Privacy Policy

1. Overview

This Privacy Policy explains how Bartosz Bryg, owner of Recallith (“Recallith,” “we,” “us,” or “our”), collects, uses, stores, and protects personal information when you use the Recallith desktop application, Chrome extension, account services, or website at www.recallith.com.

Recallith is local-first. The desktop app, capture system, storage, indexing, and retrieval engine run on your machine. Captured memories are not uploaded to Recallith servers. Only limited account, subscription, and session information is stored remotely.

2. What we collect

A. Data that stays on YOUR device — we never see this

• Browser tab activity and page content.
• AI conversation content from ChatGPT, Claude, Gemini, Perplexity, and Microsoft Copilot.
• Search queries you make within Recallith.
• All memories, indexed content, and retrieval data.
• Content encrypted with AES-256-GCM using a key stored in your operating system keychain.
• Data stored in a local SQLite database and ChromaDB.

B. Data stored on OUR servers through Supabase

• Email address, required to create an account.
• Full name, optional and supplied during signup or Google OAuth.
• Profile avatar URL, optional and received only through Google OAuth.
• Subscription plan: Free or Pro.
• Account creation date.
• App session metadata such as device name, operating system, and last-seen time.

C. What we explicitly do NOT collect

• The content of your captured memories.
• Your browsing-history content.
• Your AI-conversation content.
• Your password; Supabase handles passwords and we never store or see them.
• Your payment-card details; Stripe will handle them when payments are implemented.

3. How we use your data

• Email: account authentication, password resets, and important product updates.
• Name and avatar: display in your account dashboard only.
• Subscription plan: determine access to Free and Pro features.
• Session metadata: account security and device/session management.

We do not use your data for advertising. We do not train AI models on your data. We do not sell your data to third parties.

4. Data storage and security

• Your memories are encrypted locally with AES-256-GCM.
• Your encryption key is stored in your operating system keychain.
• Account data is stored with Supabase in US East (North Virginia).
• Supabase states that it is SOC 2 Type 2 certified.
• Passwords are hashed and managed by Supabase using bcrypt; Recallith never receives plaintext passwords.
• HTTPS protects data in transit between your browser, app, and account services.
• Local session tokens are cryptographically random, stored temporarily, and rotated when the app/backend session is recreated.

We cannot access your local memory data under any circumstances because it never leaves your device through Recallith's systems.

5. Third-party services

Supabase

Receives your email, optional name/avatar, subscription data, and app-session metadata for authentication and account storage in US East (North Virginia). Read the Supabase Privacy Policy.

Google OAuth

If you choose Google sign-in, Google provides your email, name, and optional avatar. We receive only the information Google supplies during sign-in. Read the Google Privacy Policy.

Stripe

Stripe payment processing is coming soon. Stripe will process payment details, and Recallith will never see your full card number. Read the Stripe Privacy Policy.

Vercel

Vercel hosts the website and may receive standard web-server logs, including IP address, browser, and requested pages, under its standard log-retention practices. Read the Vercel Privacy Policy.

Google Fonts

Google may receive your IP address when your browser loads the fonts used for site typography. Read the Google Privacy Policy.

6. Your rights

EU/GDPR rights

If you are in the European Union, you may request access, correction, deletion, export, restriction of processing, data portability, or withdrawal of consent. You may also lodge a complaint with your supervisory authority.

US/California rights

California residents may request the right to know, delete, and opt out of sale, and may exercise their rights without discrimination. Recallith does not sell personal information.

Submit requests to hello@recallith.com. We aim to respond within 30 days.

7. Data retention

• Account data is retained until you delete your account.
• Following account deletion, server-side data is removed from Supabase within 30 days, subject to legal or security retention obligations.
• Local memory data remains on your device and is not affected by account deletion.
• Delete local data with Recallith's in-app deletion features or by uninstalling the application and removing its local data.

8. Cookies and local storage

The Recallith website uses browser localStorage to retain the Supabase authentication session. It does not use advertising cookies, tracking pixels, or third-party analytics cookies. The desktop application does not use browser cookies.

9. Children's privacy

Recallith is not directed to children under 16, and we do not knowingly collect personal information from minors. If you believe a minor created an account, contact hello@recallith.com for prompt deletion.

10. Changes to this policy

We will notify registered users by email of material changes at least 14 days before they take effect. Continued use after the effective date constitutes acceptance. Previous versions are available on request.

11. Contact

Recallith is owned by Bartosz Bryg. Email privacy or data-rights questions to hello@recallith.com. EU data requests are answered within 30 days. For urgent security issues, use the subject “URGENT.”