MeetReady Privacy Policy
MeetReady is designed so that we do not have your data. The secrets vault, meeting notes and tasks are encrypted on your phone, and there is no MeetReady account. This page says what stays on the device, what leaves it (and where it goes), which data we process, how long we keep it, and how you exercise your rights.
Part 1. The MeetReady app
1. Who we are
MeetReady is made by HAIKOTEK COMPANY LIMITED (CÔNG TY TNHH HAIKOTEK), business registration number 0318449407, address 44/24A Truong Phuoc Phan Street, Neighborhood 1, Binh Tri Dong Ward, Ho Chi Minh City, Vietnam (“we”, “Haikotek”). Contact for personal data: info@haikotek.com.
For data on your phone (section 4, Group A) we neither receive nor can read it. For data in section 4, Group B (plan records on our server) we decide the purposes and means of processing. For data kept where you choose (your iCloud, your folder, the AI provider you configure) you decide, as described in section 4, Group C.
2. Applicable law
This policy is written under Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 (effective 1 January 2026) and Decree No. 356/2025/NĐ-CP, which guides the law. We also follow the App Store (Guideline 5.1.1) and Google Play Data safety requirements, so that what is written here matches what we declare to the stores.
3. Summary
- MeetReady has no account. We do not ask for your email, phone number or ID.
- The secrets vault (passwords, ENV variables, links, notes), meeting notes and tasks are encrypted on your phone with AES-256-GCM. The key comes from your master password (PBKDF2, 600,000 rounds) and from a 12-word recovery key. We do not have the key.
- MeetReady reads the system calendar read-only, on the device, to build the Meeting Kit. Calendar content is not sent to us.
- No microphone, no recording, no capture of meetings. Post-meeting notes are typed by you.
- Sync (optional, Pro) goes through your own iCloud (iPhone) or a folder you choose (Android). There is no MeetReady relay server.
- AI is optional: built-in templates (never leave the device), Apple on-device AI, or your own key (BYOK). With BYOK, the app first asks for your explicit consent; after that, content goes straight from your phone to the provider you choose, not through Haikotek. A hard filter strips secrets first, and you can preview what will be sent.
- When you buy Pro, Apple or Google processes the payment. Our server only receives the store’s proof of purchase (an Apple transaction or a Google Play purchase token), a random install identifier, the public part of a device key and the plan status. It never receives vault content, your name, email, Apple ID or card details.
- No ads, no sale of data, and no third-party analytics or tracking SDKs in the app.
4. Data processed: why, where, and for how long
Group A. Data on your phone. We do not receive this data.
| Data | Purpose | Where it is stored and who can read it | Retention |
|---|---|---|---|
| Vault items: passwords, ENV, links, notes, rotation history | To give you the right information when you walk into a meeting | On the phone, encrypted with AES-256-GCM. The data key is wrapped by a key derived from your master password (PBKDF2-SHA256, 600,000 rounds, random salt) and by a key from your 12-word recovery key. Only you can open it | Until you delete it or uninstall the app |
| Workspaces (clients, projects), tasks, post-meeting notes, briefs | To prepare for and record the work around each meeting | As above | As above |
| Meeting details read from the system calendar (title, time, attendees as the calendar provides them) | To build the meeting list and the Meeting Kit | Read on the device with read-only calendar permission. Never written to the calendar. Not sent to us | Until you delete it or uninstall the app |
| Search index | Fast search in the vault, including Vietnamese typed without diacritics | HMAC hashes under a key held in the vault; no plaintext of secret items is stored | As above |
| BYOK key (if you enter one) | To call the AI provider you choose | The device’s Keychain (iPhone) or Keystore (Android). We cannot see it | Until you remove the key or uninstall the app |
| Settings, reminders | To run the app and remind you before meetings | Created on the device. When the phone is locked, notifications show generic text and no secrets | Until you turn them off |
| Encrypted backups (MRBK1 format) and password-sealed export files (HPV1) | To restore the vault and move to a new phone | On the device; exported files sit where you put them, encrypted. Free keeps 3 versions, Pro keeps 30 | By version count; exported files are yours to manage |
| Clipboard when you copy a secret | To paste it into another app | The operating system clipboard. The app clears it after 30 seconds (default; you can change it) | At most your chosen setting |
Group B. Data we receive and store on our server. This arises when you buy or restore Pro, redeem a gift code, renew your plan, or when the app checks that billing is live (see the table). The server (Haikotek Platform, api.haikotek.com) is located in Tokyo (Nhật Bản / Japan) and provided by Vultr (The Constant Company, LLC). None of the records below has a column for your name, email or phone number, and no vault, note, task or calendar content is ever sent to it.
