# Is tl;dv Safe? No AI Training, but a 2026 Data Exposure > Is tl;dv safe? It never trains AI on your meetings and hosts them in the EU. A 2026 flaw exposed join links, and it kept no request logs to rule it out. - URL: https://www.getvoibe.com/resources/is-tldv-safe/ - Author: Ayush - Published: 2026-11-02 ## Is tl;dv Safe? The Short Answer A security researcher says he joined a live Google Meet run by Malaysia's Ministry of Education. Over 157 people were on the call. He found the join link in a tl;dv database. He published the details on August 4, 2026 ([his write-up](https://bobdahacker.com/blog/tldv-hack)). ### My verdict **tl;dv is safe on training and hosting. It was shaky on how it handled 2026.** On paper, its privacy promises are among the strongest in this category. ### What tl;dv gets right - Its privacy policy bars training on your meetings, by tl;dv and by its AI providers. That's section 9, published September 9, 2026. - Your data sits in the EU. It's in Google Cloud, Hetzner and Wasabi data centres in Germany and Finland. - Free recordings are deleted after 3 months. - **Consent Collection** lets guests decline before the bot records. - It has its own SOC 2 Type II report, listed on its trust center. ### Where the risk sits - **The 2026 exposure.** Any logged-in user could list meeting records across customers, 181,874 by the researcher's count. They showed join links and organizer emails. tl;dv says private recordings and transcripts were never exposed. - tl;dv kept no request-level logs for that path. Its own report says it can't conclude that nobody else looked. - The researcher says he first reported it on January 28, 2026. tl;dv's first public statement came more than six months later. - The desktop app records audio with no bot and no automatic notice. - No BAA and no HIPAA claim. - Its site still shows a Privacy Shield badge. The EU Court of Justice [invalidated that framework on 16 July 2020](https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf) (Case C-311/18). ### How I checked On November 2, 2026, I read: - tl;dv's privacy policy, terms and trust center - its security, pricing and help pages - the researcher's post and both tl;dv incident statements I haven't used tl;dv hands-on. ### Price, alternatives and the no-bot option Plans and Free-plan caps are in our [tl;dv pricing breakdown](https://www.getvoibe.com/resources/tldv-pricing/). For tools that keep notes off vendor servers, see our [tl;dv alternatives](https://www.getvoibe.com/resources/tldv-alternatives/). - [Voibe Work](https://www.getvoibe.com/resources/voibe-work-meeting-notes-no-bot/) (the app we build) has no bot, on Mac or Windows. - Its audio is deleted as soon as processing completes. Your notes are saved on your computer. - It costs $149 a year, $67 (31.0%) less than tl;dv Pro annual ($216). - tl;dv Free costs $0, so it wins for light use. Voibe reminds you to tell everyone you're taking notes when recording starts. The [recording-consent rules](https://www.getvoibe.com/resources/ai-notetaker-recording-consent-laws/) are yours to follow. > **Key takeaway:** tl;dv bars training on your meetings and hosts them in the EU. A 2026 flaw exposed join links, with no logs to rule out access. ## Key Takeaways: tl;dv Safety at a Glance (November 2026) Every row comes from tl;dv's own pages, the researcher's post and rating pages. I checked them on November 2, 2026. | Question | tl;dv's answer (November 2026) | Source | | --- | --- | --- | | **Does a bot join?** | Yes, by default. With auto-recording on, it joins scheduled Google Meet, Zoom and Teams calls, named after you (for example, Grace's AI Notetaker). | tl;dv help center | | **Can it record without a bot?** | Yes, with the Mac and Windows desktop app. It captures audio only, and recording notifications may not appear automatically. | tl;dv help center (July 9, 2026) | | **Where is it stored?** | In the EEA: Google Cloud, Hetzner and Wasabi data centres in Germany and Finland. AI processing runs in the EU or the US, by your account setting. | tl;dv privacy policy (Sept 9, 2026) | | **How long?** | Free: 3 months, then deleted. Paid: until account deletion. Emails of non-client participants: up to 5 years or until a deletion request. | tl;dv privacy policy; pricing page | | **Trained on?