Hedy Privacy Settings Explained: From Maximum Security to Full Features

Most AI meeting tools ask you to trust them with your conversations. Hedy takes a different approach: you decide exactly how much data leaves your device.

This guide walks through every privacy-relevant setting in Hedy, explains what each one does, and helps you choose the right configuration for your situation—whether you’re handling sensitive client conversations or just want the full AI coaching experience. For organizations with formal compliance requirements, see Hedy’s GDPR compliance framework, our GDPR checklist for AI meeting tools, and the EU data residency options.

Why Privacy-Conscious Professionals Choose Hedy

Unlike cloud-first transcription tools, Hedy starts with local speech recognition and lets you control which additional features you enable. While most AI meeting assistants require your audio to leave your device for transcription, Hedy’s on-device speech recognition means your conversation audio stays private by default.

When you do use AI features like summaries and coaching, your data is processed transiently—used to generate your insights, then discarded. No storage, no training, no retention.

Hedy’s Privacy-First Architecture

Hedy is built on a foundation of local-first processing. Here’s what that means:

• Speech recognition runs locally on your device. Using on-device AI models, your audio is transcribed without leaving your phone or computer.
• Audio recordings are off by default. You can enable recording for specific sessions, but it’s not automatic.
• No AI training on your data. Your conversations are never used to train AI models unless you explicitly opt into a feature that requires such processing.

Some AI features are enabled by default to give new users the full Hedy experience:

• Automatic Suggestions (Live AI Coaching) is set to “Selective” mode by default, meaning Hedy will provide periodic insights during your conversations.
• AI-generated summaries are available after sessions.

If you want maximum privacy, you’ll need to adjust a few settings. This guide shows you exactly what to change and why.

Important note for web users: The web version at web.hedy.ai always requires cloud sync since there’s no local storage available in browsers. For local storage, use the native iOS, Android, macOS, or Windows apps. To also run AI analysis on-device, enable Local AI Processing, which is available on Apple Silicon Macs, Windows PCs with a capable GPU, iPhone 15 Pro and later, and M-series or A17 Pro iPads.

Understanding Each Privacy Setting

Session Audio Recording

Default: Off

This setting saves the actual audio from your conversations.

What it does: Stores a complete audio file of your session on your device. You can enable this per-session or set it as your default.

Privacy considerations: Audio recordings contain voice biometrics—unique identifiers that can identify individuals. Under GDPR, this qualifies as sensitive personal data (Article 9). These recordings are stored locally on your device and never reach Hedy’s servers, and no share ever includes them. On Apple devices, Settings → Sessions → Save Session Audio also has a Sync Recordings to iCloud switch. It is off by default, and when you turn it on, recordings are copied to your own iCloud account, not to Hedy.

When to enable: When you need to verify transcripts against original audio, or when regulations require you to retain recordings.

When to keep off: Client conversations involving confidential information, healthcare discussions, any situation where participants haven’t explicitly consented to recording.

Cloud Synchronization

Default: Off on native apps, Always On for web

This setting syncs your sessions across devices.

What it does: Uploads your transcripts, summaries, and session data to secure cloud servers. This allows you to start a session on your phone and review it on your desktop.

Privacy considerations: Your data is stored on servers protected by AES-256 encryption at rest and TLS 1.3 for data in transit. Our cloud infrastructure is certified under the EU-US Data Privacy Framework, providing legal protections for EU residents.

Platform note: On the web version (web.hedy.ai), cloud sync is always enabled because browsers don’t provide persistent local storage. If you require fully local operation, use the native mobile or desktop apps.

When to enable: When you regularly switch between devices, work with a team, or want backup protection for your session data.

When to keep off: If you’re a professional bound by strict confidentiality requirements (attorneys, financial advisors), or if your organization prohibits cloud storage outside the EU and your account is in the US region.

Automatic Suggestions (Live AI Coaching)

Default: On (Selective mode)

This setting enables real-time AI insights during your conversations.

