Privacy

Last updated August 31, 2026.

Recollis is run by one person, on one server, for a handful of invited people. This page says plainly what is on that server, what leaves it, and how to take it all back.

What is stored

• Your email address, and a hashed password. Nothing else about you.
• Every session you import: its harness, model, repository, project path, timestamps, and the full text of every message in it — the whole transcript, not a summary of it.
• Every recollection you keep: your why-line, the excerpt it came from, its tags and its column.
• Access tokens you create for the CLI, stored as digests — the token itself is shown once and never again.

Your transcripts probably contain secrets

This is worth its own heading. Agent sessions are full of credentials: an .env the agent was asked to fix, a curl with an Authorization header, a private key pasted in to debug a deploy. When you import a session, all of that is imported with it and stored in the database in plain text.

Recollis does not scan your transcripts for secrets, and cannot promise to find them. Assume that anything your agent saw is now here, and rotate anything you would not want stored.

What leaves this server

One thing, and only when you ask for it by name. When you press Summarise on a session, or use recollis clip --suggest, the text goes to a third-party model (OpenRouter, free tier) and the answer comes back as a draft you edit. Nothing is sent in the background, on a schedule, or on import.

Before it is sent it is passed through a scrub that masks the obvious credential shapes — key blocks, Bearer headers, database URLs with a password in them, and the documented prefixes of about a dozen vendors. That scrub errs towards masking, and it is still only a scrub of the obvious. It is not a guarantee.

Any session can be marked never send this one on its own page. A withheld session is never sent anywhere, scrubbed or not, and the flag lives on the row rather than in a preference that could fail to load.

The one other place data leaves is mail: invitations and password resets go out through Brevo, which sees your email address and nothing else.

Where it is kept, and for how long

• A PostgreSQL database on a single DigitalOcean droplet in Frankfurt, backed up daily to Cloudflare R2.
• Import bundles and export archives live in Cloudflare R2. Only your newest 5 import bundles are kept; exports are deleted 7 days after you build them. The database rows are the durable copy of everything.
• Backups are kept for a rolling window and then overwritten.

Taking it back, and leaving

Everything you put in comes back out in the format it went in — from the export page or with recollis export. Deleting your account from account settings removes your sessions, messages, recollections, board, tokens and imports immediately and for good. Export first; there is no undo and no copy kept for you.

No tracking, no advertising, no sale

There are no analytics scripts, no third-party cookies and no advertising on this site. The only cookie is the one that keeps you signed in. Your transcripts and your why-lines are not sold, shared, or used to train anything.

Asking about any of this

Write to hello@recollis.com. It is read by the person who wrote the code.