** | No. Customer Content isn't used to train models for tl;dv or any third party. | tl;dv privacy policy, section 9 | | **Attestations** | SOC 2 Type II and GDPR. The ISO 27001 claim covers its data centres, not tl;dv itself. | tl;dv trust center; homepage | | **HIPAA / BAA** | No HIPAA claim and no BAA on any tl;dv page I read. | tl;dv pages, November 2, 2026 | | **2026 incident** | Meeting metadata readable by any logged-in user. Last path closed August 5, 2026. Reported to Japan's privacy regulator on August 11, 2026. | [Researcher](https://bobdahacker.com/blog/tldv-hack); tl;dv incident report | | **Lawsuits, regulators, bans** | None found as of November 2, 2026. | Web search, November 2, 2026 | | **Ratings** | Chrome Web Store 4.6 from 601 ratings (400,000 users). Trustpilot 2.1 from 10 reviews. | [Chrome Web Store](https://chromewebstore.google.com/detail/lknmjhcajhfbbglglccadlfdjbaiifig); Trustpilot | | **Price** | Free $0. Pro $18/mo billed annually ($216) or $29 monthly. Business $29/mo annually ($348) or $39 monthly. | [Our tl;dv pricing breakdown](https://www.getvoibe.com/resources/tldv-pricing/) | ## What Is tl;dv, and How Does It Record a Meeting? [tl;dv](https://tldv.io/) is an AI meeting notetaker from tldx Solutions GmbH in Aachen, Germany. Its About page says it was founded in 2020. It records your calls, transcribes them and writes AI notes. Paid plans add CRM sync, an API and an MCP server. ### Four ways tl;dv captures a meeting - A bot, the default on Google Meet, Zoom and Microsoft Teams - The desktop app on Mac or Windows, with no bot, for any meeting app - A Chrome extension for Google Meet, with or without the bot - A mobile app for in-person meetings, on iOS and Android ### What users say - **4.6 out of 5** from 601 ratings on the [Chrome Web Store](https://chromewebstore.google.com/detail/lknmjhcajhfbbglglccadlfdjbaiifig). The listing shows 400,000 users. - **2.1 out of 5** from 10 reviews on Trustpilot. Most complain about account lockouts and slow support. - tl;dv's pricing page claims 2M+ users. I checked both ratings on November 2, 2026. ## Bot or No Bot: Two Ways tl;dv Records, and What the Room Sees tl;dv records in two ways. They differ in what gets captured and in who knows about it. ### Path 1: the bot - It joins as a participant named after you, like Grace's AI Notetaker. Pro and higher plans can change its name and photo. - It records video and audio. The pricing page advertises unlimited video recordings. - With auto-recording on, it joins every scheduled meeting by itself. - Per tl;dv's help center, Google Meet may flag it in red as a potential security risk. ### Path 2: the desktop app, no bot - Audio only. No video, screen sharing or chat messages. - It picks up any sound playing on your computer, including music and notifications. - If auto-recording is on, tl;dv will still try to send the bot to your meetings. ### The safety difference Nobody else in the call sees the desktop app. Recording notifications may not appear automatically. - tl;dv's help center: "It is your responsibility to inform participants". - In desktop mode, the whole consent burden is on you. - Both paths still end in tl;dv's cloud. - Voibe Work also has no bot, but its notes are saved on your computer. Voibe reminds you to tell everyone you're taking notes when recording starts. The [recording-consent rules](https://www.getvoibe.com/resources/ai-notetaker-recording-consent-laws/) are yours to follow. ## Where Does a tl;dv Meeting Go? Its EU Cloud, Then an AI Region You Pick To tl;dv's EU cloud, whichever way you record. Bot, desktop app or mobile app, it all uploads to your tl;dv library. ### What tl;dv's privacy policy says - Data is mainly processed and stored in the European Economic Area (EEA). - The named sites are Google Cloud and Wasabi in Germany, and Hetzner in Germany and Finland. - AI features may use Anthropic models through Google Cloud Vertex AI. Limited transcript portions go to the EU or the US. Which one depends on the AI hosting location you select. - The trust center lists AssemblyAI and ElevenLabs as transcription providers for paying customers. It doesn't name the Free-plan provider. - Staff don't access your recordings or transcripts unless you share access for support. ### What tl;dv doesn't settle - The default AI region for a new account. No page I read states it. - Which clouds. The policy names Google Cloud, Hetzner and Wasabi. Other tl;dv pages add AWS, and all of them say Europe. - End-to-end encryption. Only the homepage claims it. The policy describes SSL in transit and AES-256 at rest, and names providers that process transcripts. ### Where Your Meetings Go: tl;dv vs Read AI vs Fireflies vs Granola vs Voibe Work I checked the tl;dv rows on November 2, 2026. The other rows come from our October 2026 safety reviews, linked by name. | Tool | Bot in the call? | What's kept, and where | Retention | Training default | Attestations | | --- | --- | --- | --- | --- | --- | | **tl;dv** | Yes by default; desktop app (Mac, Windows) records audio only without one | Recordings, transcripts, AI notes; EU (Google Cloud, Hetzner, Wasabi) | Free 3 months; paid until account deletion | Never (policy section 9) | SOC 2 Type II, GDPR; no HIPAA claim, no BAA | | [Read AI](https://www.getvoibe.com/resources/is-read-ai-safe/) | Yes by default; desktop app and Google Meet integration without one | Reports and transcripts, plus audio and video with playback; AWS us-east-1 | Paid: until you stop paying or ask; audio and video at most 2 years | Off (opt-in) | Read states SOC 2 Type II, GDPR; HIPAA on Enterprise+; BAA on request | | [Fireflies](https://www.getvoibe.com/resources/is-fireflies-safe/) | Yes by default; Take Notes in the desktop app without one | Transcript and summary, plus audio and