Privacy Policy — Cody Zoom Meetbot

Effective Date: 2026-05-15 Last Updated: 2026-05-15

Cody Zoom Meetbot ("Cody," "the App," "we," "us," or "our") is a Zoom Marketplace application operated by Obsidian Inc. ("Obsidian," "we," "us") that joins Zoom meetings as an AI assistant to provide real-time transcription, conversational Q&A, action-item extraction, and post-meeting summaries. This Privacy Policy explains what information we collect when you authorize and use Cody, how we use it, who we share it with, how long we keep it, and the choices you have.

By authorizing Cody on your Zoom account or any account on which you are an admin, you agree to the practices described in this Privacy Policy. If you do not agree, do not authorize the App.

This Privacy Policy is published at https://codewarrior4life.github.io/lattice-meetbot-public/privacy.html and is referenced from the Cody Zoom Meetbot Marketplace listing per Zoom's Marketplace requirements.

1. Who we are

Cody Zoom Meetbot is developed and operated by Obsidian Inc., d/b/a Lattice. The primary developer contact for privacy questions is:

• Cody Assistant (operations) — cody@obsidian-inc.com
• Cyril Carrière (engineering owner) — theblacktruth@gmail.com

Cody is open-source under the Apache 2.0 license. Source code and security advisories are published at https://github.com/CodeWarrior4Life/lattice-meetbot.

2. Information we collect

Cody collects only what is needed to deliver its meeting-assistance features. Specifically:

2.1 OAuth tokens and account identifiers

When you authorize Cody on a Zoom account, Zoom provides us with:

• An OAuth access token and refresh token scoped to the permissions you grant
• Your Zoom user ID
• Your Zoom account ID
• The email address associated with your Zoom account
• A Zoom Access Key (ZAK) token, when required, to authorize Cody to join meetings on your behalf

These tokens are credentials. They are stored encrypted at rest and used only to invoke the Zoom APIs and SDK calls necessary to join meetings, fetch metadata, and send chat messages on your behalf.

2.2 Meeting metadata

For each meeting Cody joins on your behalf, we may temporarily process:

• Meeting ID and join URL
• Meeting topic (where provided)
• Scheduled start/end times
• Host and participant display names and Zoom user IDs
• Participant join/leave events

2.3 Meeting content

Once Cody is admitted to a meeting, we process the meeting content needed to deliver our features:

• Audio: raw PCM audio frames delivered by the Zoom Meeting SDK while Cody is admitted to the meeting. These frames are buffered in memory, written to a temporary WAV file for the duration of the meeting, and (optionally) streamed to a cloud Speech-to-Text provider for real-time transcription.
• Chat messages: chat messages sent in the meeting that Cody is admitted to. Messages addressed to Cody (e.g., starting with @cody) trigger LLM responses; other messages are buffered to provide conversational context to the LLM but are not retained beyond the session unless you opt in.
• Transcripts: text transcripts generated from the audio, segmented by speaker turn when speaker diarization is available.
• Generated content: AI-generated summaries, action items, and chat replies produced by Cody.

2.4 Information we do NOT collect

Cody does not collect:

• Video frames (we do not subscribe to video tracks)
• Screen-share content
• Camera, microphone, or file access on participants' devices
• Calendar contents, email, or any data outside the scope of the Zoom OAuth grant
• Children's data (Cody is not directed to children under 13; do not authorize Cody if you are under 13)
• Sensitive personal data such as health, financial, racial, religious, biometric, or precise location data

3. How we use information

We use the information described in Section 2 only for the following purposes:

1. Joining meetings on your behalf. OAuth tokens and ZAK are used to call Zoom's Meeting SDK and join meetings you (or your account admin) authorize.
2. Operating the in-meeting assistant. Audio is processed to generate transcripts; chat messages prefixed @cody are sent to our LLM provider (Anthropic) to generate a reply; the reply is posted to the Zoom chat.
3. Generating post-meeting artifacts. When the meeting ends or Cody leaves, the transcript and chat history are used to generate a summary and action-item list.
4. Service operation. Diagnostic logs (with audio and message contents redacted) are used to debug failures and improve reliability.
5. Security. We may use access logs to detect abuse and abuse-of-tokens.