What it does: Sends portions of your conversation to AI services for analysis, which then return suggestions, questions, and insights. In Selective mode, suggestions appear periodically when Hedy identifies high-value moments.

Privacy considerations: In the default cloud mode, transcript content is processed in memory by our AI partners, never stored, and never used for training. With Local AI Processing enabled on capable hardware, this analysis runs on your device instead.

Frequency options:

• Off: No live coaching, no data sent during sessions
• Selective: Periodic suggestions at key moments (default)
• Balanced: More frequent suggestions
• Frequent: Maximum coaching intensity

When to enable: When you want Hedy’s coaching capabilities—smart follow-up questions, strategic suggestions, real-time guidance.

When to disable: Conversations involving highly classified information, trade secrets, or situations where any external data transmission is prohibited.

To disable: Go to Meeting Settings and set Suggestion Frequency to “Off.”

AI Processing (Summaries, Notes, Chat, and Suggestions)

Default: Cloud AI

This setting decides where the AI step runs. Find it under Settings → Speech & AI → AI Processing.

What it does: Turns your transcript into summaries, key points, action items, detailed notes, chat answers, and live suggestions. Speech recognition is a separate setting, so nothing here changes how your audio is transcribed. You have up to four options:

• Cloud AI: Relevant session text is processed in memory by Hedy’s AI partners, never stored by them, and never used for training. Requests go through your Hedy data region. For EU accounts, that processing runs on Inceptron, an inference provider in Lund, Sweden, whose contract with us limits processing to the EU and EEA. If Inceptron is unavailable, Hedy falls back to Google Vertex AI in an EU region.
• Local AI: The whole analysis runs on your own device, even offline, after you download a model. Available on Apple Silicon Macs, Windows PCs with a capable GPU, iPhone 15 Pro and later, and M-series or A17 Pro iPads. See Local AI Processing.
• Apple Private Cloud Compute: On an eligible iPhone or iPad running iOS 27 with Apple Intelligence turned on, Hedy 3.11 and later can send the AI step to Apple Private Cloud Compute instead of Hedy’s partners. It runs under your Apple account and Apple’s daily limit. Apple does not commit to a region for it, so it does not keep processing inside your Hedy data region. If it is unavailable or you hit the limit, Hedy tells you and stays on your setting. It never switches you to another provider on its own. It is not offered on Mac, Windows, Android, or the web app.
• Off: Transcription keeps working, and no AI analysis happens at all.

Privacy considerations: With Cloud AI and Apple Private Cloud Compute, session text leaves your device for the duration of the request. With Local AI or Off, it does not. Whatever Hedy generates is stored according to your cloud sync settings (locally or in the cloud).

When to choose Local AI or Off: Confidential client work, or any policy that prohibits sending conversation content to an external AI service. If your requirement is EU data residency, choose Cloud AI with the EU region, or Local AI. Apple Private Cloud Compute will not meet it.

For a side-by-side comparison, see AI Processing: Cloud AI, Local AI or Off.

Summary via Email

Default: Off

This setting emails your meeting summary automatically.

What it does: Sends your AI-generated summary to your email address (and optionally to other recipients) when a session ends.

Privacy considerations: Email travels through multiple servers and may be stored by email providers according to their retention policies. Consider whether the summary contents are appropriate for email delivery.

When to enable: For routine meetings where you want immediate access to summaries, or when you need to share summaries with team members quickly.

When to keep off: Sessions involving personal data, health information, financial details, or any content you’d prefer to keep out of email archives.

Tip: You can generate summaries in-app without enabling email delivery, then share them manually when appropriate.

External Speech Recognition (Cloud Transcription)

Default: Off (local transcription via on-device model)

This setting uses cloud services for transcription instead of on-device processing.

What it does: Sends your audio to cloud services for transcription. This can provide higher accuracy, especially for non-English languages or specialized terminology.

