Privacy Policy

Who we are

Recollo is an iPhone app for saving posts, links, photos, videos, PDFs and notes in a private library on your iPhone. It has an optional processing service that reads the public links you save so the app can show more about them. This policy covers the app and that service. In this policy, "we" means the people who make Recollo.

What stays on your iPhone

Your library is stored on your iPhone, including the original of everything you save. The photos, videos and PDFs you import stay on your iPhone. So do the notes you write, unless you turn on sync, which copies them to your account. Imported files and notes are never sent for processing. If you turn on iCloud copies, the app also keeps a copy of those files in your own iCloud, which Apple stores under your Apple ID; Recollo's servers never receive them.

Your iPhone shows a saved link's picture from Recollo's own copy. When there isn't one, as for a link saved without an account or not processed, your iPhone asks the link's site once for its preview picture and title, as Messages does, and keeps them on the iPhone; the site sees your iPhone's internet address. When the app matches places on your iPhone, or you search for a place, the place names go from your iPhone to Apple Maps. When you open a place's hours, photos and rating, your iPhone asks Apple Maps for that place by its Apple Maps ID; the details aren't kept. A post's mapped places show Apple Maps' street-level Look Around picture of their spot where Apple has one: your iPhone asks Apple Maps for it by the place's map location and keeps the picture on the iPhone.

Near me, on the Places tab, uses your iPhone's location only while you have it on: tap it to list your saved places by distance and show you on the map. It's off each time the app opens. iOS asks first, and only for while you're using the app. Recollo doesn't keep your location or send it to its processing service.

Processing is optional

Processing needs an account signed in with Apple or Google. Signing in turns it on, and public links you save from then on can be sent to Recollo's processing service, which reads them and returns what it found. As a guest, without an account, nothing is processed: you can save, organize and annotate without it. Your existing library isn't processed automatically.

You can turn off Automatic processing in More → Settings at any time. That stops new links from being sent automatically, but it can't cancel work that was already sent.

What is sent when processing is on

For each link it processes, the app sends the processing service:

• The link you saved, and an ID the app gives the save.
• When you share a web page from Safari, a copy of the page as you were viewing it: its title, description, image link, structured data and reading text, up to 1 MB in all. The service reads this copy only when it can't read the page from the website itself.
• A sign-in token that shows which account the request comes from. The token the share sheet uses also carries a random ID the app made for this iPhone.

If you report a problem with a result, the service also receives the reason you chose and any note you write, up to 1,000 characters.

The app never sends your imported files, your notes or your other saves for processing. Like any internet service, the services the app connects to see your device's IP address.

Who processes it

The processing service passes the link, or what it read from the link, to these services. Each receives only what it needs for its part of the work.

• Cloudflare runs the processing service. Cloudflare Workers receives every request the app sends to the service and keeps the service's operational logs. Cloudflare Workers AI reads the text of posts, pages and PDFs, and turns spoken audio into text. Cloudflare Browser Rendering opens web pages and TikTok links that need a full browser. Cloudflare R2 stores one cover image for each processed save.
• Google Gemini reads the text, photos and videos, sound included, that the service found at the link.
• ScrapeCreators receives the link to a public post on TikTok, Instagram, Reddit, YouTube, X or Facebook, and fetches the post.
• Apify, through Axesso's Amazon product lookup, receives an Amazon product's link and reads the product's price and details.
• Apple Maps Server API receives the names of places a result mentions, sometimes with a nearby point taken from other places in the same result, and matches them to real places. It never receives your own location.
• Wikipedia and Wikimedia Commons receive a matched place's map location, to find a free photo of it and who took it. Recollo keeps a small copy of the photo, and your iPhone loads it from that copy.
• Crossref, DataCite, NCBI PubMed and arXiv receive the DOI, PubMed ID or arXiv ID of a research link, to look up its record.
• Spotify and Apple Music receive a music link, to return its public details.
• The original website: the service follows a link to where it leads and reads the page, or its images, from the site that published it.
• Supabase stores accounts, processing records and results, and the synced library of accounts that turn on sync.
• Apple and Google confirm who you are when you sign in with them. When you delete an account that uses Sign in with Apple, Apple receives a one-time code so it can disconnect Recollo from your Apple ID.

Cloudflare, which runs the service, and Supabase, which holds your account, handle your sign-in token. The services that read your links receive only the link or what was read from it, never your name, email address, notes or imported files.

Accounts

You can use Recollo as a guest without an account. A guest's saves stay on the iPhone and are never sent to the service. Processing and sync need an account signed in with Apple or Google, and so does exporting a backup. Every account can process 20 links a month for free.

You can sign in with Apple or Google instead. Supabase then stores your account: your email address, your name if Apple or Google shares it, and the Apple or Google identity it's linked to. Google sign-in asks Google only for your basic profile and email address.

For each link it processes, the service keeps a processing record with your account: the link, how processing went, the results, and what the processing cost to run. It also keeps a count of how many links your account processed each month, so it can apply the monthly limit.

Purchases

You can buy a plan in the app. Apple handles the payment and never shares your card details, so they never reach Recollo. The app tags each purchase with your account's ID, and Apple sends the service a signed record of the purchase and of later changes to it, such as a renewal, a cancellation or a refund.

