Pavo / legal
Privacy Policy
Last updated: 2026-11-03
This policy explains what the Pavo desktop app and the heypavo.com website do with your information. Pavo is built to be offline capable: dictation and meeting transcription can run on your computer using local models. Some features, listed below, send data over the internet, and this page says which ones and when.
Pavo is operated by Cedarwoods Labs LLC.
Questions or requests: support@heypavo.com.
1. What stays on your computer
Pavo keeps its working data in the app’s user-data folder on your computer:
- Your notes, folders, dictation history, custom dictionary, tasks, and a cached copy of calendar events you connected.
- Meeting recordings and transcripts, speaker voice profiles used to label who spoke, and AI chat history with your notes.
- Downloaded speech and language models.
- Google Calendar sign-in tokens and any provider API keys you enter. These are encrypted with your operating system’s secure storage (macOS Keychain, Windows DPAPI, or the Linux keyring). If a system has no secure storage available (for example some Linux setups), they are stored without that encryption.
- Interface preferences, such as theme and language, kept in the app’s local storage.
- Crash reports. Pavo writes crash dumps to a folder on your computer and does not upload them to anyone.
By default, dictation is transcribed on your computer. None of the data above is sent anywhere unless you use one of the features in section 2.
2. What leaves your computer, and when
| Feature | What is sent | To whom | When |
|---|---|---|---|
| Signing in | Your email address, to receive a sign-in link | Pavo (auth.heypavo.com) | Only if you choose to create an account or sign in. You can continue without an account. |
| Cloud transcription | The audio being transcribed | Pavo’s servers (api.heypavo.com), or the provider you configured with your own API key (for example OpenAI, Groq, Mistral, AssemblyAI, Deepgram) | Only if you select a cloud transcription option in Settings. |
| Text cleanup, meeting notes, and AI features | The text, prompts, and context for the request | Pavo’s servers (api.heypavo.com), or a provider you configured with your own key | Only when the model you selected is a cloud model. Local models run on your computer. |
| Ask Pavo and the cloud agent | Your messages, system prompt, tool calls and, for web search, the search query | Pavo’s servers (api.heypavo.com) | When you use these features while signed in. |
| Cloud backup and sync | Notes, folders, dictation history, and AI conversations | Your Pavo account on api.heypavo.com | Off by default. Runs only if you are signed in, turn on cloud backup, and have a plan that includes it. Meeting audio is not part of this sync. |
| Google Calendar | Google sign-in; your calendar list and events (read and write) | Google, and a local cache on your computer | Only if you connect a Google account. Requested access: your email, calendar events, and your calendar list. You can remove Pavo’s access at any time from your Google Account settings. |
| Booking links | Your availability and the booking details a visitor submits | Pavo’s booking service (book.heypavo.com) | Only if you use booking links. |
| Usage and referrals | Account usage counts and referral invitations | Pavo’s servers | When you are signed in and open those screens or send an invite. |
| Model downloads | A normal download request, which reveals your IP address | Hugging Face and GitHub | When you download a speech, speaker, or language model. |
| Update checks | A normal request for the latest version, which reveals your IP address | Pavo’s release feed, hosted on GitHub | Periodically while the app runs. |
Pavo’s servers may keep the content they receive in order to provide the feature, for as long as your account exists. When you delete your account (section 5), the app asks Pavo’s servers to delete your account and cloud data. Providers you connect with your own API key handle your data under their own terms and privacy policies.
We do not sell your personal data.
3. Google user data
If you connect Google Calendar, Pavo requests the scopes openid, email, calendar.events, and calendar.calendarlist.readonly. Pavo uses this information only to show your calendar, link meetings to calendar events, schedule tasks and booking links, and write events you ask it to write. It is not used for advertising.
4. Payments
Paid plans are not open yet. When they open, payments will be processed by Stripe. Card details are entered on Stripe’s pages, not inside the Pavo app.
5. Your choices
- Use Pavo offline. Do not sign in, do not connect Google, and choose local models. Pavo keeps working.
- Turn off cloud backup in Settings. Turning it off stops new uploads; it does not by itself delete what is already in your account.
- Delete your account. Settings has a Delete account action that asks Pavo’s servers to delete your account and cloud data.
- Delete local data. Settings has a reset action for local data. You can also delete the app’s user-data folder.
- Disconnect Google. Disconnect in Pavo, or remove Pavo’s access from your Google Account.
- Team waitlist. If you enter your email for the Team plan waitlist, it is saved on your computer only. Nothing is sent until a waitlist service exists, and this page will be updated before that happens.
For any request about your data, write to support@heypavo.com.
6. Analytics and diagnostics
The Pavo app does not currently include analytics or remote crash reporting, and sends no usage analytics about what you do in the app. If we add analytics or crash reporting in a future version, we will update this page before it is switched on and describe what is collected.
7. This website
heypavo.com does not set cookies of its own and does not use analytics. It stores your light or dark theme choice in your browser’s local storage. The pages load fonts from Google Fonts, so Google receives your IP address when a page loads. Our hosting provider (Vercel) keeps standard server logs.
8. Children
Pavo is not directed at children.
9. Security
Tokens and API keys are encrypted at rest with your operating system’s secure storage where available. No method of storage or transmission is perfectly secure.
10. Changes
We will change this page when Pavo’s data practices change and update the date at the top. If a change is significant, we will say so in the app or in release notes.