Privacy at Recall

When Memory Helper is enabled, opening its empty shell, organising material, finding cues, rehearsing, and creating or editing your own version do not make an AI request. Learner-created and learner-edited text stays in this browser and is never sent through the Memory Helper AI action.

Only an explicit Create suggestion action can contact the separate endpoint. That bounded request contains one validated activity target: controlled IDs, the protected answer or structure fields needed for that target, short labels, and source evidence. One permitted replacement may also include the immediately preceding AI-generated aid. It never includes a learner-created or learner-edited version.

Memory Helper requests exclude the original PDF, filename, raw pasted draft, unselected text, learner responses, attempt history, review schedule, and other saved practices. Saved helpers, aids, preferences, and pending exposure markers remain local and are removed with their saved practice or by clearing all Recall data.

Recall's server validates the request, then sends the confirmed section and controlled generation instructions to its configured OpenAI Responses API provider. The provider returns one structured activity; Recall validates its method, shape, source anchors, and evidence before showing or saving it.

An explicitly requested generated memory aid uses the same configured Responses API provider through a separate, versioned prompt and strict response schema. It cannot change the saved activity, score an answer, or update Review timing.

Provider requests use stateless mode with store: false. Recall does not create provider files, conversations, background responses, or reusable prompt state containing your source text.

This configuration is not a promise of zero provider retention or special legal treatment. The provider and hosting platform may process operational data under their applicable terms and policies.

The hosting platform necessarily exposes network metadata to Recall's server. For abuse and cost protection, the server converts available network metadata into a keyed digest using a rotating server secret. This creates a pseudonymous network bucket; it is not described as anonymous data.

The rate-limit store receives the digest, controlled counters, and expiry times—not source or learner text. Counter records expire no later than 25 hours after the last counted generation attempt.

A random request ID also holds a content-free in-flight lock to prevent duplicate provider calls. That lock expires after at most two minutes. Network-bucket keys are not included in product-event totals or analytics reports.

After a generated activity passes validation, Recall saves the confirmed source section, controlled learner settings, generated activity, activity preferences, attempts, and review-unit schedules in this browser profile's IndexedDB. When Memory Tools is enabled, its saved aids, preferred-aid choices, and content-free pending exposure markers use separate local stores. It does not save the original PDF, filename, raw pasted draft, or unselected source text.

Saved data is specific to this device and browser profile. The MVP has no account, cloud backup, or cross-device sync. Clearing browser site storage may remove saved study sets and review material.

The Library can delete one study set together with its attempts and review units. The Privacy & data menu in Recall can clear every Recall-owned IndexedDB store without clearing unrelated origin data.

Recall can be deployed with optional, coarse product analytics. The app continues to work when analytics is disabled or unavailable.

When enabled, the browser sends one approved event at a time to Recall's own endpoint. Recall stores daily totals rather than individual event records and removes those totals after 90 days. No third-party tracking script is used.

If enabled, analytics categories are limited to controlled source-input and preparation outcomes, generation outcomes and error categories, approved method and engine IDs, practice and review progress, coarse count buckets, deletion events, and controlled activity-report categories.

Analytics does not receive source text, excerpts, filenames, free-text difficulty notes, generated answers, learner responses, study titles, memory-aid text, AI request bodies, local record IDs, or content hashes. A short-lived pseudonymous network bucket limits event spam, but it is not joined to or shown in the daily totals. Operational server logs may contain request IDs, timestamps, duration, response status, configured model identifier, coarse token or cost aggregates where available, and typed error categories—but not educational content.