Privacy considerations: Your audio is processed by the selected provider according to their data handling practices. You can bring your own API keys to route through your existing enterprise agreements.

When to enable: When you need maximum transcription accuracy, or work primarily in languages where on-device recognition struggles.

When to keep off: When local processing meets your accuracy needs, or when audio transmission is prohibited by your organization or professional obligations.

Note: The web version cannot perform local transcription, so cloud transcription is required for web users.

Speaker Names

Requires: the on-device Nemotron speech engine

Hedy can now label who said what, and put real names on speakers when the conversation gives it something to go on, such as an introduction or someone being addressed by name.

What it does: Nemotron separates the voices as it captures, on your device. Hedy then matches names to voices using the conversation itself, your calendar invite, and any Topic context. If the evidence isn’t there, the speaker stays numbered. You can rename any speaker with a tap, and a name you set is never overwritten.

Privacy considerations: Voice separation doesn’t need a cloud speech service. On supported iPhones and Apple Silicon Macs, Hedy 3.12 also runs NVIDIA’s Nemotron 3 Diarization model after a session ends to re-check who said what, and that pass runs on the device as well, with no audio sent anywhere. Names end up in the transcript, recap, notes, and to-dos, and in anything you share, so check them before you send a transcript to someone.

How to enable: Choose Nemotron under Settings → Speech & AI. Whisper is still the default, and sessions captured with Whisper or a cloud speech provider have no speaker turns.

Session Sharing

Requires: Pro subscription

This setting lets you share sessions with others. You don’t need Cloud Sync switched on: Hedy uploads only the session you are sharing, and asks you first.

What it does: Offers three ways to share. An email invitation goes to a named person, who signs in to Hedy to read it (a free account is enough). An invite link is single-use and also requires signing in. A public link publishes one session as a web page anyone with the address can open, no account needed. You choose which sections appear (recap, detailed notes, to-dos, your session notes, transcript, chat), set it to expire after 7, 30, or 90 days or never, and can revoke it at any time.

Privacy considerations: Audio is never part of any share. A public link is unlisted, not private: search engines are told not to index it, but anyone who has the address can open it and forward it. For confidential material, send an email invitation so access belongs to a named person who has to sign in. The transcript contains what other people said word for word, so only publish it with their permission.

When to enable: Collaboration with colleagues, sharing meeting notes with clients, sending a recap to someone who doesn’t use Hedy.

When to keep off: Sessions containing information that should remain strictly confidential to you.

API Access and Webhooks

Requires: Pro subscription + Cloud Sync enabled

This setting enables programmatic access to your Hedy data.

What it does: Allows external tools (like Zapier or workflow automation platforms) to access your sessions, summaries, and to-dos. Webhooks can notify external systems when sessions complete or highlights are created.

Privacy considerations: Your Hedy data flows to whatever systems you connect. Webhooks are cryptographically signed so you can verify requests actually came from Hedy.

When to enable: Workflow automation—automatically creating tasks in your project management tool, logging meetings to your CRM, triggering follow-up sequences.

When to keep off: If you haven’t evaluated the security of connected systems, or if your data governance policies restrict automated data flows.

Privacy Configurations for Specific Professions

For Attorneys and Legal Professionals

Client confidentiality is non-negotiable. Hedy’s on-device speech recognition means your conversation audio never leaves your device for transcription. AI features like summaries use cloud analysis by default, where transcript content is processed in memory, never stored, and never used for training. On capable hardware, Local AI Processing keeps that analysis on your device too. With Cloud Sync off, nothing about the conversation goes to our servers unless you explicitly share that session.

For maximum discretion, disable cloud sync to keep transcripts and summaries stored only on your device. Always verify compliance with your bar association’s specific technology guidelines.

