Privacy Policy
Last updated: 18 September 2026.
This Privacy Policy explains how Recoll ("Recoll", "we", "us") processes your personal data when you use the Recoll mobile application and related website (the "Service"), in accordance with Regulation (EU) 2016/679 ("GDPR") and Spanish data protection law (LOPDGDD).
1. Data Controller
Recoll, operated from Spain, is the data controller responsible for processing your personal data (see also the Legal Notice). Contact: support@recoll.me.
2. Information We Collect
2.1 Information you provide
- Account data: your email address, name or alias, and the identifier from your sign-in provider (Google, Apple) depending on the method you choose.
- Your content: the voice recordings you make, their transcriptions, and the data derived from them (title, summary, people, places, topics and dates mentioned, reminders suggested for your confirmation, and semantic representations known as embeddings). We do not keep your voice: the original audio file is deleted from our servers once it has been processed into a memory. If processing fails, the audio is kept temporarily so the memory can be recovered, and deleted once processing succeeds or you delete the memory.
- Consent record: when you give the explicit consent described in Section 4, we record the date, your choice and the version of this Policy you accepted.
- Support communications: information you send us when you contact support.
- Waitlist (web): if you join the waitlist at recoll.me, your email address and chosen language.
2.2 Information collected automatically
- Usage and device data: technical information, device identifiers, app interaction data, your device's time zone (used to deliver reminders at the right local time) and crash diagnostics.
- Push identifiers: tokens used to deliver notifications.
2.3 Subscription data
- Your subscription status. Payment details are handled by Apple, Google and RevenueCat; we do not store card numbers.
3. Purposes and Legal Bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Create and manage your account and provide the Service (transcribe, structure, index and answer queries about your memories; reminders) | Performance of a contract (Art. 6(1)(b)) |
| Process any special-category data your memories may contain | Explicit consent (Art. 9(2)(a)) — see Section 4 |
| Manage subscriptions and payments | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Usage analytics and crash diagnostics, to keep the Service working and improve it | Legitimate interest (Art. 6(1)(f)) |
| Security, fraud prevention and legal compliance | Legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
| Notify you of the launch and send you product communications if you joined the waitlist | Consent (Art. 6(1)(a)) |
4. Special Categories of Data and Your Explicit Consent
What you choose to dictate may include special-category data (Art. 9 GDPR), such as health, beliefs, or sex life or orientation. For that reason, before you can use Recoll we ask for your explicit consent (Art. 9(2)(a)) to process your recordings with the AI provider described in Section 5, including any special-category data they may contain. The checkbox is never pre-ticked and we record when you gave it.
You may withdraw this consent at any time. Because the Service cannot operate without this processing, withdrawing it means closing your account: in the app (Profile → Delete account) or by writing to support@recoll.me. Do not record special-category information about other people.
5. AI Processing
Recoll relies on a third-party artificial-intelligence provider — currently Google (Gemini) — to transcribe your audio, structure your content and answer your queries. To deliver these features, the relevant content (audio and/or text) is transmitted to that provider, which processes it as a processor under data-processing terms. If we change provider, we will update this Policy. Related international transfers are described in Section 7.
6. Recipients (Processors and Sub-processors)
- Google (Firebase / Google Cloud): authentication, database, temporary audio storage, cloud functions, push notifications, analytics and crash reporting.
- Google (AI / Gemini): audio transcription and language processing.
- RevenueCat: technical management of subscriptions.
- Apple / Google Play: processing of subscription payments.
- Web hosting provider: hosting of the recoll.me website and its waitlist.
We enter into the agreements required by Art. 28 GDPR with our processors. Your data is encrypted in transit and at rest, and each piece of content is accessible only by its owner.
7. International Transfers
Some providers (e.g. Google and RevenueCat) process data outside the European Economic Area, including in the United States, under appropriate GDPR safeguards: the European Commission's Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework, depending on the provider.
8. Retention
We keep your data for as long as your account is active or as needed for the purposes in Section 3, and afterwards only for the periods required by law (for example, tax law). The original audio is deleted once processed. If you delete your account or specific content, it is removed from our systems within a reasonable period, except for temporary technical copies held by our infrastructure providers.
9. Your Rights (GDPR)
You may exercise your rights of access, rectification, erasure, restriction, objection and portability — and, where we rely on consent, withdraw it — by writing to support@recoll.me. We may ask you to verify your identity. We will respond within one month, which may be extended by two further months for complex cases.
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interest — analytics and diagnostics to keep the Service working and improve it, and security and fraud prevention — you may object at any time at the same address.
If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
10. Children
Recoll is intended exclusively for adults: you must be 18 or older, or the age of majority in your country of residence if that is higher. We do not knowingly collect data from anyone below that age; if we detect such an account, we will delete it.
11. Cookies
Our website uses strictly necessary cookies required for it to function. Web analytics (Google Analytics) sets analytics cookies (for example _ga) that measure traffic in a pseudonymous way; they are not loaded until you give consent through our cookie banner, and you can change your choice at any time from the Cookies link in the footer. The mobile app does not use browser cookies but does use the identifiers described in Section 2.2.
12. Changes
We may update this Policy; we will post the current version with its date and, where changes are material, notify you by reasonable means.
13. Contact
For any privacy matter: support@recoll.me.