Privacy Policy

This privacy policy is applicable to the Recalli app for mobile devices and web browsers, together with any related services operated by Kent Daniel (collectively, the "Application"). Kent Daniel is hereinafter referred to as the "Service Provider".

Data Controller Information

Kent Daniel acts as the Data Controller responsible for the processing of your personal data.

• Name: Kent Daniel
• Email: support@recalli.app

For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.

What information does the Application obtain and how is it used?

The Application and related services acquire the information you supply when you download, access, or register for the service. An account is required to use the Recalli mobile app: you create it by signing in with Apple or Google. The sign-in provider gives the Application your account identifier and, if you choose to share them, your email address and name (Apple may give a private relay address instead of your real one). Some features of the website can be used without an account. Before you sign in for the first time, the app asks for your birth year; it only keeps a yes/no answer to "16 or older" and the date you answered, on your device, and never stores the year.

The Service Provider may also use the information you provide to send important information, required notices, and, where permitted by law, marketing communications.

What data is stored, and where?

• On your device: your decks, the cards you create or import, your study progress, streak, goals, exam dates and settings are stored on your phone. Photos you add to cards or use as wallpapers stay on your device. Pictures that come with notes you import (from a file, a folder or a .zip export) are copied onto your device only; they are not uploaded. If an import links to pictures on other websites, the app asks first and downloads them only when you allow it; those websites then see a request from your device, as with any web link.
• Profile photo (optional): if you add a profile photo, the app keeps a small copy (about 192 pixels) on your device. For Recalli Pro subscribers it is also synced to the cloud with your other settings. It is shown to other people only if you turn on "Show photo on my public page"; you can turn that off or remove the photo at any time.
• In the cloud (Google Firebase): your account identifier and, if you claim one, your username (the name in recalli.app/u/yourname). For Recalli Pro subscribers, cloud backup and sync also store your decks, cards, progress and settings so they follow you across your devices.
• Public page (Recalli Pro, optional): if you turn on your public stats page, your username, streak and study counts (and your profile photo, if you choose to show it) are visible to anyone at recalli.app/u/yourname. You can turn it off at any time in the app, which removes the page.
• Forum (recalli.app/forum): posts are public. Anyone can read them, and each post is stored with your account identifier (not your name or email) so that you can delete it and so abuse can be handled. Votes are stored with your account identifier too and are not shown to others. If you report a post, the report (the post, the reason, your optional note and your account identifier) is seen only by the Service Provider. You can delete your own posts; deleting your account deletes your posts and votes.
• Student discount (optional): to check that you are a student, you enter a school email address. The Service Provider sends a 6-digit code to that address through Resend. After you confirm the code, only a one-way hash of the address (not the address itself), the date you verified and the date the discount ends are stored with your account, so one school address can be used by one account. The code is kept for at most 15 minutes.
• Beta list: if you join the beta on recalli.app, your email address and the time you signed up are stored. After you confirm by clicking the link in the email we send, your address is given to Apple TestFlight so Apple can send you the beta invitation. You can ask to be removed at any time.
• Usernames: if you claim a username, it can be found by other Recalli users who search for it.

Device features the Application can use

• Notifications: study reminders are scheduled on your device. You choose whether and when to receive them.
• Calendar (optional): if you switch on Calendar reminders, the Application asks for access to your calendar and adds daily study events to a calendar named "Recalli" on your device. These events are created and kept by your device and calendar account; the Service Provider does not receive them. "Add to Google Calendar" opens Google Calendar with a pre-filled event.
• Photos and camera (optional): used only when you choose a picture for a card or a wallpaper, or take a photo for a card.
• Widgets: the Recalli home screen widget reads your study data from storage shared on your device between the app and the widget, and records the reviews you do in the widget there. This does not leave your device.

Usage data and analytics

If you allow it, the Application sends pseudonymous counts, such as cards studied and features used, linked to a random install identifier rather than your name or email. No text you type and no screen recordings are sent. In the web app at recalli.app/app, usage data is off until you choose "Allow"; on iPhone and iPad you choose during setup. You can change your choice at any time (Settings, then Privacy). To store these counts, the Application opens an anonymous Firebase sign-in for the install; this is not linked to your Apple or Google account, and it is not opened while usage data is off. The Service Provider also keeps anonymous records of subscription purchases (for example the product and amount) that are not linked to your account.

Emails

When you create an account the Service Provider may send you a welcome email and occasional product emails, such as getting-started tips or a reminder if you have been away. To do this, your email address and a record of which emails were sent are stored by the Service Provider, and the emails are delivered by Resend. Each email has an unsubscribe link, and you can switch product emails off in the app. The Service Provider does not send third-party marketing.

Deleting your account

In the app, go to Settings, then Account, then Delete account. This permanently deletes your cloud data (synced decks and progress, your profile photo, your username and public page, your forum posts and votes, and your student verification record) and your sign-in account. Information stored only on your phone stays there until you delete the app or its data. You can also request deletion by email (see below).

