Granola makes meeting notes open to anyone with the link, even without your knowledge

Users of the AI app Granola have made an unpleasant discovery: despite the advertised privacy by default, meeting notes are in practice accessible to anyone who has the direct link. The service also uses this data for internal AI model training, unless the user disables the feature themselves.

Granola positions itself as an "AI notepad for people who go from one meeting to the next." The app connects to your calendar, records the audio of conversations and uses AI to automatically build a structured summary: a list of the key points from the discussion. Users can edit the generated text, invite colleagues to collaborate and ask questions about what was discussed through a built-in AI assistant.

The problem is that the access model works differently from what users expect. On its security policy page, Granola says notes are "private by default," but technically that only means they are not publicly indexed. Anyone who gets the direct link to a note can open it without any restrictions. For corporate users who discuss strategy, personnel matters or financial figures, this model poses a real risk of leaks.

The use of data for model training is a separate issue. By default, the content of notes may be used to improve Granola's AI systems. To turn this off, you have to find the relevant setting and uncheck the box manually. Most users do not know this option exists.

The situation fits a broader trend: workplace AI tools often collect and process sensitive data without transparently informing users. Corporate negotiations, deal details, personnel discussions: all of it ends up in service databases, under policies written so as not to formally break the law while in practice giving maximum freedom to use the content.

If you use Granola, it is worth opening the settings right now: check who can access your notes via link, and disable data sharing for model training if you are not willing to share the content of your work meetings. It takes two minutes, but it may prevent unwanted consequences.