Privacy Policy

Recall ("we", "us", "our") is an AI revision tool for UK GCSE and A-Level students, operated by Recall. This policy explains, in plain English, what data we collect, why, and what your rights are. We comply with the UK GDPR, the Data Protection Act 2018, and the ICO's Age Appropriate Design Code (Children's Code).

Contact: recallappai@gmail.com

1. Designed for young people

Most of our users are under 18. We follow the Children's Code by default:

We collect the minimum data needed to run the service.
We do not profile you for advertising and we do not sell your data.
Privacy-protective settings are on by default.
This policy is written in language students can understand.
We do not use nudge techniques to push you to share more data than necessary.

The service is intended for users aged 13 and over. If you are under 13, please ask a parent or guardian to contact us so we can remove your account.

2. What we collect

Account data: your email address and (optionally) display name when you sign up.
Study content: the notes you paste in and the study sets we generate from them, when you choose to save them.
Usage data: how many generations you've made today (for free-tier limits) and the mode used (flashcards / quiz / summary / exam).
Subscription data: if you upgrade to Pro, Gumroad tells us your sale ID, subscription ID and the email used at checkout so we can unlock Pro on your account.
Technical data: standard logs (IP, browser type, error reports) used to keep the service running and secure.

We do not knowingly collect any special category data (e.g. health, ethnicity). Please don't paste that kind of information into the notes box.

3. Why we use it (and our legal basis)

To provide the service — generating study material from your notes and saving sets you choose to keep. Legal basis: contract.
To enforce limits — counting daily generations on the free plan. Legal basis: legitimate interests (preventing abuse).
To run Pro subscriptions — matching your Gumroad purchase to your Recall account. Legal basis: contract.
To keep the service safe — logs and error reports. Legal basis: legitimate interests.
To respond to you — if you email us for support. Legal basis: legitimate interests.

4. Who we share data with (sub-processors)

We use a small number of trusted providers to run Recall. We never sell your data.

Supabase — hosts our database and handles sign-in. Stores your account, your saved study sets, and usage counters. Data is hosted in the EU.
Gumroad — processes Pro subscription payments. When you check out, Gumroad collects your payment details directly; we never see your card. Gumroad shares your email and subscription status back to us.
Google (Gemini) — the AI model that turns your notes into study material. When you generate, we send the contents of the notes box to Google's Gemini API. Per Google's terms for paid Gemini API usage, your prompts and outputs are not used to train Google's models. We do not send your name, email or account ID to Google.
Cloudflare — serves and protects the website.

Some of these providers may process data outside the UK (for example in the EU or the US). Where this happens we rely on appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

5. How long we keep your data

Account & saved study sets: kept until you delete them or delete your account.
Generation counters: retained for up to 30 days to enforce daily limits.
Subscription records: kept while your subscription is active and for up to 6 years afterwards to meet UK tax and accounting rules.
Technical logs: typically up to 30 days.

6. Your rights

Under UK GDPR you can ask us to:

see a copy of your data (right of access);
correct something that's wrong (rectification);
delete your account and content (erasure);
limit or object to how we use it;
get your data in a portable format.

You can delete saved study sets yourself from your dashboard at any time. For anything else, email recallappai@gmail.com and we'll respond within 30 days.

If you're unhappy with how we've handled your data you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies and tracking

We use a small number of strictly necessary cookies/local storage entries to keep you signed in and remember UI preferences (like theme and whether you've completed the welcome tour). We do not use advertising or cross-site tracking cookies.

8. Security

Data is transmitted over HTTPS and stored in access-controlled databases with row-level security so users can only access their own content. No system is 100% secure, but we take this seriously.

9. Changes to this policy

If we make material changes we'll update the "last updated" date above and, where appropriate, notify you in the app or by email.

10. Contact

Questions or requests: recallappai@gmail.com.