Data Management Policy
Last updated: July 5, 2026
1. Data we manage
We group the data mrecall handles into three categories:
| Category | Examples | Sensitivity |
|---|---|---|
| Account data | Name, email, profile photo, authentication tokens | Confidential |
| Your content | Inventory items, contacts, conversation notes, meeting notes, vendor records, warranty/insurance details, shopping lists, uploaded photos/documents | Confidential |
| Operational data | Device/browser info used to keep the app working, error logs | Internal |
We do not collect payment card details, government ID numbers, or health records through mrecall.
2. Who can access your data
- You: full access to everything in your account.
- People you explicitly share with: only the specific note, conversation, home, or list you choose to share — nothing else.
- mrecall (the team): we do not routinely view your content. Access is limited to what's needed to investigate a bug you've reported or a security issue, and is logged.
- Service providers: Supabase, Google, Anthropic, and Netlify, each strictly scoped to what their function requires (see our Privacy Policy for details).
Access to your content is enforced technically, not just by policy: our database uses row-level security so that queries for your data are restricted to your account (and anyone you've explicitly shared with) at the database layer.
3. Storage and infrastructure
- Structured data (homes, items, contacts, notes, records) is stored in a Supabase-managed Postgres database.
- Files you upload (photos, bills, documents) are stored in Supabase Storage.
- A local copy of your data is cached in your browser's storage so mrecall works offline as a Progressive Web App — this local cache is cleared if you sign out or clear your browser data.
- All data in transit is encrypted via HTTPS.
4. Data lifecycle
| Stage | What happens |
|---|---|
| Creation | Data is created when you add an item, log a conversation, save a meeting note, etc., and is synced to the cloud database immediately. |
| Use | Data is read and updated as you use the app, and may be sent to a third-party integration only when you trigger that specific feature (AI summary, calendar sync, Drive backup). |
| Retention | Data is retained for as long as your account remains active. |
| Deletion | You can delete individual records yourself at any time. Deleting your account removes your data from our active database; backups (see below) age out over time. |
Routine infrastructure backups taken by our database provider may retain deleted data for a limited recovery window (typically a matter of weeks) before being purged, in line with standard database backup practices.
5. How you stay in control
- Export: download a full backup of your data from the Backup screen at any time.
- Correct: edit any record directly in the app.
- Delete: remove individual items, contacts, notes, or records yourself, or contact us for full account deletion.
- Revoke integrations: disconnect Google Calendar or Drive access at any time from your Google Account's connected-apps settings, or by revoking permission when you next sign in.
- Un-share: stop sharing a conversation or list with someone at any time from within the relevant screen.
6. How AI features handle your data
When you tap "Summarise" on a contact's conversation history, the relevant notes are sent to Anthropic's Claude API at that moment to generate a summary. Only the content needed for that specific summary is sent — not your full account. We don't use your data to train any AI models.
7. How Calendar sync handles your data
If you've granted Calendar permission during Google sign-in, saving a meeting note with a follow-up date and time creates or updates a corresponding event on your primary Google Calendar, including the meeting details you entered (client name, notes, action items). This only happens for meeting notes where you've set a follow-up date — nothing is synced automatically otherwise. You can revoke this permission at any time via your Google Account settings; existing calendar events you've created won't be automatically deleted.
8. In the event of a data incident
If we become aware of a security incident affecting your personal data, we will investigate promptly, take steps to contain and remediate it, and notify affected users and relevant authorities as required by applicable law.
9. Contact us
Questions about how your data is managed, or want to request an export or deletion? Reach us at privacy@mrecall.ai.