video in bot mode; Fireflies cloud | While the account is active; custom retention Enterprise only | Never (policy) | Fireflies states SOC 2 Type II, ISO 42001, GDPR; BAA on Enterprise with Private Storage | | [Granola](https://www.getvoibe.com/resources/is-granola-safe/) | No | Audio deleted after transcription; notes in a US-hosted AWS cloud | Indefinitely unless a retention policy is set | On for Free and Business (anonymised); opt-out | SOC 2 Type II; HIPAA and BAA Enterprise only | | **Voibe Work** | No (Mac and Windows) | Audio deleted as soon as processing completes; transcript and summary saved on your computer | Your files, your choice | Never trained on | None claimed; BAA available on request | > **Key takeaway:** Every tl;dv recording ends up in its EU cloud. AI features send limited transcript portions to Anthropic in the EU or US region you pick. ## Does tl;dv Train AI on Your Meetings? No, and the Policy Covers Its Vendors **No.** On training, tl;dv's wording is better than most notetakers'. ### The policy text The privacy policy is dated September 9, 2026. Its section 9 covers your recordings, transcripts, notes and files. - None of it trains AI models "for the benefit of tldx Solutions GmbH or any third party". - The same section binds its outside AI providers. They can't use your content to train their general-purpose models. - The policy names Anthropic, through Google Vertex, as its AI provider. - AssemblyAI and ElevenLabs handle transcription. ### How other notetakers compare Otter, Fathom and Granola train on de-identified or anonymised meeting data unless you act. See our reviews of [Otter](https://www.getvoibe.com/resources/is-otter-safe/), [Fathom](https://www.getvoibe.com/resources/is-fathom-safe/) and [Granola](https://www.getvoibe.com/resources/is-granola-safe/). tl;dv's security page makes two more claims. I couldn't verify either. - It anonymises names and emails before data reaches Anthropic. - It sends meetings as small, shuffled chunks. ### One weaker line - The Chrome Web Store listing was updated October 30, 2026. It says your data isn't used to train AI by default, which is weaker than the policy. - The homepage goes further. It promises tl;dv will never use your meetings to train AI. The privacy policy is the binding text. Rely on section 9. ### If you connect AI apps tl;dv's MCP server (Pro and up) lets Claude or ChatGPT read your meetings. What they read falls under the AI company's terms, not section 9. Voibe Work doesn't train on your audio or text either. The difference is where your notes are stored. > **Tip:** Save a copy of tl;dv's privacy policy (September 9, 2026) and terms (effective May 18, 2026). If section 9 changes, you'll have the old wording. ## How Long Does tl;dv Keep Your Meetings, and Can You Delete Them? It depends on your plan. Free recordings expire, and paid ones stay until you delete them or the account. ### The Free plan - Recordings are stored for up to 3 months, then deleted automatically. - After a few days they move to archived storage. Unarchiving can take up to an hour and a half. - tl;dv emails you 4 weeks before deletion. - Deletions run in batches on the 1st of each month. - Outside that 4-week window, you can't download Free recordings, not even from a Pro account. ### Paid plans The policy keeps a paying user's data until account deletion. The pricing page lists a custom data retention period on Pro, Business and Enterprise. ### What lingers longer - Emails of meeting participants with no tl;dv account: 5 years, or until they ask for deletion. The policy cites legitimate interest. - Logs: 10 days - Support tickets: not deleted unless you ask Guests who never signed up have to ask tl;dv to delete their email. ### Deleting and leaving - Deleting a recording is final. tl;dv's help center says: "We do not keep backups nor fallbacks." - tl;dv doesn't say what happens to paid-era recordings after you downgrade or cancel. Export them first. - Under the terms, fees are non-refundable unless otherwise agreed. ## Is tl;dv HIPAA Compliant? SOC 2, ISO 27001 and an Expired Badge **No.** tl;dv makes no HIPAA claim and offers no BAA. Neither term appears in its policy, trust center, security page or help articles. Yet its trust center lists personal health information among the data it collects. - If you handle protected health information, keep it out of tl;dv. - Our [HIPAA dictation guide](https://www.getvoibe.com/resources/hipaa-dictation/) explains why data flow comes first. ### What each claim covers - **SOC 2 Type II** is tl;dv's own. The trust center lists a 2026 SOC 2 Type 2 report. It audits security controls, not where data lives. - **ISO 27001** belongs to the data centres. tl;dv doesn't claim the certificate for itself. - **GDPR** applies because tl;dv is a German company. Its policy names Germany's Federal Commissioner for Data Protection (BfDI) as the main supervisory authority. A DPA is available on request. ### The Privacy Shield badge tl;dv's homepage and security page still show an EU-US Privacy Shield