Privacy Policy

The short version

• Your PDF files never leave your device. They are opened, parsed and stored locally; only a word or passage you select, plus the sentence around it, is sent to our servers.
• We store your account, the flashcards you make, and your study history — that is what makes review scheduling work across devices.
• AI features send that text to AI providers outside your country, including DeepSeek in the People's Republic of China. Read the AI section before you use them; it is the part of this policy that matters most.
• Reader Live streams your microphone to Google while a session is open. It is off until you start it, and nothing is recorded.
• You can export everything you have made, and delete your account and its data from inside the app at any time.
• No ads, no advertising identifiers, no analytics SDKs, and we do not sell your data.

Who is responsible for your data

The data controller for Recall is Halil Sarıkaya, Karatay, Konya, Türkiye — reachable at recallapp.official@gmail.com.

Write to that address to ask a question about this policy or to exercise any of the rights listed below. We answer within 30 days.

What we collect, why, and on what legal basis

We collect only what a feature needs in order to work. Everything below is collected directly from you — from the account you create and the actions you take in the app. We do not buy data or obtain it from third parties.

Providing account data is a contractual requirement: without it there is no account and no sync. You do not have to use any AI feature — the reader, your cards and offline review all work without them.

What we do not collect

• The contents of your PDF files. Parsing and caching happen entirely on your device.
• Advertising identifiers, location data, contacts, photos, or a listing of the files on your device.
• Third-party analytics or advertising SDKs — the app ships with none.
• Special-category data (health, beliefs, biometrics). Please do not put such information into notes or AI prompts; if you do, it is processed as ordinary card content and we have no way to treat it differently.

AI features — what you should know before using them

You are talking to a machine. Card definitions, translations, explanations, stories, quizzes, the page chat and the Reader Live voice are all produced by AI models, not by a person, and their output can be wrong or invented — that is true everywhere in the app, whether or not a given screen carries an explicit label saying so.

When you use one of these features, the text you selected and the sentence around it are sent to the AI provider that answers the request. We send the fragment, never the document.

Important: our text AI provider is DeepSeek, whose published privacy policy states that it stores data on servers in the People's Republic of China and permits use of submitted content to train and improve its models. We cannot contractually override that on your behalf. Google (Gemini) operates under terms that do not permit training on API input. Read-aloud does not go to an AI provider at all today — see the processor table below.

So: do not paste anything into an AI feature that you would not be comfortable having stored abroad and potentially used to improve a model. Everything else in the app — reading, cards you write yourself, review, offline study — works without sending anything to an AI provider.

Microphone and voice

The microphone is used for exactly one feature: Reader Live, the optional voice conversation about the page you are reading. It is off until you press Start. The app explains what will happen and asks for the Android microphone permission at that moment, not at install time — that screen is your consent, and it is deliberately separate from this document.

While a session is open, audio is streamed to Google's Gemini live-audio API so it can answer in real time. We do not write that audio to disk or keep a copy. A live transcript is shown to you and is discarded when the session ends. Ending the session releases the microphone immediately.

You can withdraw consent at any time by ending the session or revoking the permission in Android settings. Withdrawal does not affect processing that already happened, and every other part of the app keeps working.

The shared word cache

When you generate a card for a word we have never seen, the resulting dictionary entry — the word, its part of speech, definitions and examples — is stored once in a shared cache and reused for everyone else who looks that word up. This is why generation is usually instant and free of quota.

What is shared is the dictionary entry for the word. Your sentence, your document, your notes and your review history are never part of it, and the cache cannot be traced back to you by other users.

The entry itself is not deleted when you delete your account, because by then it is a dictionary definition serving other people rather than a record about you.

Who else processes your data

These are our processors. Each receives only what its feature requires, and each is bound by a data-processing agreement.

We will update this table before adding any new processor. Check the date at the top of this page to see when it last changed.

Sending data outside your country

The providers above are established outside Türkiye and, in several cases, outside the European Economic Area. That means your data is transferred internationally whenever the corresponding feature runs.

For transfers to the United States and to processors inside the EEA we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, together with the standard contracts (standart sözleşme) required by KVKK m.9 and notified to the Kurum. Neither the United States nor the People's Republic of China holds a KVKK adequacy decision, so those transfers rest on those contractual safeguards rather than on your consent.

The People's Republic of China deserves a specific warning: its legal framework gives state authorities broad powers to compel disclosure by companies operating there, and contractual safeguards cannot fully neutralise that. This is the reason the AI section asks you to think before pasting sensitive text. If you never use a text AI feature, no data of yours is sent to China.

How long we keep things

Your rights

Under the GDPR and, in Türkiye, under KVKK m.11 you can ask us to give you a copy of your data, correct it, erase it, restrict or object to how we use it, and receive it in a portable format. Where processing rests on consent, you can withdraw that consent at any time. You can also ask whether we process your data at all and, if so, why.

Two of those you do not need to ask us for — they are built into the app:

• Export — Settings → Data & Backup → Export my data writes a JSON file with your decks, cards and full review history.
• Erasure — Settings → Danger Zone → Delete account removes your account and every row of your data from our servers and clears the local copy on the device. It cannot be undone.
• If you can no longer sign in, request deletion at https://learnwithrecall.com/delete-account or write to recallapp.official@gmail.com from the address on the account. We complete it within 30 days.

Complaints

If you think we have handled your data badly, tell us first at recallapp.official@gmail.com — most things are fixable quickly. You also have the right to go to a regulator without asking us: in Türkiye the Kişisel Verileri Koruma Kurumu (kvkk.gov.tr), and in the European Economic Area or the United Kingdom the data-protection authority of the country you live in.

Automated decisions

The review schedule is computed by an algorithm, but it only decides when a flashcard is shown to you. Nothing in the app makes a decision that has a legal or similarly significant effect on you, so the Art. 22 rules on automated decision-making do not apply.

Children

Recall is not directed at children. You must be at least 16 to create an account, or 13 where your country's law permits it and a parent or guardian agrees. We do not knowingly collect data from anyone below that age; if you believe a child has created an account, contact recallapp.official@gmail.com and we will delete it.

Storage on your device

The app stores data on your device so it works offline: your decks and review queue in a local database, your PDFs in a local cache, and your sign-in session and preferences in local storage. These are necessary for the app to function and are not used for tracking or advertising — there are no third-party cookies. Signing out or deleting your account clears them; uninstalling the app removes them entirely.

Security, and what happens if it fails

Traffic runs over HTTPS, requests are authenticated with short-lived tokens, and every database query is scoped on the server to the signed-in account. Passwords are never stored by us — authentication is delegated to Supabase.

No system is perfect. If a breach occurs that is likely to put your rights at risk, we will notify the competent authority within 72 hours and tell you directly without undue delay.

Changes to this policy

If this policy changes materially — a new processor, a new category of data, a new purpose — we will update the date at the top and show you the new version in the app before the change takes effect. Continued use after that means you accept it. Past versions are available on request.