Privacy policy

Draft for review by a lawyer before launch. Highlighted items in brackets still need filling in. Last updated October 22, 2026.

Who we are
What we collect
How we use it
Who else handles it
Cookies and browser storage
How long we keep it
Your choices and rights
Security
Children
Changes

1. Who we are

This policy explains what Recall First (recallfirst.com), run by [company legal name], collects and why. Contact: [contact email, e.g. support@recallfirst.com].

2. What we collect

When you request access: your email, and the name and note you choose to give.
Your account: your email address, your watches, the recalls that matched them, and your email settings.
Emails we send: a record of each alert and sign-in email (to, subject, text, and whether it was sent).
For software and AI agents: your API keys, stored only as a one-way hash so we can't read them back, with a name you give each one and when it was last used. If you set a webhook, its address, a signing secret and the result of the last delivery.
Sign-in: one-time sign-in links (they expire after 15 minutes, or 7 days for an invite) and a sign-in cookie that lasts 30 days.
Technical data: like any website, our host Cloudflare processes your IP address, browser type and request details to serve and protect the site.
We don't collect health information about any person, and we ask you not to put any in a watch.

3. How we use it

To run the service: match recalls, send alerts, show your account and answer API calls.
To keep it secure and working: stop abuse, fix problems and enforce our terms.
To contact you about your account, such as access approval, changes to the service or to these policies.
We don't sell your data, we don't use it for advertising, and we don't run analytics or ad trackers on the site.

Cloudflare hosts the site and its database.
Resend sends our emails.
Google Fonts serves the site's typefaces, so Google sees your IP address when a page loads.
Your webhook: if you set one, matches are sent to the address you chose.
We may also share data if the law requires it, to protect people's safety or our rights, or as part of a sale or merger of the business, in which case this policy keeps applying.

5. Cookies and browser storage

We use one cookie, rw_session, which keeps you signed in. We don't use tracking or advertising cookies. The site may remember small preferences in your browser's storage.

6. How long we keep it

We keep your account data while your account is open. When you ask us to delete your account, we delete your email address, watches, matches, keys and webhook within 30 days, except where the law requires us to keep something. Backups roll off within a further [backup period, e.g. 30 days].

7. Your choices and rights

You can see and change your watches and email settings on your account page, turn alert emails off with the link in any alert, and export your watches and matches through the API. To get a copy of your data, correct it or delete it, email [contact email, e.g. support@recallfirst.com].

Depending on where you live (for example California, the UK or the EU), you may have further rights, such as to object to some uses or to complain to a regulator. We will honor them as the law requires. [lawyer: confirm which laws apply and add any required sections].

8. Security

Everything travels over HTTPS. API keys and sign-in links are stored only as hashes, and webhooks are signed so you can check they came from us. No system is perfectly secure; if we learn of a breach affecting your data we will tell you as the law requires.

9. Children

Recall First is a business service and isn't meant for anyone under 18.

10. Changes

If we change this policy in a material way we will email account holders before the change takes effect.