PSA: Anyone with a link can view your Granola reviews by default

If you use the AI ​​note-taking app Granola, you may want to double-check your privacy settings. Nevertheless Granola says Your notes are “private by default,” making them viewable to anyone with a link, and you also use them for internal AI training unless you opt out.

Granola He describes himself As an “AI-powered notepad for people in back-to-back meetings.” It integrates with your calendar to capture audio from your meetings, then uses AI to create a bulleted list of what you heard, which it calls a “note.” You can edit AI-generated notes, invite other collaborators to view them, use Granola’s AI Assistant to ask questions about your notes and review the meeting transcript they’re based on.

But in the app’s settings menu, Granola says, “By default, your notes are viewable to anyone with the link.” This means anyone on the web can see your notes if you accidentally share a link – potentially a big problem if you’re recording sensitive meetings. After testing this myself, I found that I could access my private note from a private window in my browser, all without logging into my Granola account. The site also tells you who the note belongs to and when it was created.

Although I couldn’t view the full text associated with the note, I could still view parts of it. Selecting one of the Granola-generated points pulls up a quote from the text the note refers to, as well as an AI-generated summary with additional context about the conversation.

On its websiteGranola says, “Full access to text is available to collaborators who open the same folder or note within the Granola desktop app.” It’s not clear whether anyone with a Granola account can access your text, or whether only people you’ve shared your workspace with. Granola did not respond to a request for further information by press time.

You can change who can view your links by opening Granola, selecting your profile in the lower-right corner of the screen, then choosing Settings. From there, go to the “Share Default Link” option, and change “Anyone with the Link” to “My Company Only” or “Private.” If you delete your note, people with the link will no longer be able to access it.

one User on LinkedIn He called attention to the public feedback setting last year, saying: “These links are not indexed, but if you share or leak one — even accidentally — they become public for whoever finds them.” A source said that at least one major company had refused to use the tool to a senior executive due to security concerns Edge.

Additionally, Granola may use anonymized data to improve its AI models, according to Application support page. AI training is opted out by default on enterprise customers, but not for people on all other plans. You can disable AI training by going to the settings menu and turning off the “Use my data to improve models for everyone” option. The company says it doesn’t allow third-party companies, like OpenAI or Anthropic, to use your data to train AI if the setting is enabled.

Granola security page The company stores your notes in a private Amazon Web Services cloud hosted in the US, which it says is “encrypted at rest and in transit.” The company doesn’t store audio from meetings either. It only saves meeting notes and transcripts, which are processed in the cloud.