Ringside — Privacy Policy
The short version
Ringside listens to your sales calls so you don't have to take notes. The listening happens on your computer — the audio is turned into text by speech models running inside your browser, and the audio itself is never uploaded, never stored by us, and never leaves your machine. The text of the meeting, and the follow-ups Ringside drafts from it, are stored in your own Ringside account so you can act on them later and see them on another machine. We do not sell any of it, we do not advertise, and we do not use your meetings to train models.
1. What we process on your device and never send anywhere
When you arm a meeting, Ringside captures two audio streams: the audio of the browser tab your meeting is in, and — if you enable it — your microphone. Both streams are handed to speech-recognition models that run inside your browser as WebAssembly, on your own CPU.
- Audio is never uploaded. It is not sent to our servers, not sent to any third party, and not written to a file. It exists only in memory, for as long as it takes to turn a few seconds of speech into a line of text.
- Optional speaker separation (telling your voice from theirs) computes a numerical voice signature in the same on-device process. That signature is held for the duration of the meeting and then discarded. We never store a voiceprint, and none is ever transmitted.
- Speech model files. Ringside ships with two speech engines. The alternative engine, and the optional speaker-separation model, are packaged inside the extension. The default engine downloads its open-source model weights from the public Hugging Face CDN the first time you use it, and your browser caches them after that. This is a one-way download of public files: no audio, no transcript and no account information is sent. Like any web request your browser makes, it carries your IP address to the server serving the file.
2. What is stored in your Ringside account
When you are signed in, Ringside stores the following in its database (hosted on Supabase, in the region configured for the project). Every row is tied to your user id and is readable only by you — and, if your organisation uses Ringside's manager view, by a manager on your team.
The one deliberate exception is the shared spelling glossary. A correction you save globally rather than to a single meeting — "it's Ethico, not ethical" — is visible to, and editable by, everyone signed in to your Ringside deployment, because a glossary that each person has to teach separately is not a glossary. Corrections you save to a single meeting stay with that meeting and stay yours. Do not put anything confidential in a global term.
| What | Examples |
|---|---|
| Meeting sessions | The browser tab's title, start and end time, and — for meetings armed from your calendar — the calendar event id, the event's attendee list, its description/agenda, its scheduled end, and the meeting type you tagged it with. |
| Transcript text | The recognised text of the meeting, line by line, with timings and a speaker label (ME / THEM, plus any name you assign). |
| Suggestions | The post-call summary, the drafted follow-up emails, proposed calendar actions and tasks, the commitments Ringside heard, and the supporting quotes it cites — plus, for each one, whether you approved, edited, or dismissed it, and the receipt of what happened when you did. |
| Live corner cards | The short mid-call coaching cards Ringside surfaces while you are on the call. |
| Whispers | If your organisation uses the manager view, a short note a manager sends you during a live call, and whether you have seen it. |
| Your corrections | Terms you teach Ringside to spell correctly — product names, company names — and speaker names you assign. |
| Meeting preferences | Per calendar event: its id and start time, whether you armed it, and the meeting type you chose. |
| Account | Your Google account's email address and Google user id, and your Ringside user id. |
3. Google user data — exactly what we access and why
Ringside asks for the narrowest set of Google permissions that makes the product work. You grant them on Google's own consent screen, and you can revoke them at any time at myaccount.google.com/permissions.
3.1 What we request today
| Scope | What it lets Ringside do | What we do with it |
|---|---|---|
openid, email | Identify you | Creates your Ringside account and keys every row you own to it. We store the email address and the Google user id. Nothing else from your Google profile. |
.../auth/calendar.readonly | Read your primary calendar | Draws the meeting rail — today and the coming week — so you can arm a meeting with one click. |
.../auth/calendar.events | Read and write events on your primary calendar | The read half feeds the same rail. The write half is used only when you press ✓ on a calendar suggestion, and only to create the one event on that card. Ringside never edits or deletes an event you did not just approve. |
Your calendar events are fetched live and are not stored on our servers. The rail requests the current window from the Google Calendar API each time it refreshes and keeps a copy in your browser's local storage so the rail can draw instantly on the next open. That copy lives on your machine.
The exceptions, stated plainly, are the two places calendar data is deliberately persisted because the product needs it:
- When you arm a meeting, that event's id, title, attendee list, agenda and scheduled end are written into the meeting session, so the follow-up can be addressed to the right people and shaped to what the meeting was for.
- Your per-meeting preferences — armed or not, and the meeting type — are saved against the event id, so a week you tag on Monday is still tagged on Thursday and on another machine.
Nothing else about your calendar is retained.
3.2 Email — what Ringside does and does not do
Ringside does not request access to your Gmail. It cannot read your mail, it cannot list your messages, and it cannot send mail on your behalf.
When you approve a drafted follow-up, Ringside opens a Gmail compose window in a new tab with the recipient, subject and body already filled in. You press Send, in Gmail, as yourself. If you are not signed in, or Ringside could not work out a recipient, it copies the draft to your clipboard instead.