badge. That framework no longer exists. The Court of Justice of the EU struck it down on 16 July 2020 ([press release](https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf)). The ruling in Case C-311/18 invalidated Decision 2016/1250, the adequacy decision behind the Shield. - For US transfers, tl;dv's policy relies on standard contractual clauses instead. - I couldn't confirm whether tl;dv is on the current EU-US Data Privacy Framework list. > **Key takeaway:** No HIPAA claim, no BAA. SOC 2 Type II is tl;dv's own; ISO 27001 belongs to its data centres. Its Privacy Shield badge is outdated. ## What Happened in 2026: The tl;dv Firestore Exposure, Both Sides A researcher found that any logged-in tl;dv user could read other customers' meeting records. He and tl;dv have both published their accounts. ### Timeline - **January 28, 2026:** the researcher says he first reported the flaw to tl;dv. - **March 10:** tl;dv's own routine pentest flags the same flaw and rates it Major. - **March 26:** tl;dv fixes the main access path. - **August 4:** the researcher publishes his post. - **August 5:** tl;dv closes the last remaining path. Its CTO replies on tl;dv's blog. - **August 11:** tl;dv reports the incident to Japan's privacy regulator. - **August 13:** tl;dv tells GIGAZINE it will improve how it handles disclosures. - **August 20:** tl;dv publishes a fuller incident report, in Japanese only. ### What the researcher says The researcher goes by bobdahacker. He published on August 4, 2026 ([full post](https://bobdahacker.com/blog/tldv-hack)). - The meetings collection had no tenant isolation. Any logged-in user could query every meeting on the platform. - Each record showed the creator's email and the conference ID, a joinable Google Meet or Teams room. It also showed the provider, recording status and timestamps. - He counted 181,874 meeting records from 84,312 users across 35,003 email domains. - Those included government meetings from 23 countries. - He says he joined two live calls. One was the Malaysian ministry call, the other a 21-person call at a US university. - He says he reported it on January 28 and that "The CTO never responded." He also notes a limit. For private meetings, the default, he couldn't see the video or transcript. ### What tl;dv says tl;dv put out two statements, one in English and one in Japanese. #### The English statement, August 5, 2026 CTO Allan Bettarel replied on tl;dv's blog. - There were two distinct flaws, not one, the statement says. An outside pentest firm, Abicom, attested to that. - tl;dv says it closed the second within 24 hours of discovery. - Only metadata was exposed: meeting identifiers, conference IDs, and participant emails and domains. - No recordings, transcripts, AI notes or billing data were accessible. - Transcripts and notes were reachable only for meetings users had made public. Public sharing is off by default. - He apologised for not keeping the researcher updated, and took full responsibility for that communication gap. #### The Japanese incident report, August 20, 2026 It's on tldv.io, in Japanese only. I read it on November 2, 2026, and translated these points myself. - tl;dv's own routine pentest flagged the same flaw on March 10, 2026. It rated it Major (重大). - The main path was fixed on March 26. A separate remaining path was closed on August 5. - tl;dv reported the incident to Japan's [Personal Information Protection Commission](https://www.ppc.go.jp/en/) on August 11, 2026. - The cause: temporary data in Firebase wasn't deleted on schedule. An access rule was also misconfigured. - tl;dv kept no request-level records for that path. It says it cannot conclude that no third party viewed the data. - Public meetings were switched to private as a precaution. Affected customers were asked to reissue meeting links. ### Where the two statements disagree They disagree on whether anyone joined a live call. - The English statement says the researcher got meeting URLs in a select few instances. He entered live rooms under an unfamiliar name, and the organizer let him in manually. - The Japanese report says it hasn't been confirmed that anyone actually joined (実際に参加が行われた事実は確認されておりません). The researcher says he joined two calls. The English statement matches his account. ### My read - By both accounts, this exposed links and addresses, not private recordings. - More than six months passed between the first report and tl;dv's first public statement. Its own pentest had rated the flaw Major in March. - Without request logs, nobody can prove the data wasn't read. ### What tl;dv promised next On August 13, 2026, tl;dv [told GIGAZINE](https://gigazine.net/gsc_news/en/20260813-tldv-data-hack/) it would improve its vulnerability disclosure and response processes. Its Japanese report listed removing Firebase as in progress. I found no later update as of November 2, 2026. ## Has tl;dv Been Sued or Banned? **Not that I could find.