Privacy Policy

The data controller for all personal data processed by Recl is the Recl operator, reachable at hello@recl.app. We respond to all privacy requests within 30 days.

We do not collect: precise location, contacts, advertising identifiers, or data from third-party data brokers. The camera, photo library and microphone are used only when you choose to: to take or pick a photo to save, or to send a photo or voice message in support chat.

• When you save content, the transcript or text is sent to our AI provider (OpenRouter) to generate summaries, topics, quiz questions, and category labels.
• AI requests are scoped to the single piece of content being processed. Your library as a whole is never used to train AI models — neither by us nor, per their terms, by our AI provider.
• We create vector embeddings of your saved videos and nuggets, stored in our own database and scoped to your account. They power search by meaning in the Chrome extension and the similarity links in your knowledge graph.
• AI outputs can be wrong. They are labeled as generated content and are never represented as professional advice.

• Primary database and application servers: an Amazon Web Services (AWS) EC2 server in the Mumbai region (ap-south-1).
• Encrypted backups and uploaded images: Cloudflare R2 object storage.
• All traffic is encrypted in transit (TLS 1.2+). Backups of secrets are GPG-encrypted at rest.
• Access to production systems is limited to the operator, via key-based SSH.

We share data only with the subprocessors needed to run the service — never for advertising, and never by selling it. In the mobile apps these include RevenueCat (in-app purchase and subscription state), Zoho SalesIQ (in-app support chat), Sentry (crash and error diagnostics), and Google ML Kit (on-device translation: the text you translate never leaves your phone; Google receives anonymous diagnostics such as device model, language pair and error codes). The current list, with purposes and regions, is maintained on the Subprocessors page. We may also disclose data if required by law, or to protect the rights, safety, and security of Recl and its users.

Retention periods per data category are documented on the Data retention page. In short: your content stays as long as your account exists; deleting your account deletes your content; operational logs rotate within weeks; billing records are kept as long as tax law requires.

Depending on where you live (GDPR in the EU/EEA/UK, CCPA/CPRA in California, and similar laws elsewhere), you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (most profile data is editable in Settings).
• Erasure — delete your account and all associated content (self-serve in the app under Profile → Settings → Delete account, on the web under Settings → Danger zone, or by email).
• Portability — receive your saved content in a machine-readable format.
• Restriction & objection — limit or object to specific processing.
• Withdraw consent — disable push notifications at any time.
• Complain — lodge a complaint with your local data-protection authority.

To exercise any right that isn't self-serve, email hello@recl.app. We verify requests against your signed-in account email and respond within 30 days. See GDPR & EU users for the full process.

Recl is not directed at children under 16 and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

Recl uses strictly-necessary first-party cookies (session, CSRF protection) and Google Analytics cookies to understand how its sites are used. Recl runs no ads or advertising tags. Visitors from the EEA, the UK and Switzerland get analytics cookies only if they accept them (in the recl.app banner; the choice applies to app.recl.app too). Details, and how to change your choice, on the Cookie policy page.

We will update this page when our practices change and revise the “Last updated” date above. For material changes affecting your rights we will notify you in-app or by email before they take effect.

@reco.save is a mascot/sub-brand Instagram account operated by Recl (not the official recl.app Instagram). When you DM it, we process your Page-scoped user ID (PSID), the message content (reel/post links and attachments), and the email address you provide to link your Recl account — solely to save shared content to your library and send save receipts. Retention: DM link rows are kept 90 days after deletion/unlink; webhook event records are kept 90 days. Deletion: reply DELETE in-DM at any time, use the Meta data-deletion callback, or email hello@recl.app. Subprocessors for this flow are Cloudflare (edge delivery), Resend (one-time-code email), Supadata (content fetch), and OpenRouter (AI summaries) — see the Subprocessors page for details.

You can connect your Recl library to an AI assistant that supports remote MCP servers, such as ChatGPT, Claude or Cursor (see Recl in your AI assistant). You choose which app to connect and approve what it may do: read (search and open your saves, see what's due) and, if you allow it, add (save links, mark reviews done, ask questions about your saves).

When the app uses a Recl tool, we send it the result: for example matching titles, summaries, key points, your notes or what's due today. That happens at your direction, and from then on the app's provider handles that text under its own privacy terms. An app can only reach your own library, never other people's saves or your Google or Apple account. Recl doesn't see your conversations with the app.

Retention: access tokens expire after 15 minutes; refresh tokens after 30 days unless the app renews them while you use it. Your approval stays until you disconnect. Disconnecting: Settings → Connected apps on app.recl.app removes the approval and every token at once, so the app loses access on its next request. Deleting your account removes all of it.

If you join with an invite or creator code, we record the code, who it belongs to, how it reached you (a link, the Google Play install referrer, a typed code, our website, or added by our support team at your or the creator's request), which platform you signed up on, when you signed up, and whether and when you became a paying subscriber, with the amounts you paid. To prevent abuse we also keep a one-way hash of your network prefix and of your app install. We never store your IP address.

When someone opens a creator's link (recl.app/r/…), a one-way keyed hash of their IP address (for IPv6, only the network part, /64) and browser user-agent string is used to count unique visitors per day. The hash is kept for up to 4 days, only the daily count is stored, and the IP address is never stored.

If the code belongs to a creator, the creator sees totals and amounts (for example “11 paid subscribers, $23.52 commission”) and each payment by day (platform, plan and amount). They never see who signed up: not your name, email, country or what you save.

If you are a creator, we keep your application (name, email, social accounts, follower count, niche, country, where your audience lives, your preferred payout method and the creator terms version you agreed to), your code and its statistics, your payout method and payout handle (UPI ID or PayPal / Wise email; for bank transfers we collect details by email and don't store them in the app), your acceptance of the creator terms, and records of commissions and payouts, including the amount, currency, method, date and the transaction ID of each payout. Tax documents you send us are kept outside the app. When you open your creator dashboard we refresh the one-way hash of your network prefix, so sign-ups from your own network can be held for review.

Retention: payment records (amount, currency, tax and fee, store country and the store transaction or payment ID) are kept as long as tax and accounting law requires; when an account is deleted they are no longer linked to it. A creator's commission and payout records, with the name, email and payout handle they were paid under, are kept for the same period, also after the creator deletes their Recl account. The rest of the creator data is deleted on request when you leave the program (we keep payout and tax records as required by law). The legal basis is our contract with you (paying creators), legal obligation (accounting records) and legitimate interest (preventing referral fraud).

Privacy questions and requests: hello@recl.app.