Privacy Policy

1. What QuickMeet Does

QuickMeet is a browser extension that creates meeting links with one click. It currently supports Google Meet, Jitsi Meet, Zoom, and Microsoft Teams — Cisco Webex and Zoho Meeting are planned for a future version. It has no user accounts. For Google Meet, Jitsi, and Teams there is no server on our side; the extension talks directly to those providers. For Zoom, we operate a minimal stateless relay (a small stateless forwarder) because Zoom's API architecture does not allow direct browser calls — details in Section 3b.

2. What we don't collect

QuickMeet collects no data that could identify you personally. Specifically, we do NOT:

• Track your name, email, or any account details
• Record or store the meeting links you create — not on the extension, not on the Zoom relay, not anywhere
• Log your browsing activity or the tabs you have open
• Use cookies
• Retain any data that flows through the Zoom relay (it is stateless — see Section 3b)

The only data we do collect is anonymous usage information — see Section 6 for the exact list, in plain language.

3. OAuth Tokens (for Zoom and Microsoft Teams)

If you connect a provider that requires a login (currently Zoom and Microsoft Teams — Cisco Webex and Zoho Meeting are planned for a future version), QuickMeet will guide you through that provider's official sign-in screen.

After you sign in, the provider gives QuickMeet an access token — a temporary key that lets the extension create meetings on your behalf. This token is stored locally in your browser using Chrome's built-in secure storage (chrome.storage.local). It is:

• Encrypted by Chrome and accessible only to the QuickMeet extension
• Never stored on any server (for Teams, tokens go directly to Microsoft; for Zoom, tokens pass through our relay in transit only — see Section 3b — and are never persisted)
• Deleted immediately when you click "Disconnect" in the extension
• Used only to create meeting links on your behalf

3b. The Zoom Relay (why it exists, what it does, what it doesn't)

What it is: A minimal Cloudflare Worker (roughly 140 lines, of which most are explanatory comments) that forwards Zoom API requests from the extension to Zoom's servers.

Why it exists: Zoom's REST API (api.zoom.us) rejects all browser-origin requests with an "Invalid CORS request" error. This is by Zoom's design — they require API calls to come from server-to-server contexts. Every browser extension that creates Zoom meetings needs some server-side component to work around this. Our relay is the minimum needed to bridge the gap.

What the relay DOES:

• Receives your Zoom API request from the extension (with your Bearer token attached)
• Forwards that exact request to api.zoom.us from the Cloudflare server (which has no browser origin)
• Returns Zoom's response back to your extension

What the relay DOES NOT do:

• Store your access token — it flows through in transit only (roughly 50 milliseconds) and is not persisted anywhere
• Store, log, or retain the meeting URLs Zoom returns
• Log requests, users, IPs, or any usage data — the relay does not contain any storage or logging code
• Reach any other host — the target api.zoom.us is hard-coded, not user-configurable
• Accept anonymous requests — it requires a Bearer token that Zoom itself validates
• Handle Google Meet, Jitsi, or Teams — those talk directly to their providers with zero relay involvement

What you have to trust: Since the Worker runs on Cloudflare's infrastructure, you can't cryptographically verify from the outside that the deployed code matches what we describe. You are trusting our word that the relay does exactly what's described above — no more, no less. If you're building a QuickMeet integration where that level of trust isn't enough, please email us and we'll share the code so you can review it and, if you prefer, deploy your own copy under your Cloudflare account. Cloudflare's platform also produces infrastructure-level request metrics (aggregate counts, edge locations, response codes — not per-user data or request contents) that are visible only to the QuickMeet developer for billing and reliability purposes; we cannot fully suppress these.

Provider by provider — where your data goes:

• Google Meet: Extension opens a background tab at meet.google.com and reads the meeting URL. Uses your existing Google login. No involvement from us.
• Jitsi Meet: Extension generates a URL locally. No API call, no login, no involvement from us.
• Microsoft Teams: Extension calls Microsoft Graph directly with your Bearer token. No involvement from us. (Note: Microsoft's API only supports Teams meeting creation for work/school accounts, not personal accounts — this is Microsoft's policy.)
• Zoom: Extension calls the relay, which calls Zoom. Details above.

