01
Local-first, encrypted at rest
Capture and grouping run on your machine. The local store is encrypted with your OS keychain. What leaves the device is opt-in, scoped, and visible to you.
Quick check before I install. What does Recall actually see while I work?
Honest answer: app names, document titles, time on task, and switching patterns. Capture runs on your device. Nothing leaves unless you turn on sync, and even then it is metadata, never raw screen content.
That is the answer I needed. Now I want to stress-test the privacy claims.
the trust question, asked before install
Want a second opinion?
Use the prompt below to have ChatGPT, Claude, or Perplexity review Recall’s published privacy claims.
This reviews our published privacy architecture, not proprietary implementation code.
Priya Sharma
Solo founder · privacy-first SaaS
Chapter 04 · TrustEvaluating new tools
15:55
Second opinion
Check it yourself, like Priya does.
Priya is evaluating Recall before installing it on her work laptop. The product looks useful, but one question comes first: what does it see, what stays local, and what can she delete?
If a tool watches my screen, I want a straight answer before I let it in.
Tell me what Recall sees. Then let a second opinion stress-test the claim.
That is why we make the privacy model readable. You can ask any AI assistant to review the claims, find gaps, and tell you what still needs proof.
Six promises
The defaults are the policy.
02
Screen only, never your mic
Recall reads what you can see on screen across tabs and apps. It never opens the microphone, the camera, or the system audio. No voice, no calls, no video.
03
No third party gets your work
No third party receives your work content. Zero analytics SDKs, zero tracking pixels, zero ad networks. We do not sell, share, or syndicate your context.
04
No training on your work
Your sessions are not used to train any model, ours or anyone else's. The patterns Recall learns about your day stay scoped to you.
05
Pause and forget in one tap
One toggle pauses capture. One action wipes a session, a day, or everything. Forgetting is not buried in settings.
06
No manager dashboard
Recall is for the person doing the work. There is no team-wide view of who opened what or for how long. Surveillance is not a feature.
What Recall captures
The shape of the work, not the words.
- Active app and document title, when it helps the thread
- Tab URL stems and titles you stay on, not every flicker
- Time-on-task patterns across tools
- Context cards you confirm or correct
What Recall does not capture
The lines we will not cross.
- Microphone audio, calls, or voice of any kind
- Camera, webcam, or video feeds
- Keystrokes, passwords, or clipboard contents
- Content of password, payment, or 2FA fields (auto-redacted)
- Private message bodies, DMs, or email content
- Banking, medical, or other surfaces flagged sensitive
- Anything inside a private or incognito window
- Anything while Recall is paused
Compliance and guarantees
The same answer in every jurisdiction.
If your team or your legal review needs the boring details, here they are. No asterisks, no enterprise-only carve-outs. The defaults are the policy.
EU / UK
GDPR ready
You have the right to access, export, or delete every byte Recall holds about you, on demand and without friction. Data minimization is the default, not a setting.
United States
CCPA aligned
California residents can request a full export or full deletion at any time. We do not sell personal information, full stop, in any state.
On disk
AES-256 at rest
The local Recall store is encrypted with a key bound to your OS keychain. If your laptop is locked, your context is locked with it.
Vendors
No work-content sub-processors
No third party receives your work content. Providers used for basics like app distribution, payments, email, hosting, or licensing do not receive the context of your work. AI features run against your own provider key, or against a local model.
Architecture at a glance
The whole privacy spec, on one screen.
Six layers, each with a one-line scope. If you are reviewing Recall for your team, paste this into your AI of choice and ask it the hard questions. The answers should not require us in the room.
Where the work lives
Local first is not a marketing line.
Capture, grouping, and the patterns Recall learns about your day all run on your device. The boundary below is the one we will not cross without you.
Your device
Stays here, by default
- Active app, document title, window state
- Time-on-task patterns and switching shape
- Session groupings and the labels you confirm
- Encrypted local store, scoped to your user account
Cloud, if you choose
Almost nothing.
- Your account profile and license state
- Session metadata, only if you turn on sync
There is no work content to clone, leak, or delete from our side. Pause, scope by app, or wipe local history at any time, in one tap.
Technical boundary
What Recall can know, and what it should never keep.
Metadata can still be sensitive. That is why Recall keeps the useful signal narrow, local by default, and visible to you.
What Recall reads
App names, window or document titles, URL domains and stems, time-on-task, switching patterns, and context labels you confirm or correct.
What Recall does not keep
No microphone audio, camera, system audio, keystrokes, clipboard contents, passwords, payment fields, 2FA fields, private or incognito windows, or raw screen recordings.
What can sync
Sync is off by default. If enabled, it is limited to account and license state and selected session metadata, not raw screen content.
What you control
Pause capture, exclude apps, windows, or domains, edit context cards, or delete a session, a day, or everything from one place.
Work contentThe actual contents of your work: message bodies, email bodies, documents, calls, voice, video, passwords, payment details, private windows, or raw screen content.
Session metadataThe minimal structure Recall uses to help you return: app and window context, rough timing, switching patterns, and labels you approve.
Common questions
What people ask before they install.
Where does my data live?
On your machine, in an AES-256 encrypted store keyed to your OS keychain. Nothing leaves the device unless you explicitly enable sync, and even then only the high-level session metadata you choose, never raw screen content.
Does Recall record audio, calls, or video?
Never. Recall only reads what is already visible on your screen across tabs and apps. The microphone, the camera, and system audio are never touched. Voice and video are out of scope by design.
Does Recall store screenshots?
No raw screen recordings are stored. Recall is designed to keep the work signal narrow: app and window context, timing, switching patterns, and labels you confirm. Any temporary processing is discarded and is not kept as history.
Can notifications or sensitive titles be captured?
Recall avoids known sensitive surfaces and lets you exclude apps, windows, and domains. Metadata can still be sensitive, so the default is local storage, pause is one tap, and exclusions apply before any new history is kept.
Do you collect logs or crash reports?
We do not use analytics SDKs or tracking pixels. If diagnostics are added later, they will be opt-in or scoped, and they will not include work content.
Are you GDPR and CCPA compliant?
Yes to both. EU and UK users can request access, export, or full deletion at any time. California residents have the same rights under CCPA. We collect the minimum needed to make Recall work, and we do not sell personal information in any jurisdiction.
Do you share data with third parties or sub-processors?
No third party receives your work content. Providers used for basics like app distribution, payments, email, hosting, or licensing do not receive the context of your work. AI features that require a model run against your own provider key or against a local model.
Can my employer see this?
No. There is no team-wide dashboard, no manager view, no leaderboard. Recall is built for the person doing the work, not for someone watching them.
What if I open something sensitive?
Recall ignores known sensitive surfaces by default, auto-redacts password, payment, and 2FA fields, and skips private and incognito windows entirely. You can also exclude any app, window, or domain permanently, or tap pause and capture stops immediately.
Can I delete what Recall remembers?
Yes. Remove a single session, an entire day, or every recorded byte from one screen. Forgetting is not buried in settings.
Do you use my data to train models?
No. We do not use your work to train anything, ours or anyone else's. The patterns Recall learns about your day stay scoped to your device.