| Data | Purpose | Where it is stored and who can read it | Retention |
|---|---|---|---|
| A random install identifier (a UUID the app creates once for this installation; no personal information; Apple calls it appAccountToken, Google obfuscatedAccountId) and the support code (MRS-XXXXX-XXXXX) the app computes from it and shows in Settings → About | To tie a transaction to an installation without an account, and to find or delete your records when you quote the support code | Our database. The server keeps only a keyed one-way hash of the support code; engineers with access cannot turn it back into the code | While the plan is active and 24 months after it ends, then deleted or anonymized |
| A random device key for this installation: your phone makes a key pair, the private key stays in the Keychain or Keystore and only the public key is sent | To bind your entitlement to this phone. One plan can be used on up to 5 devices (seats); you can release a device in the app | Our database, as a hash of the public key | As above. A seat you release is deleted after about 13 months |
| Proof of purchase from the store: Apple’s signed transaction or the Google Play purchase token, with the product (monthly or yearly), status, period and grace end dates, whether it auto-renews and offer type (for example the free trial) | To verify the transaction with Apple or Google, and to grant, renew and revoke Pro | Our database. The store reference is kept as a keyed one-way hash; a Google Play purchase token is kept encrypted, only so we can ask Google about the subscription later | As above |
| Entitlement token: a token we sign that holds a grant id, the plan, the Pro features, the number of seats and dates. The app keeps it on your phone and sends it back to renew (about once a week while online) or when you release a device | To renew Pro offline-safely without an account, and to give a seat back | Stored on your phone (Keychain or Keystore). On our server only the grant record above exists | As above |
| Gift codes (MR-XXXX-XXXX-XXXX-XXXX, redeemed on Android): a hash, a short hint, the redemption count; an event log of plan grants (event type, time) | To redeem codes, reconcile and prevent abuse | Our database; the code itself is not stored in a readable form | 24 months after the code or grant ends or is revoked, then deleted |
| A billing availability check. When billing is switched on in the app, at most every 6 hours when you open it, the app sends an empty renewal request that carries only the device public key. This also happens if you are on the free plan and have bought nothing | So the app can hide the purchase screen if billing is not live | Nothing is stored except the access-log line in the next row | See the next row |
| Your phone’s IP address when it calls our server | To rate-limit and prevent abuse | The application never stores the address. For rate limits it is turned into a keyed hash that changes every day, so it cannot be linked from one day to the next, and it is kept in memory for at most an hour. The web server’s access log for plan and gift-code requests records the IP, time, path (no query string) and response code, with no headers, body or browser type | Access log: 14 days |
| Email you send to info@haikotek.com | To reply to you | Company mailbox | Until no longer needed |
Group C. Data that goes to someone you choose. We do not receive it, but it leaves your phone by your choice:
- Sync through iCloud (iPhone, optional, Pro). Encrypted data is stored in the CloudKit private database of your own iCloud account. Apple processes it under your account, under Apple’s policy. We have no access.
- Sync through a folder you choose (Android, optional, Pro). The app writes encrypted data to the folder you pick with Android’s file picker. Where that folder lives (device storage, a cloud service you use) and that place’s policy are your choice.