** No lawsuit, EU regulator action or university ban names tl;dv as of November 2, 2026. My check was a web search, not a docket check. Re-check before you rely on it. ### What I checked - Lawsuits: searches for tl;dv and tldx with class action, lawsuit and wiretap found nothing. - No German or EU data protection action came up. - Japan: tl;dv reported itself to the privacy regulator on August 11, 2026. That isn't an enforcement action. - Several university IT notices block AI notetakers. None I read names tl;dv. Their rules on unapproved third-party assistants still cover its bot. ### Other notetakers are in court Otter ([details](https://www.getvoibe.com/resources/is-otter-safe/)) and Fireflies ([details](https://www.getvoibe.com/resources/is-fireflies-safe/)) face privacy class actions. Granola faces a wiretap suit over capture without a visible bot. If you use tl;dv's desktop app, read our explainer on [the Granola lawsuit](https://www.getvoibe.com/resources/granola-lawsuit/). > **Key takeaway:** I found no lawsuit, EU regulator action or university ban naming tl;dv as of November 2, 2026. Its report to Japan's regulator was a self-report. ## Recording Consent: tl;dv's Consent Collection Is a Real Strength On consent, tl;dv's bot mode beats most rivals. Its desktop mode doesn't. ### Consent Collection Consent Collection swaps your calendar's meeting link for a consent link. Guests who decline aren't recorded. tl;dv's help center (September 24, 2026) adds these details: - If the bot already joined, it leaves within a few seconds. - It only works for calendar meetings recorded automatically. Instant meetings don't trigger it. - The organizer isn't asked for consent. - It needs permission to edit your calendar. - Recurring meetings may not behave consistently. A consent link is a stronger gate than a reminder. ### Where the notice stops - Under the terms, you must get consent from everyone before recording starts. - With desktop or mobile recording, notice is on you. Say it out loud. - Recaps count as disclosure too. tl;dv can auto-email notes to invitees and publish meetings to your whole email domain. A one-line script: "I'm taking AI notes on this call. Is everyone OK with that?" Then wait for each yes. Our [AI notetaker consent laws guide](https://www.getvoibe.com/resources/ai-notetaker-recording-consent-laws/) covers one-party and all-party states. It also covers late joiners and bot-free capture. ### With Voibe Work Voibe Work has no consent link, because no bot joins the call. On this one, tl;dv wins. Voibe reminds you to tell everyone you're taking notes when recording starts. The [recording-consent rules](https://www.getvoibe.com/resources/ai-notetaker-recording-consent-laws/) are yours to follow. ## The tl;dv Safety Decision Tree Five questions, from the easiest case to the hardest. Stop at the first answer you can't accept. 1. **Is it an internal, non-confidential meeting?** Stand-ups, planning, your own team. If yes, tl;dv is a reasonable choice. Keep meetings private. 2. **Will people outside your company join?** Use the bot or Consent Collection so they know. Avoid silent desktop recording. 3. **Will health information come up?** tl;dv offers no BAA. Keep those calls out of it. 4. **Would a leaked join link or invite list hurt?** Think deals, legal matters and public bodies. The 2026 exposure revealed exactly those, and the logs can't show who looked. 5. **Can the meeting sit in tl;dv's EU cloud?** Paid plans keep it until you delete it. If not, use a tool that keeps no copy on its servers. Most internal and sales calls stop at question 1 or 2. Those are fine on tl;dv. Legal, medical and government calls usually reach question 3 or 4. Our notetaker guides for [lawyers](https://www.getvoibe.com/resources/best-ai-meeting-note-taker-for-lawyers/) and [financial advisors](https://www.getvoibe.com/resources/best-ai-meeting-note-taker-for-financial-advisors/) cover those rules. ## The 5-Step tl;dv Safety Audit: Settings to Check Today If you're keeping tl;dv, run these five checks. 1. **Turn on Consent Collection.** Guests can decline before the bot records. It skips instant meetings and the organizer. 2. **Review auto-recording and sharing.** Decide which meetings the bot joins. Turn off auto-emailed notes and domain-wide publishing where they don't fit. 3. **Keep meetings private.** tl;dv made public meetings private after the incident. Re-check any you've made public since. 4. **Pick your AI region.** For EU data residency, choose the EU AI hosting location in your account preferences. tl;dv doesn't publish the default. 5. **Reissue old meeting links.