For Patients and Caregivers

Medical conversations are sensitive. Hedy is built for patients and caregivers capturing their own appointments, not for clinicians documenting patient sessions. On-device transcription keeps your audio local, and transient AI processing means conversation data isn’t retained by our providers. Hedy has completed an independent HIPAA assessment as a Business Associate.

When you capture your own appointment, Hedy helps you keep important medical information without your audio being stored in the cloud. Remember to get your provider’s consent first.

For Coaches and Consultants

Client trust depends on discretion. Hedy lets you capture detailed session notes and action items while keeping your audio local. AI-generated summaries help you follow up effectively, and you control whether transcripts stay on your device or sync across your devices.

For your most sensitive client engagements, disable cloud sync to ensure session records remain solely on your device.

For Financial Advisors

Fiduciary conversations demand security. Hedy’s local speech recognition keeps client audio off external servers, while transient AI processing means your conversation content isn’t stored by third parties. Disable cloud sync for client meetings involving sensitive financial details, or enable it selectively for internal team discussions.

For Journalists and Researchers

Source protection matters. Hedy’s on-device transcription means interview audio stays on your device. Disable cloud sync for sensitive source conversations, or use it selectively when the content doesn’t require confidentiality. AI-generated summaries can help you identify key quotes and themes without manual review of hours of recordings.

Configuration Recommendations by Use Case

Maximum Privacy (Sensitive Client Work)

For attorneys, financial advisors, or anyone handling confidential information:

What you get: Local transcription with on-device speech recognition. Your audio never leaves your device, and transcripts are stored only locally. With Local AI selected on capable hardware, summaries and notes are generated on the device too, nothing is sent to the cloud, and everything works offline. On hardware that can’t run Local AI, choose Off if nothing may leave the device, or accept Cloud AI’s transient processing (data is not stored).

Important: This configuration is only available on native apps (iOS, Android, macOS, Windows). The web version cannot operate in this mode.

To configure: Disable cloud sync, choose Local AI (or Off) under Settings → Speech & AI → AI Processing, then go to Meeting Settings and set Suggestion Frequency to “Off.”

Balanced Configuration (General Business Use)

For typical business meetings, sales calls, and team collaboration:‍

What you get: Full AI coaching and cross-device access. Your data is protected by agreements preventing AI training, encrypted cloud storage, and the EU-US Data Privacy Framework.

Full Features (Personal Productivity)

For individual learning, personal note-taking, or situations without confidentiality constraints:

What you get: Everything Hedy offers—real-time coaching, automated workflows, maximum transcription accuracy, full cross-device experience.

Additional Security Measures

Beyond the main settings, a few choices can strengthen your overall security:

Use Google or Apple Sign-In

Logging in with Google or Apple provides two-factor authentication by default. This is more secure than email/password login and protects your account if your password is compromised elsewhere.

Choose the EU Data Region

New accounts pick where their data lives, the European Union or the United States, when they sign up, and that choice is permanent. With the EU region, synced conversations are stored on EU servers and Cloud AI processing runs in the EU on Inceptron, with Google Vertex AI in an EU region as the fallback. Accounts created before the region choice existed can still send their AI processing to the EU from Settings → Privacy & System → Privacy Preferences; their stored conversations stay in the US. Account sign-in, subscription billing, error tracking, and the providers that send auto-recap emails are US-based for everyone. The EU data residency post has the full breakdown.

Review Connected Integrations Regularly

If you’ve connected Hedy to automation tools, periodically review what’s connected. Remove integrations you no longer use.

Set a Data Retention Practice

Decide how long you need to keep sessions and delete older ones regularly. Hedy doesn’t impose retention limits—that’s your choice—but data minimization is a good privacy practice.