- AI with your own key (BYOK, optional, Pro). Before the first request to your own AI endpoint, the app shows a dialog that says what will be sent and to whom, and sends nothing unless you explicitly agree (“I agree”; “Not now” sends nothing). After that, when you generate a brief with the provider you choose, the app sends part of the content straight from your phone to that provider using your key. The data does not pass through Haikotek’s servers. Before sending, the app’s hard filter strips secret values, and you can preview what is about to be sent. The provider processes it under its own policy and your agreement with it; read that policy before you use it.
- Apple on-device AI (iPhone, Pro). Processed on the device and not sent out. The Android app does not have it yet.
We do not collect: location, contacts, microphone or audio, your photos, advertising identifiers, device model, usage logs or bank account numbers. The app has no third-party analytics or advertising tools.
5. Permissions the app asks for
- Calendar (iOS: calendar access; Android: read calendar): read-only, to read upcoming meetings and build the Meeting Kit. Calendar data stays on the device.
- Notifications: meeting reminders, created on the device; there is no server push service. When the phone is locked, the notification text is generic.
- Face ID / fingerprint / face unlock (optional): to unlock the vault and to confirm it is you before showing or copying a secret. The operating system handles biometric data; neither the app nor we receive it.
- Internet: used to verify a purchase and renew Pro with our server (api.haikotek.com), for the billing availability check described in section 4, to redeem a gift code (Android), to sync with iCloud (iPhone), and to call an AI provider with your own key (BYOK). It never carries vault content.
- Exact alarms and boot (Android): to fire reminders on time and re-arm them after the phone restarts.
- The Android app sets allowBackup=false (vault data is not put into Android automatic backups) and blocks screenshots in release builds.
6. Purposes and legal basis
We process data only to: (a) run the app on your device; (b) grant, renew and revoke Pro and redeem gift codes; (c) prevent abuse and keep the server safe; (d) reply when you contact us; (e) comply with legal obligations.
Basis. The main basis is your consent under Article 9 of the Law on Personal Data Protection: voluntary, for each specific purpose, and clearly expressed. You consent when you grant calendar access, when you turn on sync, when you explicitly agree in the consent dialog before your first request to your own AI provider (BYOK), and when you buy or restore a plan. For plan records we also rely on performing the transaction you requested and on the legal duty to keep records. You may withdraw consent at any time (section 10); withdrawal does not affect processing already done.
You can use MeetReady entirely on your phone without buying anything. Then the only thing the app may send to our server is the billing availability check in section 4, which carries no content and no purchase data. We do not use data for advertising, do not profile you, and make no automated decisions that affect you.
Sensitive data. A vault may hold passwords, access keys and your clients’ information. That is why the app is designed so we hold no readable copy of it and the data stays on your device.
7. Payments through Apple and Google
All Pro payments are processed by Apple (App Store) or Google (Google Play) under their own policies: Apple and Google. We do not receive your name, email, Apple ID, Google account or card details. We only receive the transaction identifier, product id and plan status listed in section 4. Pro is tied to the Apple ID or Google account that bought it, not to a MeetReady account (there is none). To use it on a new phone, tap “Restore purchases” in the app.
9. Retention and deletion
How long we keep each kind of data is in the last column of the tables in section 4. In addition:
- The ledger of store notifications (the messages Apple and Google send us) is kept 90 days; audit events 24 months; released device seats about 13 months; the web server’s access log 14 days.
- Server backups are encrypted and kept as 7 daily and 4 weekly copies (about 5 weeks); deleted data disappears from backups when the last copy that holds it expires. Access logs of the server are never part of a backup.
- Where the law requires records to be kept (accounting, tax) or they are needed for a dispute in progress, we keep that part until the time needed and use it only for that purpose.
- Delete in the app: delete items or workspaces, or uninstall the app to remove its data from the device. Data in your iCloud or sync folder is removed by you in that place (see the data deletion page).