** tl;dv asked affected customers to do this. Replace standing links created before August 5, 2026. ### Which steps matter most Do steps 1 and 5 first. - Step 1 protects the people in your calls. - Step 5 closes what the 2026 exposure may have revealed. Training needs no setting. The policy already rules it out. > **Warning:** Free recordings are deleted after 3 months, and deleted recordings can't be recovered. Export what you need before downgrading or cancelling. ## Where Voibe Work Differs: No Bot, and Notes Saved on Your Computer tl;dv already promises no training and EU hosting. It still keeps a copy of every meeting in its cloud. [Voibe Work](https://www.getvoibe.com/resources/voibe-work-meeting-notes-no-bot/) (ours) saves your notes on your computer, not on Voibe's servers. ### What Voibe Work does differently - No bot in the call, on Mac or Windows. It captures Zoom, Microsoft Teams, Google Meet, Webex, Slack huddles or any other meeting app from your computer. - It also records in-person meetings through your Mac or PC's mic. - Open-source models on zero-retention cloud providers process the audio. It's deleted as soon as processing completes ([what zero data retention means](https://www.getvoibe.com/resources/zero-data-retention/)). - Your transcript and summary are never used to train AI. - Speaker labels you can rename, up to 4 hours per meeting and unlimited meetings - Templates, chat with your meetings, and copy or PDF export - Dictation included - **BAA available on request**, for practices that need one Voibe reminds you to tell everyone you're taking notes when recording starts. The [recording-consent rules](https://www.getvoibe.com/resources/ai-notetaker-recording-consent-laws/) are yours to follow. ### Where tl;dv wins - tl;dv Free records unlimited meetings. Voibe Free covers dictation only. - Consent Collection lets guests decline before recording. Voibe Work has a reminder, not a gate. - tl;dv records video and has iOS and Android apps, CRM integrations and an API. Voibe Work has no video, phone app or CRM integrations. - Voibe Work's meeting notes need an internet connection. On-device processing is a Voibe dictation feature on Apple Silicon Macs, not a meeting-notes feature. ### What it costs Voibe Work is $19 a month, $149 a year or $399 once, per seat. - tl;dv Pro is $18 a month billed annually ($216 a year). That's from its pricing page on November 2, 2026. - Against Pro annual, Voibe Work is $67 (31.0%) less a year. The math: $216 − $149 = $67, and $67 ÷ $216 = 31.0%. - Against Business annual ($348), it's $199 (57.2%) less. - Against tl;dv Free ($0), tl;dv is cheaper for light use. For every plan, cap and bundle, see our [tl;dv pricing breakdown](https://www.getvoibe.com/resources/tldv-pricing/). ### Trying Voibe Work, and switching from tl;dv - 7-day free trial of every Voibe Work feature - No credit card and no automatic charge - After the trial, you move to Voibe Free unless you buy a plan. - Paid plans carry a 30-day money-back guarantee. If you pay for tl;dv now, cancel it. Then email the cancellation confirmation to hi@getvoibe.com. [Voibe's switch offer](https://www.getvoibe.com/resources/switch-to-voibe/) gives you Voibe Work free for the rest of your tl;dv plan. You also get a bonus month, up to 12 months in total. > **Key takeaway:** Voibe Work has no bot, saves notes on your computer and costs $149 a year. tl;dv Free costs less. Consent Collection has no Voibe equivalent. ## Who tl;dv Is Safe For, and Who Should Pick Something Else tl;dv is safe for most internal and sales calls. Turn on Consent Collection first, and keep meetings private. It fits less well when a leaked link or a cloud copy would hurt. Find your situation below. | Your situation | tl;dv verdict | What to do | | --- | --- | --- | | Internal stand-ups and planning | Safe | Keep meetings private; Free recordings expire after 3 months | | Sales and customer calls | Safe with notice | Use the bot or Consent Collection so guests can decline | | EU teams that need EU data residency | Strong fit | Choose the EU AI region; request the DPA | | Recording with the desktop app, no bot | Your responsibility | Tell everyone; there's no automatic notice | | Participants in California, Illinois or another all-party state | Safe only with everyone's consent | Ask each person and wait for a yes | | Patient conversations with health information | Not supported | No BAA; use a tool that offers one | | Privileged legal calls | Risky | Read the [lawyers guide](https://www.getvoibe.com/resources/best-ai-meeting-note-taker-for-lawyers/); prefer no vendor-side copy | | Government or high-profile meetings on standing links | Caution | Reissue links; the 2026 exposure revealed join URLs | | Free users who need an archive | Plan for deletion | Download within the 4-week notice window | Our [tl;dv alternatives](https://www.getvoibe.com/resources/tldv-alternatives/) compare where each notetaker keeps your meetings. The [best no-bot meeting note takers](https://www.getvoibe.com/resources/best-no-bot-meeting-note-takers/) skip the bot entirely. For the rest of your AI tools, see our [AI privacy guide](https://www.getvoibe.com/resources/privacy/). ## Is tl;dv Safe? FAQ Quick answers, grouped by topic. ### Privacy and Your Data **Is tl;dv safe to use?** Yes, for most internal and sales calls. - Its privacy policy bars training on your meetings, by tl;dv and its AI providers. - Data is hosted in the EU. - Consent Collection lets guests decline. - A 2026 flaw exposed join links and organizer emails. - tl;dv kept no request-level logs to rule out other access. - The desktop app records with no automatic notice, and there's no BAA. **Does tl;dv train AI on my meetings?