Privacy policy

The short version. Recall Note runs inside your browser. Without an account, nothing you import, write or review ever reaches us — there is no server in the loop, and we have nothing about you to lose, hand over or delete. With an account, your collection is mirrored onto our servers so your other devices can read it, and that copy includes the PDF files themselves. We sell nothing to anyone, we show no advertising, we run no analytics, and no part of your documents is ever sent to an AI model.

1. Who is responsible

The controller of your personal data is [À COMPLÉTER — éditeur : nom et forme juridique], [À COMPLÉTER — adresse]. For anything concerning your data, write to recallnote@proton.me.

This policy covers the Recall Note website and the Recall Note application. It does not cover the sites of the companies listed in section 6, each of which has its own policy.

2. Without an account, nothing leaves your device

This is not a promise about our intentions; it is how the application is built. Everything the product does with your course happens on your own machine:

• opening a PDF and displaying its pages;
• extracting its text, so a highlight can be anchored to the exact passage;
• highlighting, and turning a passage into a card;
• reading the labels drawn inside a captured figure — the character recognition runs in your browser, from files this site serves itself. No pixel of your figures is sent anywhere;
• scheduling your reviews;
• exporting everything to a standard .apkg file.

Your collection lives in your browser's own storage, and your preferences — theme, language, chosen accent — in a handful of local keys. What each one holds is listed in the cookie and storage policy.

As long as you have no account, the application opens no connection to us for any of it. It works with the network switched off, and in that state we hold nothing about you whatsoever.

3. What changes the moment you create an account

Creating an account turns synchronisation on. There is no separate switch to flip. From the moment you are signed in, and for as long as your plan allows it, the application mirrors your collection onto our servers in the background so that your other devices can pick it up. We say it plainly here because it is the single most important thing to understand before signing up.

What we hold about you

• Your email address, which identifies the account.
• Your password, never in clear. It is held as an irreversible hash by our authentication provider; we cannot read it, and neither can anyone who obtains the database.
• A session token, stored by your browser so that you stay signed in.
• Your plan, and the date the account was created.

What is copied from your collection

• Your rows — documents, folders, notes, cards, decks and settings, as you wrote them.
• Your review journal — one entry per review, with its date and the answer you gave. It is append-only: it is never rewritten, on our side or yours.
• Your files. The PDFs you import are copied too, not merely the text extracted from them, along with the pixels of the figures you capture and any image or sound you attach. Without them, a card could not reopen its passage on another device. This is the part of the copy that actually contains your course material, and it is why the sentence at the top of this page is worded the way it is.

What is never copied

The scheduling state of each card — when it is next due, how strongly you remember it — stays on your machine. It is rebuilt locally from your review journal, so sending it would create a second version of the truth that could drift from the first.

4. What we never do

• We never sell, rent or hand over your data to anyone for their own purposes.
• There is no advertising on this site or in the application, and no advertising identifier of any kind.
• There is no analytics and no tracker. No audience measurement script, no third-party pixel, no session recording — not on the marketing pages, not in the application.
• We do not profile you, and no decision about you is taken automatically.
• Nothing you write or import is sent to an AI model. The generation feature was removed from the product on 24 August 2026, and with it every relay to a model provider: there is no longer any code path by which a passage of your course could reach one.
• We do not read your documents. Access is restricted by the technical measures described in section 9, and we open a collection only if you ask us to in writing, for support.
• We never train anything on your data.

5. Why we hold it, and on what legal basis

• Running the service — the account, and the mirror that makes your collection available on your other devices: performance of the contract between you and us (GDPR art. 6.1.b).
• Billing — performance of the contract, and the accounting obligations that come with it (art. 6.1.b and 6.1.c).
• Keeping the service standing — preventing abuse, and the technical logs that make a failure diagnosable: our legitimate interest in a service that works, weighed against the small amount of data involved (art. 6.1.f).
• The feedback you send us from the application: your consent, given by the act of writing to us (art. 6.1.a).

