Privacy

RecallCoach is an active-recall study tool. You paste source material you want to learn, write what you remember, and an AI compares the two and returns structured feedback. We keep your saved sessions so you can revisit them later.

• Account info. When you sign in we receive the email address tied to your Google account (if you use Google sign-in) or the email you supply for a magic-link, plus the session cookies that keep you signed in.
• Study content. Source text you paste, recall text you write, AI feedback the system generates for each session, and — if you segment a source — the AI-generated section structure (headings, summaries, and topic labels derived from your source text).
• Quiz activity.If you quiz yourself on a section: the AI-generated quiz questions (including their answer keys), the answers you give, the AI's grading of written answers, and a per-topic mastery summary (counts of graded attempts and how many were correct).
• Operational telemetry. A per-call record of AI model usage (model name, token counts, latency, an estimated cost) tied to your user id. This is operator telemetry, not billing-grade — it exists so the app can enforce per-user usage limits and so we can investigate failures.

• We do not use ad pixels, behavioral advertising analytics, or session-replay tools. We do use Vercel Speed Insights for minimal, anonymous performance metrics (e.g., page load timing); it does not identify individual users.
• We do not use third-party cookies.
• We do not collect a password — sign-in is magic-link or Google OAuth.

When you submit a recall, the source text and recall text are sent to OpenAI's API for analysis. OpenAI processes the request and returns structured feedback. When you segment a source, its full text is likewise sent to OpenAI's API, which returns the section boundaries, headings, summaries, and topic labels we store for you.

Two further AI calls power section quizzes. When you click “Quiz me” on a section, that section's text is sent to OpenAI's API to generate quiz questions, which we store for you. When you answer a written (non multiple-choice) quiz question, your answer — together with the question and its stored answer key — is sent to OpenAI's API for grading, and the grading result is stored with your attempt. Multiple-choice answers are checked on our servers and are never sent to OpenAI. Per OpenAI's API data policy, API content is not used to train their models by default.

Your saved sessions and AI feedback are stored in our Supabase (Postgres) database. Row-level security restricts every read and write to the owning user; no other RecallCoach user can see your study content.

• Supabase — authentication, database (Postgres), session cookies.
• OpenAI — AI analysis of your source + recall, AI segmentation of sources you choose to segment, AI quiz generation for sections you choose to quiz on, and AI grading of written quiz answers.
• Vercel — application hosting, edge network, minimal anonymous Speed Insights performance metrics.
• Google — only if you sign in with Google OAuth; provides your account email for sign-in.
• Resend — outbound transactional email (magic-link sign-in messages).

We do not sell, rent, or share your study content or account information with third parties for advertising or any other commercial purpose.

You can delete your saved study content at any time from /settings. This removes your saved sources, recall sessions, AI feedback, review items, any AI-generated section structure and topic labels, and your quiz questions, quiz answers, and per-topic mastery records. Your account stays active and you remain signed in.

You can download a JSON export of all your study data from /settings. Full account deletion is not yet self-serve — to request it, email support@recallcoach.ai and we will handle it manually.

Operational telemetry — per-user analyze counts, monthly quota state, and per-call usage records (model, token counts, latency, estimated cost) — may remain after study-data deletion for security, abuse prevention, reliability, and cost-control purposes. These records do not contain your source, recall, or feedback text.

All traffic to RecallCoach is HTTPS. Database access is mediated by per-user row-level security policies enforced at the database. The Supabase service-role key — which would bypass those policies — is never used on user request paths; we use the cookie-bound anon-key client so every query reaches Postgres with your JWT.

RecallCoach is not directed at children under 13 and we do not knowingly collect data from them.

We will update the “Last updated” date when we change this page. Material changes will be called out on the login screen or via email to your account address.

Questions or requests: support@recallcoach.ai.