Your memory is yours.

TotalRecall stores the memories you choose to keep and lets you decide which AI assistants can read or write them. This page explains what we keep, who sees it, and how to get it removed.

What we store

Your account: your email, an optional name, and a scrambled (scrypt) form of your password. We never store the password itself. If you sign in with Google, we receive only your name and email address from Google.
Your memories: the cards on your board and in your inbox, the spaces you sort them into, and their earlier versions.
Your connections and permissions: which assistants you connected, which spaces each one can read or write, and when you change that.
The receipt: a log of every time a connected assistant searched, read or saved a memory. You can hide a row from view; the log itself is kept so the record stays trustworthy.
Imports: when you upload a ChatGPT or Claude export, we keep the memories extracted from it. The uploaded file itself is deleted once it has been processed.
Your own AI key, if you add one: stored encrypted (AES-256-GCM), never shown again and never written to logs.

Who can see it

Assistants you connect (such as Claude, ChatGPT or Claude Code) can read or save memories only in the spaces you grant them, and only until you revoke access. What those assistants do with what they read is governed by their own privacy policies.
AI providers that organize your imports: to turn an export into memory cards, its text is sent to a language model: our default provider (Groq), or the provider whose key you added in Memory engine.
Service providers we run on: Google Cloud hosts the app and database in the United States, and Resend delivers account emails such as password resets.
That's the full list. We don't sell your data, show ads, or use your memories to train AI models.

Cookies

We use one cookie to keep you signed in. There are no tracking or advertising cookies.

Your choices

Revoke any assistant's access at any time from your board; it takes effect on its next request.
Delete any memory from your board.
To delete your account and everything in it, email es299@fordham.edu from the address on your account. We'll confirm when it's done.

Security

Data travels over HTTPS. Passwords are hashed and AI keys are encrypted at rest. Assistants connect through OAuth, so they never see your password.

Changes and contact

If this policy changes, we'll update the date above. Questions: es299@fordham.edu.