# Recall Trust Center > Source: https://www.joinrecall.com/trust > What Recall can see, what it stores, and what never leaves your Mac, plus security controls, subprocessors, and honest compliance status. Recall reads your screen to rebuild the structure of your work, so the boundary matters. This is a plain-language register of Recall's security controls, the third parties we use, and where we stand on formal compliance. No badge on this page claims more than we can prove. ## The four questions that matter Short answers first. Each one links to the controls behind it, with how to check the important ones yourself. ### Does my work data leave my computer? No. Your work history (what you worked on, when, in which apps) stays in one folder on your Mac and has no server copy. Our vendors see account, licence, payment and email data, feedback and bug reports you choose to send, crash reports with no work content, and pseudonymous usage events that say which Recall screens and features you use, never anything from your screen. Usage analytics and crash reports are on by default, and one switch in Settings → Privacy turns them off; after that only anonymous setup counts, with no install ID, still go out. A few milestones (such as setup completed, or a purchase with its amount and currency) also go to Google Analytics under a hashed install ID, and if you came from a Reddit ad and allowed advertising on our website, Reddit is told when that visit led to a download, a sign-up, a trial or a first purchase, identified by Reddit's own click and cookie IDs and one-way hashed reference numbers. Work content reaches us only when you send it to us, with feedback or a bug report. Verify it: https://www.joinrecall.com/trust/controls#network ### Is the AI in the cloud? No. Recall runs its own model, Recall Core v1.1, trained by us for one job: reading a screen and telling what you are working on. Setup asks first and downloads it once, about 1.9 GB, only after you click Start free trial. Every analysis then runs on your own hardware, and no screenshot, window title or description of your work is ever sent to a cloud AI service. Verify it: https://www.joinrecall.com/trust/controls#processing ### Can Recall hear or see me? No. Recall holds two macOS permissions, Screen Recording and Accessibility, and nothing else. It never opens the microphone or camera and never records system audio, calls or video. macOS sometimes re-confirms screen access with a prompt that mentions audio. Recall still never records it. macOS may also ask whether Recall can access your Desktop, Documents or Downloads folder, or an external or network drive. That happens when an app has a file from there open: Recall checks whether the file belongs to a project folder (it looks for a .git folder) so it can group your work. It doesn't read or upload your files, and saying no only makes that grouping a little less precise. Verify it: https://www.joinrecall.com/trust/controls#capture ### Can Recall employees read my work? No. There is nothing to read on our side, because work content is not uploaded. We read only what you choose to send us: a feedback message, with any images or activity data you attach, and a bug report sent with diagnostics sharing on, which can include analysis traces, screenshots redacted on your Mac, and any text you add. Images you attach to feedback are checked on your Mac first: card numbers, bank details, keys and seed phrases are blacked out, but names, emails and message text are not. We use feedback to answer you, and diagnostics to fix the problem and to improve Recall Core, our own on-device model. Verify it: https://www.joinrecall.com/trust/controls#network ## In the app: every control is one you can see Pause Recall, exclude an app, turn off usage analytics or erase everything, from the menu bar and Settings. - **Settings → Privacy: Usage analytics & crash reports, one switch.** On by default, and never anything from your screen. What's sent lists every event, and Delete my analytics data erases what we hold. - Screenshot: https://www.joinrecall.com/docs/shots/settings-privacy.webp - **Menu bar: pause from the tray.** Click the Recall is on switch to pause for 15 minutes, an hour, three hours, the rest of the day or until you resume. Nothing is captured while the tray says Paused. - Screenshot: https://www.joinrecall.com/docs/shots/tray-paused.webp - **Settings → Excluded apps: exclude any app.** While an excluded app is in front, Recall records no activity, takes no snapshot and runs no screen analysis, and a return never reopens it. - Screenshot: https://www.joinrecall.com/docs/shots/settings-excluded.webp - **Settings → Data: Forget history, or uninstall.** Forget history deletes everything Recall captured, plus your analytics data and feedback conversations on our servers. Uninstall… removes the app, all captured data, the AI model and settings from this Mac. - Screenshot: https://www.joinrecall.com/docs/shots/settings-data.webp Every switch is described in the app's own words in the user guide: https://www.joinrecall.com/docs/privacy ## Second opinion: check it yourself Check it yourself, then get a second opinion. This page carries a prepared prompt you can send to ChatGPT, Claude, or Perplexity, or copy anywhere else. It defines work content and session metadata, lists every claim we make about capture, storage, the network and our vendors, then asks the assistant which claims hold, which need proof, what risks remain, and what the pages leave out. Next to it, the page shows the app's own setup step that asks for the only two permissions Recall uses. - Screenshot: https://www.joinrecall.com/docs/shots/wizard-2-privacy.webp (setup, step 2: the four promises and the two permissions) This reviews our published privacy architecture, not proprietary implementation code. ## Compliance frameworks: statuses we can defend, not badges we bought Compliance portals make it easy to show four green "Compliant" badges. We show the real state instead. If a status below says planned, it means exactly that, and it will only change when the underlying audit or control work actually exists. - **GDPR: Controls implemented.** Local-first processing is data minimization by architecture. Your history is one local folder you can open, and Forget history erases it; account-data rights via hello@joinrecall.com. - **SOC 2: Planned.** No audit has been performed. We will not show an "in progress" badge until control mapping and evidence collection have genuinely started. - **ISO 27001: Not started.** Formal ISMS certification is not yet justified at our size. This status will change before any claim does. - **HIPAA: Not in scope.** Recall is not positioned for protected-health-information workflows and does not claim HIPAA compliance. ## Report a security concern Found a vulnerability, or something on these pages that does not match what the app actually does? Write to hello@joinrecall.com. Reports of inaccurate claims are treated with the same priority as security reports, because on this page they are the same thing. ## Links - Trust Center overview: https://www.joinrecall.com/trust - Security Controls: https://www.joinrecall.com/trust/controls - Subprocessors: https://www.joinrecall.com/trust/subprocessors - Trust Center resources: https://www.joinrecall.com/trust/resources - User guide, Privacy and your data: https://www.joinrecall.com/docs/privacy - Privacy Policy: https://www.joinrecall.com/privacy-policy - Terms of Service: https://www.joinrecall.com/terms - Pricing: https://www.joinrecall.com/pricing - Site overview for AI agents: https://www.joinrecall.com/llms.txt