4. Permissions the Extension Requests

• tabs — Required to open a background tab for Google Meet link generation and to read the URL of that tab once Meet creates a meeting code. QuickMeet does not read URLs of any other tabs.
• storage — Required to save your preferences (default provider, recently used providers) and OAuth tokens locally on your device.
• identity — Required to show the provider's sign-in window (OAuth flow) for Zoom, Teams, Webex, and Zoho.
• clipboardWrite — Required to automatically copy the created meeting link to your clipboard.
• offscreen — Required so QuickMeet can copy the meeting link to your clipboard even if you close the popup before the link finishes being created. Chrome MV3 service workers cannot access the clipboard directly; an invisible offscreen document is Chrome's official mechanism for background clipboard writes. Used only for this single purpose.

5. Third-Party Services

When you create a meeting link, QuickMeet communicates with the provider's official API (directly for Google, Jitsi, and Teams; via our minimal stateless relay for Zoom — see Section 3b). Your data is governed by that provider's own privacy policy:

• Google Meet — policies.google.com/privacy
• Zoom — zoom.us/privacy
• Microsoft Teams — privacy.microsoft.com
• Jitsi Meet — jitsi.org privacy
• Cloudflare (hosts the Zoom relay described in Section 3b — sees only aggregate infrastructure metrics, never request contents) — cloudflare.com/privacypolicy
• PostHog (anonymous analytics — see Section 6) — posthog.com/privacy

Cisco Webex and Zoho Meeting are planned for a future version and are not currently active. Their privacy policies will be added here when those providers are enabled.

6. What we learn about how QuickMeet is used

We want QuickMeet to keep getting better. To do that we need a rough sense of two things — which meeting providers people actually use, and roughly where in the world QuickMeet is being used. That is the entire list of what we look at.

Every time you successfully create a meeting link, we send this to PostHog, an analytics tool built to respect privacy:

• Which provider you chose — Google Meet, Zoom, Teams, or Jitsi
• A random ID that identifies your extension install, so we can count unique users. It's not tied to your name, email, or Google/Zoom/Teams account in any way. Uninstalling QuickMeet deletes it.
• Your approximate location — country, and roughly which city. This is derived from your IP address, and then the IP itself is discarded. We never see or store the raw IP.

Just as importantly, here is what we never see:

• The meeting link, its contents, or anything about the meeting itself
• Your name, email address, or any account you use with Google, Zoom, Teams, or Jitsi
• Your browsing history, other tabs you have open, or anything you do outside QuickMeet
• Who joins your meetings, how long they last, or what happens in them

The reason we track anything at all is simple. Knowing that most people create Google Meet links (rather than Zoom or Teams) helps us decide what to build next. Knowing who those people are personally would not help us — and would be a betrayal of the promise this extension makes. So we collect the first and never the second, by design.

PostHog is GDPR-compliant, uses no cookies, and does not track you across other websites. Their privacy policy is at posthog.com/privacy.

7. Data Retention

Since we store no data on our own servers, there is nothing for us to retain or delete. Data stored locally in your browser (preferences and OAuth tokens) can be cleared at any time by:

• Clicking "Disconnect" for each provider in the extension settings
• Uninstalling the extension (Chrome removes all extension storage on uninstall)
• Clearing Chrome's extension storage via Chrome settings

8. Children's Privacy

QuickMeet is not directed at children under 13. We do not knowingly collect any information from children.

9. Changes to This Policy

If we make material changes to this privacy policy, we will update the "Last updated" date at the top of this page. Continued use of the extension after changes are posted constitutes acceptance of the updated policy.

10. Contact

If you have any questions about this privacy policy or how QuickMeet handles data, please contact us at:

quickmeet@eightai.workCopy