you are in the EU, the UK or Switzerland, your data is transferred to the United States. Where the GDPR applies, those transfers rely on the safeguards in our providers' data processing terms.

  • The waitlist: your consent, which you give by submitting the form and confirming your address. You can withdraw it at any time by unsubscribing or emailing us.
  • Sessions, cookies, rate limits and monitoring: our legitimate interest in keeping the site working and secure.
  • Emails you send us: our legitimate interest in replying to you.

How long we keep data

  • Waitlist entries, confirmed or not, stay until you ask us to delete them. We do not delete them automatically yet. If you unsubscribe, Resend stops sending you our emails. Your address stays in our database until you ask us to delete it.
  • Sessions last up to 2 hours. The signup rate-limit counter lasts one minute.
  • Monitoring data stays in Nightwatch for the retention period of our Nightwatch plan.
  • Emails you send us stay in our inbox until we delete them.

Your rights

Wherever you live, you can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email [email protected], ideally from the address the request is about. We may ask you to confirm that the request comes from you. We reply within one month.

If you are in the EU or the UK

Under the GDPR and the UK GDPR, you have the right to access your data, to correct it, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw your consent at any time. You also have the right to complain to your local data protection authority.

If you are in California

Under the CCPA, as amended by the CPRA, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share it, so there is nothing to opt out of. We do not collect sensitive personal information. We will not treat you differently for using any of these rights. You can use an authorized agent to make a request for you.

In the past 12 months we collected identifiers (your email address and IP address) and internet activity (the pages you requested and your browser type), from you and your browser, for the purposes described above. We disclosed them only to the providers listed above, to run the site.

Children

This site is not aimed at children under 16, and we do not knowingly collect their data. If you think a child has joined the waitlist, email us and we will delete the entry.

Changes to this policy

When we change this policy, we update the date at the top of this page.

Contact

Chris Gmyr, trading as Avocet, North Carolina, USA. Email [email protected].