6. Who else touches your data

We use three companies to run the service. They act on our instructions, under a contract, and may not use your data for their own purposes.

• Vercel — hosting of the site, of the application and of the payment endpoints. The server functions run in the Dublin region, in Ireland. [À COMPLÉTER — entité contractante et adresse]
• Supabase — accounts, database and file storage: this is where the copy described in section 3 lives. The project is hosted in the European Union, in Ireland. [À COMPLÉTER — entité contractante et adresse]
• Stripe — payment. Your card details never reach us: they are entered on Stripe's own pages. We receive the fact that a payment succeeded, and which plan it opens. [À COMPLÉTER — entité contractante et adresse]

Where it is stored. Your account and your collection stay in the European Union: the servers are in Ireland, and nothing described in section 3 is held anywhere else. Payment is the one place to look further — Stripe operates worldwide, and its own policy governs where payment data travels and under what safeguards. [À COMPLÉTER — confirmer l'entité Stripe contractante et renvoyer à ses clauses de transfert.]

7. How long we keep it

• Your account and your collection — for as long as the account exists.
• After you delete your account — your files are removed first, then the account itself, and everything attached to it falls with it. Backups roll off after [À COMPLÉTER — délai de rotation des sauvegardes].
• Billing records — ten years, which is the retention that accounting law imposes on us, and which we cannot shorten at your request.
• Feedback you send us — [À COMPLÉTER — durée].
• Anything held only in your browser — until you clear your browser's data for this site. We cannot delete it for you, because we cannot see it.

8. Deleting everything

You can delete your account from the application's settings. It is a real deletion and not a flag: your files are erased from storage, then your account is removed, and your rows, your review journal and your profile fall with it. Nothing is kept in a shadow copy.

Your local collection is a separate matter — it stays on your machine, which is the point of it. Clearing your browser's data for this site removes it.

9. How it is protected

• Everything travels over an encrypted connection.
• Every table enforces row-level security: an account can read and write its own rows and nothing else, and this is enforced by the database itself rather than by the application asking politely.
• The file storage is private. Each account has its own folder, and the access rule is keyed on the account identifier — there is no address at which someone else's PDF can be requested.
• Your password is held as an irreversible hash, never in clear.
• The review journal accepts additions only. No update, no delete, for anyone.

No system is beyond reach. If you believe you have found a security flaw, write to recallnote@proton.me and we will answer.

10. The feedback button

When you send us feedback from inside the application, we receive your message, the name of the screen you were on, your email address if you chose to give one, and the identifier of your account if you were signed in. Nothing else travels with it — not your cards, not your documents.

11. Your rights

You may ask us for access to your data, for its correction, for its erasure, for a portable copy, for a restriction of a processing, or object to one carried out on the basis of our legitimate interest. Where a processing rests on your consent, you may withdraw it at any time, and that does not call into question what was done before.

Write to recallnote@proton.me. We answer within one month; if the request is complex we will tell you so within that month and take up to two more. Access to your own data costs nothing.

You may also lodge a complaint with a supervisory authority — in France, the CNIL, 3 place de Fontenoy, 75007 Paris.

Two of these rights are already in your hands without writing to anyone: portability, because you can export your whole collection to a standard .apkg file at any time, review history included; and erasure, through the deletion described in section 8.

12. Cookies

This site sets no cookie and loads nothing from a third party. The application stores what it needs to work offline and to keep you signed in, and none of it tracks you. What is stored, why, and for how long is set out in the cookie and storage policy.

13. Age

Recall Note is meant for students of 15 and over, which is the age from which French law lets someone consent on their own to the processing of their data. If you are under 15, a parent or guardian must agree on your behalf before you create an account. We do not knowingly hold data about younger children; if you believe we do, write to recallnote@proton.me and we will erase it.

14. Changes to this policy

If we change what we do with your data, we change this page and move the effective date at the top. A change that materially affects you will be announced in the application before it takes effect, not slipped in.

15. Getting in touch

For any question about this policy, or to exercise any of the rights in section 11: recallnote@proton.me.