How Hedy Protects Your Data

Regardless of which features you enable, certain protections are always active:

• No AI training on your data. Your conversations are never used to train AI models unless you explicitly opt into a feature that requires such processing. We have strict agreements with all AI providers prohibiting the use of your data for training purposes.
• Transient AI processing. Data sent to AI services is processed in memory only—used to generate your insights, then discarded. It is not stored by our AI partners.
• Encryption everywhere. All data transmission uses TLS 1.3. Data stored in the cloud uses AES-256 encryption.
• Zero-trust access model. Hedy employees have no default access to production data. Any access requires business justification, security approval, and is logged for audit.
• EU-US Data Privacy Framework. Our cloud infrastructure provider is certified under this framework, providing legal protections for EU residents.
• Transparent documentation. Our Trust Center at trust.hedy.ai provides complete documentation: Data Processing Agreement, Standard Contractual Clauses, Technical and Organizational Measures, and sub-processor lists.

Frequently Asked Questions

Is Hedy GDPR compliant?

Yes. Hedy provides Data Processing Agreements, Standard Contractual Clauses, and technical measures to support GDPR compliance. Full documentation is available in our Trust Center.

Does Hedy work offline?

Hedy’s speech recognition runs on-device, so transcription works without an internet connection. In the default cloud mode, summaries and live coaching need a connection. With Local AI Processing enabled on capable hardware, summaries, notes, chat replies, and live suggestions all run on your device too, so the full experience works offline.

Does Apple Private Cloud Compute keep my data in the EU?

No. Apple does not commit to a region for Private Cloud Compute, so choosing it on iPhone or iPad means processing can happen outside your Hedy data region. If you need EU residency, use Cloud AI with the EU region, or Local AI.

Does Hedy train AI on my conversations?

No. Your conversations are never used to train AI models unless you explicitly opt into a feature that requires such processing. We have strict agreements with all AI providers prohibiting training on user data.

Is Hedy secure enough for attorney-client privileged conversations?

Hedy’s on-device transcription keeps your audio local, and cloud AI analysis is transient with no data retention by default. On capable hardware, Local AI Processing keeps that analysis on your device too, or you can set AI Processing to Off. With cloud sync disabled, your transcripts remain only on your device. This configuration may be suitable for privileged communications. Always verify with your bar association’s specific technology guidelines.

How does Hedy compare to Otter.ai for privacy?

Unlike cloud-first tools, Hedy’s default speech recognition runs entirely on your device—your audio never leaves your phone or computer for transcription. You choose whether to enable cloud features like sync and sharing. Otter.ai processes audio in the cloud by default.

Can therapists and counselors use Hedy?

Hedy is built for patients and individuals capturing their own conversations, not for clinicians documenting client or patient sessions. It is not designed or marketed for clinical use. If you are attending your own session and want to remember what was discussed, that is a personal use you control, with your provider’s consent.

Where is my data stored?

Audio recordings: Only on your device (if you enable recording), plus your own iCloud if you turn on Sync Recordings to iCloud. Never on Hedy’s servers.

Transcripts and summaries: On your device by default. If you enable cloud sync, also stored in encrypted cloud storage in the data region you chose at signup (EU or US).

Account data: Encrypted in cloud data centers certified under the EU-US Data Privacy Framework.

How do I delete all my data?

Go to Account Settings then Delete Account. All your session data on our servers will be permanently removed within 30 days. Local data on your devices can be removed by deleting the app.

Making Your Choice

The right configuration depends on your situation:

• What you’re capturing. A team brainstorm has different requirements than a client consultation.
• Who’s in the conversation. Have participants consented? What are their expectations?
• Your professional obligations. Some industries have specific data handling requirements.
• Your platform. Web users have different options than native app users.

Hedy gives you the controls. You make the call.

Questions?

If you’re unsure which configuration fits your situation, our support team can help you think through the options. We’d rather you use Hedy confidently with fewer features than feel uncertain about your setup.

For organizations requiring formal compliance verification, our GDPR documentation is available in the Trust Center, and Hedy has completed an independent SOC 2 Type I examination and HIPAA assessment.

Hedy is designed to make you brilliant in every conversation—and you get to decide exactly how it works for you.