** No. - Section 9 of its privacy policy is dated September 9, 2026. It rules out training for tl;dv or any third party. - It also binds its AI providers, which include Anthropic through Google Vertex. - The Chrome Web Store listing says "by default", which is weaker. The policy is the binding text. **Where does tl;dv store my recordings, and for how long?** In the EU, per its privacy policy. - Google Cloud, Hetzner and Wasabi data centres in Germany and Finland - AI features send limited transcript portions to Anthropic, in the EU or US region you choose. - Free recordings are deleted after 3 months. - Paid recordings stay until account deletion. - Emails of non-client participants can be kept up to 5 years. ### The 2026 Exposure and Legal Record **Was tl;dv hacked in 2026?** A researcher showed that any logged-in user could read other customers' meeting metadata. - That included join links and organizer emails for 181,874 meetings. - He published on August 4, 2026, after first reporting it in late January. - tl;dv closed the last access path on August 5, 2026. - It reported the incident to Japan's Personal Information Protection Commission on August 11, 2026. **Were tl;dv recordings or transcripts exposed?** Not for private meetings, says tl;dv. - tl;dv says no recordings, transcripts or AI notes of private meetings were accessible. - Notes were reachable only for meetings users had made public. - Its Japanese incident report says it kept no request-level logs for the flawed path. Without them, it cannot conclude that no third party viewed the data. - Reissue meeting links created before August 5, 2026. **Has tl;dv been sued or banned?** Not that I could find. - As of November 2, 2026, no lawsuit, EU data-protection action or university ban names tl;dv. - Its report to Japan's privacy regulator was a self-report, not an enforcement action. - My check was a web search, not a docket check. ### Compliance, Consent and Alternatives **Is tl;dv HIPAA or GDPR compliant?** It states GDPR compliance but makes no HIPAA claim. - It offers no BAA, so keep health information out of it. - It offers a DPA. - It holds its own SOC 2 Type II report. Its ISO 27001 claim refers to its data centres. - Its site still shows an EU-US Privacy Shield badge. The EU Court of Justice invalidated that framework in July 2020. **Does tl;dv tell participants it is recording?** The bot does, because it joins as a visible participant. - Consent Collection can ask guests before a calendar meeting. - The desktop app records audio with no bot, and notifications may not appear automatically. - Telling people is your job. Its terms make you responsible for collecting consent from all participants. **What is a safer alternative to tl;dv for confidential meetings?** A notetaker with no bot and no copy on the vendor's servers. - Voibe Work (ours) has no bot and deletes the audio as soon as processing completes. - Notes are saved on your computer and never trained on. BAA available on request. - At $149 a year, it's $67 (31.0%) less than tl;dv Pro annual. - Voibe reminds you to tell everyone you're taking notes. The [recording-consent rules](https://www.getvoibe.com/resources/ai-notetaker-recording-consent-laws/) are yours to follow. ## The Bottom Line: Is tl;dv Safe in 2026? **tl;dv's written promises are strong.** Its no-training policy even binds its AI providers, and its EU hosting beats most notetakers. Its weak points are about 2026, and what it can prove: - a 2026 flaw that exposed join links and organizer emails to any logged-in user - no request-level logs, so tl;dv can't rule out other access - more than six months from first report to first public statement - English and Japanese statements that disagree on live-call joins - a desktop mode that records with no automatic notice - no BAA, and an expired Privacy Shield badge on its site ### If you're keeping tl;dv I'd keep it for internal and sales calls. Run the five-step audit above first. Re-check when the privacy policy date moves past September 9, 2026. ### If the meeting shouldn't sit in a vendor's cloud [Voibe Work](https://www.getvoibe.com/resources/voibe-work-meeting-notes-no-bot/) captures it from your Mac or Windows PC with no bot. The audio is deleted as soon as processing completes. - Notes are saved on your computer and never trained on. - Dictation is included. - It costs $149 a year. Voibe reminds you to tell everyone you're taking notes when recording starts. The [recording-consent rules](https://www.getvoibe.com/resources/ai-notetaker-recording-consent-laws/) are yours to follow. [Start the 7-day free trial](https://www.getvoibe.com) (no credit card). ### Related reading - [tl;dv pricing](https://www.getvoibe.com/resources/tldv-pricing/) - [tl;dv alternatives](https://www.getvoibe.com/resources/tldv-alternatives/) - [Is Read AI Safe?](https://www.getvoibe.com/resources/is-read-ai-safe/), [Is