Privacy Policy

OwnRecall is operated by Moringa Software LLC. This policy says what OwnRecall stores, who processes it and why, what stays in your browser, and what you can do with your data. It describes the product as it works today. When the product changes, this page changes with it.

What we store

Your account

Your email address, the name you enter at onboarding, the name of your organization, your role in it, and when your account was created. Supabase Auth handles your password; OwnRecall never sees or stores it in readable form. We also keep, for each space, the time you last looked at it, so the app can show you what changed since then. For the setup steps on Home, we keep when you first got an answer from Ask (never what you asked or what it said) and when you hid those steps, if you did.

Early access and the waitlist

A list of the email addresses we have invited to early access. If you join the waitlist, we store your email address, which form you used, and when you joined. Nothing else.

What you capture

Everything you paste or upload: its title, date, and kind, the text itself, and for uploaded files the file, its size, and who captured it. Pasted text is kept in the database. Uploaded files are kept in a private Supabase Storage bucket that only your own session can read.

What we extract from it

The facts, commitments, and people, organizations and things OwnRecall pulls out of each source: each fact's statement and date; each commitment's description, direction, counterparty, due date and status; each person or thing's name, kind and other names; which source each came from; which fact replaced which; and the suggestions the app makes about that.

Connections

For each assistant connection: its name, the spaces it can reach, when it was created, last used and revoked, and a hash of its access token. The token itself is shown to you once and never stored. For each call an assistant makes: which kind of lookup it was, when, and how many results came back. We do not store what it searched for. When an assistant connects through OAuth we also store that client's registration and hashed tokens.

Abuse prevention

To limit abuse of assistant connector registration, sign-in to a connector, and connection requests, we keep a salted hash of your IP address for up to 24 hours. We never store the IP address itself.

Who processes your data and why

OwnRecall runs on a small number of providers. Each one receives only what its job needs. We do not sell personal data, and nothing in the product shares your data with anyone not listed here.

• Supabase stores everything above: the database, accounts and sign-in, and uploaded files. Our project runs in Supabase's Oregon, United States region. Supabase states that all customer data is encrypted at rest with AES-256 and in transit with TLS. Supabase's privacy policy.
• Vercel hosts the website and the app and handles every request you make to them. Vercel's privacy policy.
• Anthropic receives captured content for processing. When you capture something, its text is sent to Anthropic's models to suggest a title and date and to extract facts and commitments, along with the name you entered at onboarding so the model knows who "I" refers to. When a new fact may replace an older one, both statements are sent to compare them. When you use Ask, your question is sent, and then the facts and commitments retrieved for it, with their source titles and space names. We do not describe Anthropic's retention or training terms here; read them directly: Anthropic's commercial terms and Anthropic's privacy policy.
• Resend delivers the emails Supabase Auth sends on our behalf: sign-in links, sign-up confirmation, and password resets. It receives your email address and the message. Resend's privacy policy.
• Google is offered as a way to sign in. See Google user data below, and Google's privacy policy.

The website and app fonts are served from our own servers, not Google's.

There is no analytics, advertising, or tracking code on the website or in the app.

Google user data

If you choose Continue with Google, Google shares your name, email address, and profile picture link with our sign-in provider, Supabase Auth, to create or sign in to your account. OwnRecall uses only your name and email address, to sign you in and to label your account. We don't sell this information, use it for advertising, or share it except with the service providers listed above that run OwnRecall. To delete your account and this information, email support@ownrecall.com. OwnRecall's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and browser storage

One kind of cookie: the session cookie Supabase Auth sets when you sign in, so the app knows it is you. Its name starts with sb-, it is marked HTTP-only and secure, and it is cleared when you sign out. There are no analytics or advertising cookies.

The app also keeps three small things in your browser's own storage, never sent to us:

• ownrecall:ask-scope in local storage remembers whether Ask should search the current space or all spaces.
• ownrecall:changes-visit: followed by a space id, in session storage, remembers the changes you were shown on this visit to a space so a reload shows the same list. It is cleared when the tab closes.
• A key starting with tsr-scroll-restoration, in session storage, where the app's page router remembers how far you had scrolled on each page so going back returns you to the same place. It is cleared when the tab closes.

What you can do with your data

• Download any file you uploaded, from that source's page.
• Revoke any assistant connection at any time, from the Assistants page.
• You can delete any capture, or any single fact, from History. It is removed from OwnRecall right away, including from Ask and connected assistants. Copies in our database provider's backups are removed as those backups expire.
• Export a space or delete your account: neither is self-serve yet. Email support@ownrecall.com from your account email and we will do it for you and confirm when it is done.

Connections and assistants

A connection lets an assistant you use, such as Claude, look things up in OwnRecall. It can reach only the spaces you chose when you created it, and that choice is frozen: the database rejects any change to a live connection's scope, so to change it you create a new connection and revoke the old one. Through a connection an assistant can receive, from those spaces only: facts with their dates and source titles, and earlier versions of a fact if it asks for history; open commitments with their counterparties and due dates; the people, organizations and things you have captured and what is known about them; and, for one source, the facts extracted from it. It does not receive the original text of a source. Every call is logged with its kind, time and result count, and the Assistants page shows each connection's call count.

What OwnRecall staff can see

A small number of us can look up an account for support and administration. What that shows is account information and usage counts: your email, when your account was created, when you last signed in, which sign-in providers you use, your organization's name, and how many spaces, sources, facts, commitments and connections it holds. It never shows the content of your spaces: not what you captured, not the facts or commitments extracted from it, not the names of people or things you have linked, not a source's title or text. Opening one account's own detail page this way is logged, with who looked, when, and which account.

Changes to this policy

When the product changes in a way that changes what is stored or who processes it, we update this page and its effective date. The current version is always at this address.

Contact

OwnRecall is operated by Moringa Software LLC. Questions and requests about your data go to support@ownrecall.com.