Security
Your history, kept safe
What you record is personal, whether it is the house you live in, your health, your children or the trips you remember. We built ToRecall so that it stays yours.
It is encrypted on its way to us and where it is kept, in the EU, and every request is checked before anything is shown. We do not read it unless you ask us to or the law requires it, we never sell it, and nobody trains AI on it. And you can take all of it with you whenever you like.
Encrypted in transit Everything goes over HTTPS. Encrypted at rest Stored with AES-256. Stored in the EU Your history is kept in the EU. No ads or data selling Your history is never sold.
Protecting your data
Your history is encrypted on its way to us and where it is kept.
Encrypted where it is kept
Your history and your photos are stored encrypted (AES-256) by our providers, in the EU.
Encrypted on the way
Everything between you and ToRecall goes over HTTPS, and browsers are told never to use anything else. Our pages load no scripts from anyone else, apart from Cloudflare’s bot check on the sign-in pages and in Ask ToRecall.
Checked on every request
The server confirms, every time, that what is asked for is yours or shared with you. The apps never query the database directly; everything goes through our API.
Privacy by design
We keep only what ToRecall needs, and never use your history for advertising or AI training.
We do not look
We open an account only to deal with a support request you have made, and only as far as that request needs.
No card details with us
Paddle handles payment for Premium. Your card number never reaches ToRecall.
No ads, no selling, no AI training
Your history is never sold or used for advertising, and nobody trains an AI model on it.
You stay in control
Your history, your choices. Export it, delete it, and decide who sees it.
Backed up, then gone when you say
Backups are kept for 7 days. What you delete is gone for good within 37 days.
Export your data
Export everything you have recorded, at any time, on every plan.
Signing in
Passwords are at least eight characters, and we never see them. Every request carries a signed token that the server checks before it answers.
How your data moves through ToRecall
From your device to encrypted storage, in three steps.
You add something
A photo, a note or a receipt, in the app.
It is sent securely and stored encrypted
It travels over HTTPS and is stored encrypted, in the EU.
Only the right people can reach it
Every request is checked, so only you, and anyone you share with, can see it.
Report a security problem
Found a vulnerability? Write to security@torecall.com with what you found and how to reproduce it. We will reply, and tell you when it is fixed. Please give us a reasonable time to fix it before telling anyone else, and do not access other people’s data or disrupt the service while you test.
Security and privacy questions
Short answers to what people ask most.
Can ToRecall’s staff see my data?
Only when you ask us to, or when Swedish law obliges us to. We open an account only to deal with a support request you have made, and only as far as that request needs.
Where is my data stored?
In the EU, encrypted. Emails, reminders included, go out through Lettermint, in the EU too.
What happens when I delete something?
It stays 30 days in the bin, where you can restore it, and is then removed. Backups are overwritten after 7 days, so nothing you delete survives more than 37 days.
Do you use my content to train AI?
No. ToRecall uses AI to turn what you type into a suggested event and to help answer support questions. Nobody trains an AI model on what you record, not us and not our AI provider.
Read also
Together these say what applies when you use ToRecall, what we keep, what you agree to and how your history is protected.