Reporting content

To report a forum post or a public page, use the Report link next to it, or email support@recalli.app. Copyright notices go to the same address.

Legal basis for processing your personal data

Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data, including:

• Contract performance: processing necessary to provide the Application or fulfil a contract with you.
• Consent: where you have given explicit consent to processing, including for marketing, analytics, or optional features. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
• Legitimate interests: where processing is necessary for the Service Provider's specific legitimate interests, such as maintaining network and information security, preventing fraud and abuse, or improving the Application's core functionality through analytics, provided those interests are not overridden by your data protection rights or fundamental freedoms.
• Legal obligation: to comply with laws or government requests.

Cookies and browser storage

The website and web app do not use advertising or tracking cookies, and fonts are served from recalli.app itself. They use your browser's storage (local storage and IndexedDB) to keep you signed in, to keep your decks, progress and settings in the web app, and to remember choices such as your usage-data answer. Pages that show a sign-in button (the web app's login screen, the forum and the dashboard when you are signed out, and Settings, then Account, when you are signed in) contact Google's sign-in service when they open, so the sign-in window can appear straight away; other pages make no request to Google. You can clear this storage in your browser settings at any time; you will then be signed out.

Automated decision-making and profiling

If the Application uses automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, you have the right to request human review, express your point of view, and contest the decision. Information about the logic involved and the likely consequences of that processing will be provided where required by law.

What information does the Application collect automatically?

In addition, the Application may collect certain information automatically, including, but not limited to, the type of mobile device or computer you use, your device's unique device ID or identifier, the IP address of your mobile device or computer, your operating system, the type of browser you use, and information about the way you use the Application.

Does the Application collect precise real time location information of the device?

This Application does not gather precise information about the location of your mobile device or computer.

Do third parties see and/or have access to information obtained by the Application?

Anonymous usage counts (if you leave "Share usage data" on) are sent to external services to help the Service Provider improve the Application. The Service Provider does not sell your personal information. The Service Provider may share your information with third parties in the ways that are described in this privacy statement.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data outside the European Economic Area (EEA). Where such transfers occur, the Service Provider will use an appropriate transfer mechanism required by GDPR Chapter V.

• Adequacy decisions by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted

Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

The Service Provider may disclose User Provided and Automatically Collected Information:

• as required by law, such as to comply with a subpoena, or similar legal process;
• when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.

Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR. These DPAs impose the same data protection obligations on those service providers as described in this Privacy Policy.

What are my opt-out rights?

To request deletion of your personal data, withdraw consent, or exercise any of your rights, contact the Service Provider at support@recalli.app.

What is the data retention policy and how can you manage your information?

The Service Provider retains personal data based on its necessity for the stated purposes:

• User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law
• Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance or security purposes
• Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you
• Data required for legal compliance: Retained as long as required by applicable law

You have the right to request deletion of your personal data at any time, except where retention is required by law. If you'd like the Service Provider to delete User Provided Data that you have provided via the Application, please contact them at support@recalli.app and they will respond within the time required by applicable law. Please note that some User Provided Data may be required in order for the Application to function properly.

How does the Application address children's privacy?

The Application is not intended for children under 16 years of age, or where a higher age of digital consent is established under applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

How is your information kept secure?

The Service Provider is committed to safeguarding the confidentiality of your information. The Service Provider implements physical, electronic, and procedural safeguards to protect information it processes and maintains. For example, access is limited to authorized employees and contractors who need to know that information to operate, develop, or improve the Application. However, no security system can prevent all potential security breaches.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay, providing information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach.

How will you be informed of changes to this Privacy Policy?

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at support@recalli.app.

This privacy policy is effective as of 2026-10-10

What are your GDPR data protection rights?

Under the GDPR, you have the following rights:

• Right of Access: You can request access to your personal data.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure: You can request deletion of your personal data (the "right to be forgotten").
• Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
• Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You can object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time. Withdrawal is as simple as toggling preferences in the Application's settings or contacting the Data Controller.
• Rights Regarding Automated Decision-Making: You have rights related to automated decisions that affect you.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. Contact details for each country's Data Protection Authority can be found at: https://edpb.ec.europa.eu/about-edpb/members_en

If you are located in the United Kingdom, you may contact the Information Commissioner's Office at https://ico.org.uk

What are your California privacy rights (CCPA/CPRA)?

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

• Right to Know: You can request disclosure of the categories and specific pieces of personal information the Service Provider has collected about you.
• Right to Delete: You can request deletion of personal information the Service Provider has collected from you, subject to certain exceptions.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out: You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: You can limit the use of your sensitive personal information to essential purposes.
• Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, please contact the Service Provider at support@recalli.app. The Service Provider will verify your request using the information you provide and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf.

How do you give your consent?

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases, including contract performance, legitimate interests, or legal obligations, is carried out as described above.

How can you contact the Data Controller?

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at support@recalli.app.

To request deletion of your personal data or to exercise any of your rights, contact the Service Provider using the details provided above. The Service Provider will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.