Privacy Policy

1. Overview

This Privacy Policy explains how Bartosz Bryg, owner of Recallith (“Recallith,” “we,” “us,” or “our”), collects, uses, stores, and protects personal information when you use the Recallith desktop application, Chrome extension, account services, or website at www.recallith.com.

Recallith is local-first. The desktop app, capture system, storage, indexing, and retrieval engine run on your machine. Captured memories are not uploaded to Recallith servers. Account, subscription, and session information is handled through Supabase. If you choose a cloud AI provider, your question and retrieved memory context are sent to it.

2. What we collect

A. Memory data stored on your device

• Browser tab activity and page content.
• AI conversation content from ChatGPT, Claude, Gemini, Perplexity, and Microsoft Copilot.
• Search queries you make within Recallith.
• Optional screenshots, if you turn on the screenshot fallback (off by default). They are processed locally by the desktop app to extract text.
• Capture starts only after you review and save your capture settings in the desktop app. You can choose categories, block sites and pause capture.
• Authentication tokens are redacted from newly captured content.
• All memories, indexed content, and retrieval data.
• Conversation text in the events database is encrypted at rest with AES-256-GCM by default, using a key in your operating system keychain.
• Page URLs, other event metadata, search-index documents and metadata, legacy capture fields, browser queues, and logs are stored unencrypted on your device.
• Data stored in a local SQLite database and ChromaDB.

B. Data stored on OUR servers through Supabase

• Email address, required to create an account.
• Full name, optional and supplied during signup or Google OAuth.
• Profile avatar URL, optional and received only through Google OAuth.
• Subscription plan: Free or Pro.
• Account creation date.
• Authentication session data needed to keep you signed in.

C. What we explicitly do NOT collect

• The content of your captured memories.
• Your browsing-history content.
• Your AI-conversation content.
• Your password; Supabase handles passwords and we never store or see them.
• Your payment-card details; Stripe will handle them when payments are implemented.

3. How we use your data

• Email: account authentication, password resets, and important product updates.
• Name and avatar: display in your account dashboard only.
• Subscription plan: determine access to Free and Pro features.
• Authentication session data: sign-in and session renewal.

We do not use your data for advertising. We do not train AI models on your data. We do not sell your data to third parties.

4. Data storage and security

• Conversation text fields in the events database are encrypted locally with AES-256-GCM by default; the other local fields listed above are not.
• Your encryption key is stored in your operating system keychain.
• Account data is stored with Supabase; its region depends on the project's configuration.
• Passwords are hashed and managed by Supabase using bcrypt; Recallith never receives plaintext passwords.
• HTTPS protects data in transit between your browser, app, and account services.
• Local session tokens are cryptographically random, stored temporarily, and rotated when the app/backend session is recreated.

Recallith does not upload captured memories to its servers. If you select Claude or OpenAI, your question and retrieved memory context are sent to that provider. Local Ollama keeps those prompts on your device.

5. Third-party services

Supabase

Receives your email, optional name/avatar, subscription data, and authentication session data for authentication and account storage. Read the Supabase Privacy Policy.

Cloud AI providers

If you choose Claude or OpenAI in the desktop app, that provider receives your question and retrieved memory context to generate an answer. The local Ollama option keeps those prompts on your device.

Google OAuth

If you choose Google sign-in, Google provides your email, name, and optional avatar. We receive only the information Google supplies during sign-in. Read the Google Privacy Policy.

Stripe

Stripe payment processing is coming soon. Stripe will process payment details, and Recallith will never see your full card number. Read the Stripe Privacy Policy.

Vercel

Vercel hosts the website and may receive standard web-server logs, including IP address, browser, and requested pages, under its standard log-retention practices. Read the Vercel Privacy Policy.

Google Fonts

Google may receive your IP address when your browser loads the fonts used for site typography. Read the Google Privacy Policy.

6. Your rights

EU/GDPR rights

If you are in the European Union, you may request access, correction, deletion, export, restriction of processing, data portability, or withdrawal of consent. You may also lodge a complaint with your supervisory authority.

US/California rights

California residents may request the right to know, delete, and opt out of sale, and may exercise their rights without discrimination. Recallith does not sell personal information.

Submit requests to hello@recallith.com. We aim to respond within 30 days.

7. Data retention

• Account data is retained until you delete your account.
• Following account deletion, server-side data is removed from Supabase within 30 days, subject to legal or security retention obligations.
• Local memory data remains on your device and is not affected by account deletion.
• Delete local data with Recallith's in-app deletion features or by uninstalling the application and removing its local data.

8. Cookies and local storage

The Recallith website uses browser localStorage to retain the Supabase authentication session. It does not use advertising cookies, tracking pixels, or third-party analytics cookies. The desktop application does not use browser cookies.

9. Children's privacy

Recallith is not directed to children under 16, and we do not knowingly collect personal information from minors. If you believe a minor created an account, contact hello@recallith.com for prompt deletion.

10. Changes to this policy

We will notify registered users by email of material changes at least 14 days before they take effect. Continued use after the effective date constitutes acceptance. Previous versions are available on request.

11. Contact

Recallith is owned by Bartosz Bryg. Email privacy or data-rights questions to hello@recallith.com. EU data requests are answered within 30 days. For urgent security issues, use the subject “URGENT.”