Privacy Policy

1. Data controller

The data controller for your personal data is: Volkan Vural. For any privacy question or request: volkanvural01@gmail.com.

2. Data we collect

• Account details: email address, full name, email verification status, account role and plan. If you sign up with email and password, your password is stored only as a hash by our authentication provider (Neon Auth); we cannot see your password.
• Sign-in with Google: the name, email address, and profile picture link that Google shares with us. This information is kept by the authentication provider; Recallow copies only your name, email, and verification status into its application database, and does not use or display your profile picture.
• Documents you upload: the PDF/TXT file itself, its file name, size, type, page count, and the file's SHA-256 digest (to recognize the same file if you upload it again). Page texts and text chunks extracted from the document are also stored; scanned pages are read with AI (OCR).
• Generated content: the document's analysis (summary, lesson, key points, concepts, formulas/dates/rules), quizzes, questions, your answers and results, flashcards, and memory hints.
• Study records: your card ratings (the grade you chose and how long it took), daily study summaries (minutes, cards reviewed, quizzes completed), and your settings (daily goals, time zone).
• Usage records: for each AI call, the operation type, model used, input/output token counts, estimated cost, success or error code, and duration; monthly allowance counters and per-user request rate counters.
• Technical data: cookies that keep you logged in. Our hosting provider may keep request information (e.g., IP address, browser information, time) in its own server logs for a limited time to provide the service and keep it secure; Recallow does not write IP addresses to its own database.

3. Cookies and browser storage

We only use what is strictly necessary for the service to work: authentication/session cookies (those starting with __Secure-neon-auth.*) and the NEXT_LOCALE cookie for your language preference (1 year). Your light/dark theme preference is kept only in your browser's local storage. We do not use advertising or tracking cookies.

To improve the site, we keep aggregate visit statistics with Vercel Web Analytics (e.g., page views, referring site, country, device and browser type, and how often buttons such as "Upgrade to Pro" are clicked). This tool uses no cookies and stores nothing in your browser; it tells visitors apart with a hash that resets daily and cannot be reversed, and it does not store IP addresses. We do not send the query parameters in the address bar to analytics. These statistics are not linked to your account.

4. Purposes and legal bases

• Creating your account, letting you log in, and managing your account — entering into and performing a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Processing your documents, generating analyses, quizzes, cards, and memory hints with AI, and calculating your spaced repetition schedule and progress statistics — performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Limiting allowances and request rates, monitoring costs, preventing abuse, and keeping the service secure and available — legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Meeting our legal obligations and responding to requests from competent authorities — legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
• Transferring personal data abroad — under KVKK Art. 9 and GDPR Chapter V, as described in section 6.

5. Service providers

We share your data only with the following providers, as needed to deliver the service:

• Vercel Inc. (USA) — hosting the application and storing the files you upload privately (Vercel Blob, not publicly accessible). Server region: Frankfurt, Germany (fra1).
• Vercel Inc. (USA) — cookieless, aggregate visit statistics (Vercel Web Analytics; see section 3).
• Neon — database and authentication (Neon Auth). Data is kept in the Amazon Web Services Frankfurt region (eu-central-1).
• Anthropic PBC (USA) — AI processing (Claude model). To generate analyses, quizzes, cards, and memory hints, relevant text passages from your document are sent to Anthropic; for OCR of scanned pages, the pages themselves are sent. Anthropic states that by default it does not use content sent through its commercial API to train its models; content may be retained for a limited time under Anthropic's own policies (e.g., for safety and abuse monitoring). Anthropic's privacy and commercial terms should be consulted for the current conditions.
• Google LLC (USA) — for authentication only, if you use "Continue with Google".
• Paddle.com Market Ltd (United Kingdom) — Pro subscription payments. Paddle acts as the merchant of record: it takes the payment, issues the invoice and handles taxes. You enter your card details only with Paddle; Recallow never sees or stores them. Recallow keeps only your Paddle customer and subscription IDs, subscription status, period and currency.
• Google Gemini — provided for only as a backup AI provider if configured by the administrators; it is not currently in use. If it is enabled, this policy will be updated in advance.

6. International transfers

Vercel, Neon, and Google infrastructure is located outside Turkey; content sent to Anthropic is processed in the USA. These transfers will be based on the appropriate safeguards provided for in KVKK Art. 9 (e.g., standard contracts notified to the Personal Data Protection Board) and, under GDPR Chapter V, on adequacy decisions or Standard Contractual Clauses.

7. Retention and deletion

• Documents: you can delete a document at any time from its page. Deletion permanently removes the file from storage, along with the extracted text, the analysis, quizzes, flashcards, and the review records of those cards.
• Account: there is no in-app account deletion feature yet. You can request deletion of your account and all your data at volkanvural01@gmail.com; your request will be completed within 30 days at the latest. When your account is deleted, your documents, generated content, study records, settings, and usage counters are deleted.
• Usage/cost records: AI call records kept for cost monitoring may remain after a document or account is deleted, with the link to that document/account removed; these records do not contain document content.
• Request rate counters are kept for short time windows.
• Provider backups: deleted data may remain in backups for a limited additional time because of our providers' backup and recovery processes.

8. Your rights

Under KVKK Art. 11, you have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate; to request its deletion or destruction under the conditions of KVKK Art. 7; to request that these actions be notified to the third parties to whom it was transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation if you suffer damage due to unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to lodge a complaint with the supervisory authority in your country.

You can send your requests to volkanvural01@gmail.com, with enough information for us to verify your identity. Requests are answered free of charge within 30 days at the latest. If you find our response insufficient, you can file a complaint with the Turkish Personal Data Protection Board.

9. Age requirement

The service is intended for students. If you are under 18, you may use Recallow only with the consent and under the supervision of your parent or legal guardian. Because our AI provider's usage policies and the KVKK require additional safeguards for processing minors' data, we may suspend or delete accounts that we learn were created without parental/guardian consent.

10. Security

Connections are encrypted with HTTPS; the files you upload are kept in private storage and served only to their logged-in owner. Every record is tied to your account and cannot be viewed by other users. No system is completely risk-free; if a data breach occurs, we will inform you and the competent authority as required by law.

11. Changes

We may update this policy. For significant changes, we will let you know in the app or by email before they take effect. The current version is always on this page; the date at the top shows the last update.