Privacy

Last updated September 17, 2026

Recall is a handwriting notebook for iPad. Notes are encrypted on your device before they are sent to us. This page says exactly what we store, what we can read, and who else your data passes through.

Who we are

Recall is operated by Yan Song, Kungsvägen 114A, 352 44 Växjö, Sweden. Questions, or a request about your data: recall-notes.com/support.

What we store

• Your account: email address, when it was confirmed, a random salt, a verifier derived from your password (not the password itself), and your encryption key wrapped by your password. Sessions are stored as hashes, never as usable tokens.
• Your notes: encrypted files. Each note is encrypted on your iPad with a key only you hold, and we store the result. Titles, handwriting, transcriptions, photos and folder names are all inside that encrypted file.
• The search index: numeric vectors of your transcribed text, with note and page IDs and character positions. No text or summaries are stored — the vectors let the server find a passage that your app or a connected AI app then reads from its own copy.
• Usage and billing: which model transcribed a page, token counts, credits deducted, purchases, and your subscription status. Never note content.
• Connected apps: which app you connected, when, when it was last used, and hashed access tokens.
• Server logs: request paths and timings, and your IP address, used to apply rate limits and to investigate abuse. Logs rotate and are discarded within days.

What we can and can't read

Your notes are encrypted with a key derived from your password on your device. Which protection level you chose decides whether we hold a copy of that key:

• Standard protection: we keep a copy of your key, wrapped with our own escrow key, so you can reset a forgotten password by email and so AI apps you connect can read your notes. This means we are technically able to decrypt your notes. We use that ability only for those two purposes, and only when you ask for them.
• Advanced protection: we hold no copy of your key. Nobody but you can decrypt your notes — not us, and not anyone who compels us. If you lose both your passphrase and your recovery key, the notes are unrecoverable.

Transcription sends your pages to AI providers

To turn handwriting into text, the app sends the page image to our server, which forwards it to the model you picked. The page image and the resulting text pass through:

• Anthropic (Claude models), United States
• OpenRouter and the provider it routes to, for Qwen, GLM and DeepSeek models

We don't keep the image, and the text goes back to your device inside your encrypted note. Those providers handle it under their own terms. If "Double-check transcriptions" is on in Settings, each page is also read by a second, cheaper model, so it passes through one more provider. Turning that setting off stops it.

Other services we use

• Hetzner (Germany) — the server that stores your encrypted notes and database.
• Stripe — payments. Card details go straight to Stripe; we never see them. We store your Stripe customer and subscription IDs.
• Resend — transactional email (confirmation, password reset, security notices).
• Cloudflare R2 — encrypted off-site backup copies.
• An AI app you connect (for example Claude or ChatGPT) receives the notes it asks for, when you ask it to search or read them. You can disconnect it at any time from your dashboard, which immediately stops its access.

How long we keep things

• Notes, account data and the search index: until you delete them or delete your account.
• Backups: encrypted nightly copies, kept about 14 days locally and about 30 days off-site. Deleted notes disappear from backups as those roll off.
• Billing records: kept as long as tax and accounting rules require.
• Server logs: days.
• When you confirm an email address for the first time we keep a one-way hash of it, so the one-time signup bonus can't be claimed repeatedly. It survives account deletion and can't be turned back into your address.

Deleting your account

Settings → Delete account in the app, or the dashboard on this site. It cancels any subscription, deletes your notes, search index, credits and connected apps, and removes the account itself. It can't be undone, and purchased credits aren't refunded.

Your rights

You can ask what we hold about you, get a copy, correct it, or have it deleted. Your notes are already on your device, and you can export any note as a PDF from the app. For anything else, write to us at recall-notes.com/support and we'll respond within 30 days. If you're in the EU or UK and you think we've handled your data badly, you can complain to your national data protection authority.

Children

Recall isn't intended for children under 13, and we don't knowingly collect their data.

Changes

If this policy changes in a way that matters, we'll email the address on your account before the change takes effect. The date at the top always shows the current version.