A plain-language register of Recall's security controls, the third parties we use, and where we stand on formal compliance. No badge on this page claims more than we can prove.
No. Your work history — what you worked on, when, in which apps — is stored in a single local folder on your Mac and has no server copy. The only things that touch our vendors are account, licence, payment, and email data, plus crash reports that contain no work content. The single exception is diagnostics sharing, which is off unless you explicitly turn it on.
No. Recall downloads a small language model (Ministral 3B) to your Mac on first launch and runs every analysis on your own hardware. No screenshot, window title, or description of your work is ever sent to a cloud AI service. This is a structural difference from screen-recording tools that process content through cloud AI vendors.
No. Recall uses macOS screen-capture permission only. It never opens the microphone or camera and never records system audio, calls, or video.
No — there is nothing to read on our side, because work content is never uploaded. If you opt in to diagnostics and send a bug report, that bundle (with on-device redaction applied) is accessible to us for debugging, and only then.
Every claim above is expanded, control by control, on the Security Controls page — including how to verify the important ones yourself.
Priya is evaluating Recall before installing it on her work laptop. The product looks useful, but one question comes first: what does it see, what stays local, and what can she delete?
If a tool watches my screen, I want a straight answer before I let it in.
Tell me what Recall sees. Then let a second opinion stress-test the claim.
That is why we make the privacy model readable. You can ask any AI assistant to review the claims, find gaps, and tell you what still needs proof.
Use the prompt below to have ChatGPT, Claude, or Perplexity review Recall’s published privacy claims.
This reviews our published privacy architecture, not proprietary implementation code.
Compliance portals make it easy to show four green "Compliant" badges. We show the real state instead: if a status below says "planned", it means exactly that — and it will only change when the underlying audit or control work actually exists.
Local-first processing is data minimization by architecture. Access, export, and deletion are under your control on your own device; account-data rights via hello@joinrecall.com.
No audit has been performed. We will not show an 'in progress' badge until control mapping and evidence collection have genuinely started.
Formal ISMS certification is not yet justified at our size. This status will change before any claim does.
Recall is not positioned for protected-health-information workflows and does not claim HIPAA compliance.
Found a vulnerability, or something on these pages that doesn't match what the app actually does? Write to hello@joinrecall.com — reports of inaccurate claims are treated with the same priority as security reports, because on this page they are the same thing.