3.3 FUTURE — one-click send
We are separately applying to Google for the gmail.send permission, which would let a ✓ send the drafted email directly instead of opening a compose window. That permission is not requested by this version and the feature is switched off. If and when Google grants it, this policy will be updated before the feature is enabled, the send will remain strictly one-email-per-approval, and gmail.send — as Google defines it — allows sending only. It confers no ability to read, search, or delete anything in your mailbox, and we would not ask for one that did.
3.4 Where your Google credentials live
Signing in uses Google's authorization-code flow with PKCE. The authorization code is exchanged for tokens by our own server function, which keeps the long-lived refresh token server-side, in a table no client can read — it is never sent to the extension and never leaves the server. The short-lived access token is held in your browser's extension storage on your own machine. Signing out revokes the Google grant, which destroys the server-side refresh token, and clears your local session.
4. Who else processes your data
We use a small number of service providers. They process your data on our instructions, for the purposes below, and for nothing else.
| Provider | What it handles | Why |
|---|---|---|
| Supabase | Your account, transcripts, suggestions and preferences; the server functions that generate them. | Database and serverless hosting. |
| Anthropic | Two calls, with different contents. After the meeting, to write the summary and the follow-ups: the transcript text, the meeting's title, its start time and duration, its attendee list, the meeting type you tagged it with, and your spelling glossary. During the meeting, to produce a live corner card: the transcript so far, the attendee list, the agenda from the calendar invite, how long you have been on the call, and your spelling glossary. | This is the model that writes the summary, the drafts and the corner cards. Under Anthropic's commercial API terms, inputs and outputs are not used to train models. |
| Calendar reads and writes, and sign-in, as described in §3. | The calendar rail and identity. | |
| Hugging Face | A one-way download of public, open-source speech model files to your browser. No user data is sent. | Delivers the speech engine's weights. |
"Your spelling glossary" above means the corrections you have written yourself — product names, company names, and the speaker names you have assigned — which are sent so the model spells them the way you do. Note that the post-meeting call does not include the calendar invite's agenda, and the live call does not include the meeting title, start time or meeting type. Each call carries what that job needs and nothing else.
We do not sell personal information, we do not share it for advertising, and we transfer it to no one else except where the law requires it.
5. Google API Services User Data Policy
Ringside's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely, and in the language of that policy: we use Google user data only to provide and improve the user-facing features described above; we transfer it only to the service providers named in §4, and only to operate those features; we do not use it for advertising; we do not use it to develop, improve, or train generalised AI or machine-learning models; and no human at Ringside reads your Google user data except with your explicit consent (for a support request you raise), where required for security or to comply with the law, or on data that has been aggregated and anonymised.
6. What is stored on your own computer
The extension keeps the following in Chrome's local extension storage, on your machine, and it never syncs anywhere by itself: your Supabase session, the short-lived Google access token, your cached calendar window, your arm and meeting-type choices, your microphone and engine preferences, your list of corrected terms, and a small outbox of transcript lines waiting to be saved. Removing the extension removes all of it.
7. How long we keep things, and how to delete them
- Audio: never stored. Nothing to delete.
- Transcripts, suggestions, sessions and preferences: kept until you delete them or until you ask us to delete your account.
- Deleting one meeting: delete the session and everything attached to it — transcript, suggestions, action ledger — is deleted with it.
- Deleting your account: email support@ringside.help from the address you signed in with. We delete your user record and every row that cascades from it — sessions, transcripts, suggestions, actions, preferences, and the stored Google refresh token — within 30 days, and we confirm when it is done. Terms you added to the shared spelling glossary are not tied to your account and are not removed by this; tell us in the same email if you want any of them taken out too.
- Revoking Google access without deleting your account: sign out inside Ringside, or remove Ringside at myaccount.google.com/permissions. Either destroys the server-side refresh token.
- Backups made by our hosting provider may retain a deleted row for a short further period before they roll off. Nothing is restored from them into the live service.
8. Security
Everything is carried over TLS. Every row in the database is protected by row-level security keyed to your user id — the database itself refuses to return another user's rows, rather than relying on the application to remember. The Google refresh token lives in a table with row-level security enabled and no read policy at all: only the server function can reach it, and it is never returned to a client under any circumstances. Server credentials — the Google client secret, the model API key — exist only as server-side secrets and are never present in the extension or in this repository.
9. Things we do not do
We do not sell your data. We do not show ads or profile you for anyone else's. We do not use your meetings, transcripts or Google data to train models. We do not record video. We do not capture your screen. We have no content scripts: Ringside cannot read the pages you browse. We do not capture audio unless you have armed a meeting, and capture stops when you disarm, when the meeting tab closes, or when you close the browser.
10. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict its processing. Email support@ringside.help and we will action it. We do not charge for it and we do not treat you differently for asking.
Ringside is a business tool sold to companies and is not intended for anyone under 18.
One thing only you can do: meetings have other people in them. Recording and transcription laws differ by country and by US state, and some require every participant's consent. You are responsible for telling the people on your calls that you are transcribing, and for having the consent your jurisdiction requires. Ringside gives you the tools; it cannot give you permission.
11. Changes
If we change this policy in a way that matters — a new permission, a new processor, a new use — we will update this page and note the change here before the change takes effect in the product.
12. Contact
Tone on the Phone
support@ringside.help
ringside.help