- Ask us to delete plan records and gift codes held on our server: see the data deletion page. The quickest way is to send your order id.
10. Your rights and how to use them
Under the Law on Personal Data Protection you have the right to be informed, to consent or refuse, to access, to withdraw consent, to delete, to obtain a copy, to correct, to restrict processing, to object to processing, to complain, to denounce, to sue, to claim damages and to protect yourself. Because vault data is on your phone, you can exercise most of these yourself in the app:
- View, edit, delete: directly on each item, workspace, note and task.
- Get a copy: export a password-sealed file (HPV1) or use the encrypted backups in Settings.
- Withdraw consent: revoke calendar or notification access in the operating system settings; turn off sync; remove the BYOK key and decline the AI consent dialog; uninstall the app to delete on-device data.
For data on our server (Group B), email info@haikotek.com. Because our records hold no name or email, please include the support code shown in the app (Settings → About, like MRS-XXXXX-XXXXX), which is the easiest way, or the order id from your Apple or Google Play receipt email, or your MR-… gift code, so we can find the right records (see the data deletion page). We may ask for more to confirm the request comes from you.
| Right | Time we take |
|---|---|
| Acknowledge your request | Within 2 business days |
| Access, correct, obtain a copy | At most 15 days |
| Withdraw consent, restrict, object | At most 20 days |
| Delete | At most 30 days |
These times already include our server host’s cooperation. For a complex request the law allows one extension; we will then tell you the reason in writing. You may also complain to Vietnam’s personal data protection authority or sue in court.
11. Children
MeetReady is for people aged 18 and over and is not aimed at children. We do not knowingly collect data from anyone under 16, the age the law treats as a child. If you are a parent or guardian and see that your child has used MeetReady, write to us and we will delete the related server records.
12. Security and breach notice
Vault data is encrypted with AES-256-GCM under a random data key; that key is wrapped by a key derived from your master password (PBKDF2-SHA256, 600,000 rounds) and, in a second wrap, by a key from your 12-word recovery key. Entering a wrong password 5 times triggers an increasing lockout. The BYOK key is kept in the Keychain or Keystore. Connections to our server use TLS. Store references are kept as keyed one-way hashes, Google Play purchase tokens are encrypted, and only engineers have access.
No system is perfectly safe: keep your 12-word recovery key somewhere safe, apart from your phone. If you forget your master password and lose all 12 recovery words, nobody, including us, can reopen the vault.
If personal data is exposed or lost, we notify the personal data protection authority within 72 hours of becoming aware, and notify you when the law requires or when the incident may harm you. Because the vault is not on our server, a server incident does not expose vault content.
13. Changes to this policy
When the policy changes we update the date at the top and say so in the release notes. If a change widens the data processed or the purposes, the app asks you first and processes only if you agree.
14. Contact
Any question, request about personal data or complaint: info@haikotek.com. Mail to HAIKOTEK COMPANY LIMITED, 44/24A Truong Phuoc Phan Street, Neighborhood 1, Binh Tri Dong Ward, Ho Chi Minh City, Vietnam.
Part 2. This website
15. What the website collects
- The website collects no email and sets no cookies. There is no sign-up form and no account.
- No analytics or advertising tools run on the site, and the site loads no fonts, code or images from outside servers.
- Your browser stores one “mr-theme” value in local storage to remember light or dark mode. It stays on your device and is not sent anywhere.
16. Server logs and measurement
Like any website, our server and content delivery network (CDN) write technical access logs: IP address, time, page loaded, browser type. We use them for security and troubleshooting and keep them for at most 14 days, then delete them.
To see how the site appears in search we may use Google Search Console. It measures on the search side and does not run on this site.
17. When you write to us
If you email info@haikotek.com we use the content and your address to reply, and keep the email in the company mailbox until it is no longer needed. Please do not send passwords, access keys, card numbers or ID photos.