The service keeps, with your account: which plan you bought, its purchase, renewal and end dates, whether it renews, any refund, and Apple's transaction numbers. It uses them only to know how much your account may process. If you restore purchases while signed in to a different account, the plan moves to that account.

Sync

Sync is optional, and only for accounts signed in with Apple or Google. When you turn it on, the app copies your saved links and shared text, titles, notes, collections, favorites and confirmed places to your account, so they can appear on your other devices where sync is on. Sync never copies imported files such as photos, videos and PDFs to your account; iCloud copies, if you turn them on, go to your own iCloud instead.

Feedback and problem reports

More → Send Feedback and More → Report a Problem send a message to the people who make Recollo, with the app's version and build and your iPhone's iOS version. You can add an email address if you'd like a reply. If you're signed in, the message goes with your account; you can also send one without an account. The service doesn't keep your device's IP address with it.

A problem report can also include one screenshot you choose and, unless you turn off Include diagnostics: your iPhone model, the kind of account you use (none, Apple or Google), whether automatic processing and sync are on, how many saves you have, the error codes and dates of processing that failed in the past 7 days, the last sync error code, and how many library changes couldn't sync, since when, and the server's codes for them. Diagnostics never include links, titles, notes or anything you saved, and neither form sends your saved posts unless you type them into the message.

Messages and screenshots are kept for one year, then deleted. Deleting your account deletes the ones it sent sooner.

Notifications

If you turn on More → Settings → Posts ready, the app tells you when a post has finished processing. Your iPhone gives the app a notification address for this, which the service keeps with your account, together with the app's version, the kind of build it is, and your Show post titles choice. Apple delivers the notifications. With Show post titles on, a notification shows the post's title; with it off, it says only "Your post is ready".

Turning Posts ready off or signing out removes this iPhone's notification address from the service. Deleting your account removes all of them.

How long information is kept

• The record of what the service read from a link for you, such as a post's text and transcript, is deleted after 90 days.
• The results made from a link stay with your account until you delete the save or your account.
• Your account's monthly processing counts are kept while the account exists.
• Your account's purchase records are kept while the account exists. If Apple refunded a purchase, its transaction number and dates are kept without any account after the account is deleted, so the refunded purchase can't be used again.
• The copy of a page you shared from Safari is deleted after 7 days, or sooner if you delete the save or your account.
• Cover images are deleted when you delete the save or your account. So that the app can show a cover like any other picture, anyone who has a cover's link can load it without signing in; the link is long and hard to guess.
• A problem report is kept with the save's processing record and deleted with it.
• Deleting a save in the app also deletes its processing records, problem reports and cover image from the service.
• Messages from Send Feedback and Report a Problem, and their screenshots, are deleted after one year, or when you delete the account that sent them.
• An iPhone's notification address is kept until you turn Posts ready off, sign out or delete your account, or until Apple says it no longer works.
• So that the same public link isn't processed twice, the service keeps what it read from a public link, and the results, in a shared cache, filed under the link and without your account. The shared cache has no set deletion date, and it is not deleted when you delete your account. Nothing read from a page copy you shared from Safari goes into it.

Deleting your account

To delete an account signed in with Apple or Google, go to More → Account → Delete account. This deletes your account from Recollo's servers, together with the library synced with it, its processing records, results, monthly processing counts, purchase records and problem reports, the feedback it sent, its iPhones' notification addresses, and its cover images. It also removes that account's library from this iPhone; saves in the signed-out library stay. Deleting your account also deletes the iCloud copies the app made for it, as soon as iCloud can be reached. Deleting your account doesn't cancel a Monthly or Yearly plan: cancel it in your iPhone's Settings.

If the account uses Sign in with Apple, the app first asks Apple to confirm; when Apple confirms, Recollo is also disconnected from your Apple ID. If Apple can't confirm, you can still delete the account, then remove Recollo yourself in the iPhone's Settings → your name → Sign-In & Security → Sign in with Apple.

Results for public links in the shared cache are not deleted, because they aren't linked to any account. Deleting the app deletes the library stored on your iPhone, but it doesn't delete your account.

No ads, no tracking, no selling

Recollo shows no ads and contains no advertising or analytics code. It does not track you across other companies' apps or websites, and it does not sell your information. Your information goes only to the services named above, to do what you asked the app to do.

Children

Recollo is not directed at children under 13, and we do not knowingly collect information from children under 13.

Changes to this policy

When this policy changes, the new version is published on this page with a new effective date.

This website

getrecollo.app is run on Cloudflare. Like any website, Cloudflare sees your device's IP address and browser details to deliver the pages and protect them from attacks.

• Counting visits. Only if you choose Allow in the banner, the site loads Cloudflare Web Analytics, which counts page views without cookies and without following you to other sites. Choose No thanks, or change your answer with Cookie settings at the bottom of any page, and it isn't loaded. Your answer is kept in your browser, not sent to Recollo.
• Email sign-ups. If you leave your email address to hear when the app or the web app opens, it's kept in Cloudflare with the date and which list you joined, used only to send that one message, and never sold or shared. Write to thrashsolutions@gmail.com to have it removed.
• Spam check. The sign-up form uses Cloudflare Turnstile to tell people from automated programs. It runs only when you use the form, and Cloudflare uses what it sees only for that check.

The website sets no advertising cookies and shows no ads.

Contact

For questions about Recollo, contact thrashsolutions@gmail.com.