We do not use meeting content to train AI models. Meeting content is sent to Anthropic's Claude API only for inference and is subject to Anthropic's commercial terms, which prohibit training on customer inputs by default.

4. Legal bases for processing (EEA/UK users)

If you are in the European Economic Area or the United Kingdom, our legal bases for processing your personal data are:

• Contract: processing necessary to provide the Cody service to you (Art. 6(1)(b) GDPR)
• Consent: for any processing beyond what is strictly necessary, including the optional retention of transcripts beyond the default window (Art. 6(1)(a) GDPR)
• Legitimate interests: for security monitoring and abuse detection, balanced against your rights (Art. 6(1)(f) GDPR)

5. Sharing and third parties

We share information only with the following providers, each strictly limited to what is needed to deliver Cody's features:

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not share personal data with brokers.

6. Retention

• OAuth tokens are retained for as long as your authorization is active. When you revoke the authorization in Zoom, refresh tokens are deleted within 30 days.
• Meeting audio (WAV files), transcripts, chat history, and summaries are retained for 30 days by default, after which they are permanently deleted. You may request deletion at any time before that.
• Diagnostic logs (with content redacted) are retained for 90 days for operational debugging, then deleted.
• Account-level identifiers (email, user ID) are retained while your authorization is active, and deleted within 30 days of revocation.

If you authorize Cody for a specific meeting only (one-off use), all derived artifacts are deleted within 7 days of meeting end unless you explicitly retain them.

7. Security

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption in transit: all traffic to Zoom, Anthropic, Deepgram, and GitHub uses TLS 1.2 or higher (HTTPS / WSS).
• Encryption at rest: stored OAuth tokens and refresh tokens are encrypted with AES-256; persisted meeting artifacts are stored on encrypted filesystems.
• Access control: each meeting is processed in an ephemeral container (one container per meeting); only the authorizing user's data is accessible within that container.
• Least privilege: Cody requests only the OAuth scopes strictly required for its features.
• Secure development: code is open-source, reviewed before release; secrets are managed via environment variables and never committed to source control.

No system is completely secure. If we discover a security breach affecting your data, we will notify you per applicable law (in the US, within 30 days where required by state law; in the EEA/UK, within 72 hours per GDPR Art. 33).

8. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (subject to legal obligations to retain certain records)
• Restrict or object to processing
• Portability — receive your data in a structured, machine-readable format
• Withdraw consent for any consent-based processing
• Lodge a complaint with a data protection authority

To exercise these rights, email cody@obsidian-inc.com from the email address associated with your Zoom account. We will respond within 30 days (45 days where extension is permitted under applicable law).

California residents have additional rights under the CCPA and CPRA. We do not "sell" or "share" personal information as those terms are defined under California law.

9. International transfers

Cody is operated from the United States. If you authorize Cody from outside the US, your information will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses or equivalent mechanisms with our subprocessors.

10. Recording laws

Cody captures meeting audio and transcripts. You are responsible for complying with applicable recording laws in your jurisdiction, including obtaining the consent of meeting participants where required (e.g., two-party-consent states in the US such as California, Washington, Florida, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania).

Cody is named "Cody Assistant (Notetaker)" in the participant list specifically to make its presence and recording function visible to all participants. We strongly recommend you also disclose Cody's presence verbally and in chat at the start of each meeting.

We are not responsible for your failure to obtain required consent.

11. Children

Cody is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has authorized Cody or is using Cody, contact cody@obsidian-inc.com and we will delete the data and revoke the authorization.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced via the Marketplace listing and (where we have your email) via email. The "Last Updated" date at the top of this policy will reflect the most recent revision. Your continued use of Cody after a material change constitutes acceptance.

The current version is always at https://codewarrior4life.github.io/lattice-meetbot-public/privacy.html. Prior versions are archived in the project's public repository at https://github.com/CodeWarrior4Life/lattice-meetbot/tree/main/docs/marketplace.

13. Contact

Questions, requests, and complaints about this Privacy Policy:

• Email: cody@obsidian-inc.com
• Mail: Obsidian Inc., c/o Cyril Carrière, [address on file with Zoom Marketplace]

For Marketplace listing inquiries, see Zoom's Marketplace support.

This Privacy Policy is a working draft prepared for Cody Zoom Meetbot's submission to the Zoom Marketplace. It is subject to legal review before publication.