Key Takeaways

• Granola, an AI-powered note-taking app, operates with a default setting that makes your meeting notes viewable to anyone with a link, despite claiming they are “private by default.”
• Unless you are an enterprise customer, Granola defaults to using your “anonymized data” for internal AI model training, a setting users must manually opt out of.
• Users must proactively adjust two critical privacy settings – default link sharing and AI data usage – to protect sensitive meeting content and personal data from unintended exposure or training.

In an era dominated by rapid AI adoption, tools designed to streamline our professional lives are becoming indispensable. Among them, AI-powered note-taking apps like Granola promise to revolutionize meeting productivity, transforming spoken words into actionable insights. However, the convenience they offer often comes with a hidden caveat: an intricate web of privacy settings that, if overlooked, can expose sensitive information to unintended audiences. For users of Granola, it’s a stark reminder that “private by default” may not always mean what it seems. A closer look reveals that your meticulously captured meeting notes might be more accessible than you think, and your data more readily used for AI training unless you take specific actions.

The AI Assistant: A Double-Edged Sword for Privacy

Granola positions itself as the ultimate “AI notepad for people in back-to-back meetings,” a compelling proposition for the modern knowledge worker. Its core functionality is undeniably appealing: seamlessly integrating with your calendar to record meeting audio, then deploying sophisticated AI to distill these conversations into concise, bulleted “notes.” Beyond mere transcription, Granola empowers users to refine these AI-generated summaries, collaborate with colleagues, and leverage an AI assistant to query meeting transcripts, offering an unparalleled level of post-meeting productivity.

Yet, beneath this veneer of efficiency lies a crucial detail often overlooked: the default privacy configuration. While Granola’s marketing may suggest inherent privacy, the app’s settings menu tells a different story: “By default, your notes are viewable to anyone with the link.” This isn’t just a minor technicality; it’s a fundamental aspect of data accessibility that could have significant repercussions.

“Private by Default” or Public by Link?

The implications of this default setting are profound. Imagine recording a confidential board meeting, a sensitive client discussion, or even a personal conversation, only for those notes to be potentially accessible to anyone who stumbles upon a shared link. Our investigation confirmed this vulnerability: a note created in Granola was easily accessible from a private browser window without requiring any login credentials. The publicly viewable page even displayed the note’s owner and creation timestamp, adding another layer of identifying information to potentially sensitive content.

While the full meeting transcript remained hidden from public view, key excerpts were not. Clicking on an AI-generated bullet point within the note revealed a direct quote from the underlying transcript, coupled with an AI-synthesized summary offering additional context. This partial access still exposes significant chunks of conversational data, enough to potentially compromise sensitive discussions. Granola’s website vaguely states that “full transcript access is available to collaborators who open the same folder or note inside the Granola desktop app,” leaving ambiguity as to whether any Granola user could gain such access or if it’s strictly limited to explicitly invited workspace members. Our attempts to seek clarification from Granola on this crucial point went unanswered by publication time.

This isn’t a new concern. A user on LinkedIn highlighted this “public by link” setting last year, warning that “these links aren’t indexed, but if you share or leak one – even accidentally – it’s public to whoever finds it.” The real-world implications are tangible: a source indicates that at least one major corporation has explicitly prohibited a senior executive from using Granola due to these very security concerns. The risk of intellectual property leaks, competitive intelligence exposure, or even personal data breaches is substantial when such a fundamental privacy setting is left open by default.

Your Data, Their AI: The Training Opt-Out

Beyond public links, another critical privacy consideration is Granola’s approach to AI model training. According to its support page, the company “may use anonymized data” to enhance its AI models. While enterprise customers are automatically opted out of this data usage, individual users on all other plans are opted *in* by default. This means that, without explicit action, your meeting data – even if “anonymized” – could be contributing to the development and refinement of Granola’s AI algorithms. While Granola states it prevents third-party AI companies like OpenAI or Anthropic from using your data for training when this setting is enabled, the concept of “anonymized data” itself can be complex and sometimes imperfect, potentially still revealing patterns or topics that could be sensitive.

Taking Control: Adjusting Your Privacy Settings

Fortunately, users are not without recourse. Granola provides options to modify these default settings, but the onus is entirely on the user to make these crucial adjustments. To restrict who can view your notes via a shared link:

1. Open the Granola application.
2. Select your profile icon, typically located in the bottom-left corner of the screen.
3. Navigate to “Settings.”
4. Find the “Default link sharing” option.
5. Change the setting from the default “Anyone with the link” to either “Only my company” or “Private.”

It’s important to remember that if you delete a note, any previously shared links will cease to function, effectively revoking access.

To opt out of having your data used for AI model improvement:

1. Go to the same “Settings” menu.
2. Locate and toggle off the “Use my data to improve models for everyone” option.

These steps are essential for anyone using Granola, especially if your work involves sensitive or proprietary information.

Granola’s Underlying Security: A Glimmer of Reassurance

Despite these default privacy shortcomings, Granola does implement several foundational security measures. According to its security page, notes are stored in a US-hosted Amazon Web Services (AWS) private cloud, benefiting from robust infrastructure. Furthermore, all data, whether at rest or in transit, is encrypted, a standard practice for protecting digital information. Critically, the company asserts that it does not store audio recordings from meetings, only the AI-generated notes and their underlying transcripts, all of which are processed within their secure cloud environment. While these measures are commendable and address common security vectors, they do not negate the necessity for users to actively manage their privacy preferences regarding link sharing and AI data training.

Bottom Line

The Granola app exemplifies the ongoing tension between convenience and privacy in the age of AI. While its AI-powered note-taking capabilities offer significant benefits, the default settings for link sharing and AI model training present considerable risks to user privacy and data security. This serves as a critical reminder for all users of AI tools: never assume privacy is automatically granted. Always delve into the settings, understand the default configurations, and proactively adjust them to align with your personal or organizational security requirements. In the fast-evolving landscape of artificial intelligence, vigilance remains your most powerful privacy tool.