Privacy Policy
The short version
recall runs on your machine. No data ever leaves your server — not your code, not your queries, not what you build. The index is a local SQLite file; the dashboard is loopback-only. The only thing we ever check is your license / account. We genuinely do not know what you do with it.
What we collect
- Account data — your email address and, for password accounts, a salted password hash (never the password itself); for social sign-in, the provider's stable account id. Plus your plan and trial date. We use this solely to operate your account and issue your license; we delete it when you delete your account, except where law requires us to retain billing records.
- License / entitlement checks — when you sign in, and then about once an hour, the tool contacts us to confirm your seat is still active. It sends only your account session, an anonymous device identifier, the tool version it is running and a “last seen” timestamp — never your repository, queries or code. We use the device identifier solely to enforce one active device per seat, and the version and timestamp to operate the service and understand which versions are in use. We log security-relevant account events (sign-up, sign-in, license issue/revocation) in an audit trail.
- Never collected — your repository contents, recall queries, the index, or any source code.
Website analytics
- Vercel Web Analytics (Vercel Inc.) — aggregated page-view and performance statistics. It runs only with your consent via the cookie banner (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG). Although it is cookieless and uses no cross-site profiles or persistent identifiers, it still accesses your device, so we treat it as opt-in analytics rather than relying on legitimate interest. Data is processed for us under Vercel's data processing agreement. You can withdraw at any time via “Cookie settings” in the footer.
- Google Analytics 4 (Google Ireland Ltd. / Google LLC) — runs only with your consent via the cookie banner (Art. 6 (1) lit. a GDPR). It sets cookies and processes usage data with IP anonymization enabled; data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework. You can withdraw your consent at any time via “Cookie settings” in the footer. See Google's privacy policy.
Cookies
Strictly necessary cookies only, by default: the session cookie that keeps you signed in, the short-lived sign-in state cookie, and your cookie-banner choice itself. On the billing page, when you start a purchase, Stripe sets its own strictly necessary cookies (__stripe_mid, __stripe_sid) for fraud prevention. Google Analytics cookies are set only after you consent.
Payment data
Payments are processed by Stripe, Inc. We never see or store your card number; Stripe shares with us only what is needed to fulfil the purchase (plan, billing status, a customer reference). See Stripe's privacy policy and data processing agreement.
Bot protection (hCaptcha)
The sign-in and sign-up form is protected by hCaptcha, a service of Intuition Machines, Inc. (USA), to tell humans from automated abuse. When you complete the challenge, hCaptcha processes your IP address and interaction data to score the request; it does not set advertising cookies. The legal basis is our legitimate interest in securing accounts and preventing fraud and spam (Art. 6 (1) lit. f GDPR); any transfer to the USA relies on the appropriate safeguards in hCaptcha's terms. See hCaptcha's privacy policy. The public contact and support pages use plain email links only — no third-party form and no tracking.
Your rights (GDPR / DSGVO)
You have the right to access, rectify, erase and receive (portability) your personal data, to restrict or object to its processing, and to withdraw any consent at any time. Deleting your account from the account page exercises erasure directly. For anything else, email us at the address below — we answer within the statutory period. You also have the right to lodge a complaint with a supervisory authority; for us that is the Bavarian Data Protection Authority (BayLDA), Ansbach, Germany.
Contact / Controller
Kathrin Mc Cain — McCain Digital, Holderweg 1, 86869 Oberostendorf, Germany. Email: info@mccain-digital.com. whatever-recall is a product and service of McCain Digital; all official email (support, info, payment) comes from @mccain-digital.com addresses.