Fireflies Safe?](https://www.getvoibe.com/resources/is-fireflies-safe/), [Is Krisp Safe?](https://www.getvoibe.com/resources/is-krisp-safe/) and [Is Notta Safe?](https://www.getvoibe.com/resources/is-notta-safe/) - [AI meeting note taker pricing compared](https://www.getvoibe.com/resources/ai-meeting-note-taker-pricing/) - Our [AI Tool Privacy Tracker](https://www.getvoibe.com/resources/ai-privacy-tracker/), which scores notetakers side by side > **Info:** I checked every source on November 2, 2026. If tl;dv's privacy policy is dated after September 9, 2026, re-check before relying on these facts. ## Frequently asked questions ### Is tl;dv safe to use? Yes, for most internal and sales calls. Its privacy policy bars training on your meetings by tl;dv and its AI providers. Data is hosted in the EU, and Consent Collection lets guests decline. On the other side, a 2026 flaw exposed join links and organizer emails. tl;dv kept no request-level logs to rule out other access. The desktop app records with no automatic notice, and there's no BAA. ### Does tl;dv train AI on my meetings? No. Section 9 of its privacy policy (September 9, 2026) says Customer Content isn't used to train AI models for tl;dv or any third party. It also binds its AI providers, which include Anthropic through Google Vertex. Its Chrome Web Store listing says "by default", which is weaker. The policy is the binding text. ### Where does tl;dv store my recordings, and for how long? In the EU: Google Cloud, Hetzner and Wasabi data centres in Germany and Finland, per its privacy policy. AI features send limited transcript portions to Anthropic in the EU or US region you choose. Free recordings are deleted after 3 months. Paid recordings stay until account deletion. Emails of non-client participants can be kept up to 5 years. ### Was tl;dv hacked in 2026? A security researcher showed that any logged-in tl;dv user could read other customers' meeting metadata. That included join links and organizer emails for 181,874 meetings. He published on August 4, 2026, after first reporting it in late January. tl;dv closed the last access path on August 5, 2026. It reported the incident to Japan's Personal Information Protection Commission on August 11, 2026. ### Were tl;dv recordings or transcripts exposed? tl;dv says no recordings, transcripts or AI notes of private meetings were accessible. Notes were reachable only for meetings users had made public. Its Japanese incident report says it kept no request-level logs for the flawed path. Without them, it cannot conclude that no third party viewed the data. Reissue meeting links created before August 5, 2026. ### Has tl;dv been sued or banned? I found no lawsuit, EU data-protection action or university ban naming tl;dv as of November 2, 2026. Its report to Japan's privacy regulator was a self-report, not an enforcement action. My check was a web search, not a docket check. ### Is tl;dv HIPAA or GDPR compliant? tl;dv makes no HIPAA claim and offers no BAA, so keep health information out of it. It states GDPR compliance, offers a DPA and holds its own SOC 2 Type II report. Its ISO 27001 claim refers to its data centres. Its site still shows an EU-US Privacy Shield badge, a framework the EU Court of Justice invalidated in July 2020. ### Does tl;dv tell participants it is recording? The bot does, because it joins as a visible participant. Consent Collection can also ask guests before a calendar meeting. The desktop app records audio with no bot, and notifications may not appear automatically. Telling people is your job. Its terms make you responsible for collecting consent from all participants. ### What is a safer alternative to tl;dv for confidential meetings? A notetaker with no bot and no copy on the vendor's servers. Voibe Work (ours) has no bot and deletes the audio as soon as processing completes. Notes are saved on your computer and never trained on. BAA available on request. At $149 a year, it's $67 (31.0%) less than tl;dv Pro annual. Voibe reminds you to tell everyone you're taking notes, and recording-consent rules are yours to follow. ## Related - [tl;dv Pricing](https://www.getvoibe.com/resources/tldv-pricing/): Every tl;dv plan, the Free-plan limits and what a year costs per seat. - [tl;dv Alternatives](https://www.getvoibe.com/resources/tldv-alternatives/): Notetakers that skip the bot, or keep your meeting notes off the vendor's servers. - [Is Read AI Safe?](https://www.getvoibe.com/resources/is-read-ai-safe/): Read AI's opt-in training, a bot that spreads and the universities that block it. - [Is Fireflies Safe?](https://www.getvoibe.com/resources/is-fireflies-safe/): Fireflies' no-training terms, where its meetings live and the BIPA suit. - [Is Krisp Safe?](https://www.getvoibe.com/resources/is-krisp-safe/): Where a Krisp meeting goes, who processes it and what Enterprise changes. - [AI Notetaker Recording Consent Laws](https://www.getvoibe.com/resources/ai-notetaker-recording-consent-laws/): One-party and all-party states, late joiners and what bot-free capture changes.