Privacy Policy
Recall — AI Memorial
Effective date: August 2, 2026 Last updated: August 27, 2026 Provider: Stefano Anania ("Recall", "we", "us", "our") Contact: support@stefanoanania.com Postal address: 525 N Sycamore Ave, Los Angeles, CA 90036, USA
1. The short version
Recall lets you have written and spoken conversations with an AI recreation of someone who has died, built from details and a voice sample you provide.
Because that is unusually personal material, the app is built so that almost none of it reaches us:
- Your conversations, memories, photos, and profiles are stored on your iPhone, in the app's own storage. We do not have a copy, we cannot read them, and we cannot restore them for you.
- We never ask for your email address. Sign in with Apple can supply one; Recall does not request it. Apple therefore omits it from the token entirely, so we never receive an address, hold one, or have one to lose — whether or not you use Hide My Email.
- Your name stays on your device. Recall asks Apple for your given name so the persona has something to call you, and writes it to local storage only. It is not attached to your account on our servers, and your surname is never used or transmitted at all.
- Your account with us holds an identifier and nothing else. Sign in with Apple issues an identifier that is unique to this app — it cannot be used to identify you anywhere else — and Google Firebase Authentication stores it so your purchased minutes come back after a reinstall. Your balance, purchase transaction IDs and voice authorisation record hang off that identifier and contain no other personal information. Your payment details never reach us at all.
- Message and voice content is sent to the AI services to be processed, and is not sent with your identity. Google's Gemini API and Cartesia receive the text of a conversation or a voice clip. Neither receives your email address, your Apple ID, your payment information, or the identifier our own servers use. (The conversation text itself contains whatever you wrote — see the caveat below.)
- We ask before we send anything. The first time you open the app after signing in, a screen names every company that will receive your content, lists field by field what each one gets, and asks your permission. Nothing is sent to any of them until you agree. You can withdraw that permission at any time in Profile → AI & Data Sharing, and the app keeps working without it — you just cannot chat or call.
- We do not sell or share your personal information, we do not use it for advertising, and there is no analytics or tracking SDK in the app.
There is one thing we want to be equally plain about, because a privacy promise that overstates itself is worse than none at all:
Conversations contain whatever you type or say. If you tell the persona your name, your children's names, where you live, or how you are feeling, that text is sent to our AI provider as part of the conversation. It is not labelled with your account, but it is not anonymous in the sense of being stripped of names. Section 5 sets out exactly what is sent, and to whom.
2. Who this policy covers
This policy applies to the Recall iOS application and the backend services that support it. Recall is intended only for people aged 18 or over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has used the app, contact us at support@stefanoanania.com and we will delete what we hold.
3. Information stored on your device only
The following is written to the app's local database on your iPhone. It is not transmitted to us, and it is not backed up to our servers:
| What | Examples |
|---|---|
| Your account details | The given name returned by Sign in with Apple, which you can edit. No email address is requested or stored |
| Your personal profile | Age, city, profession, birthplace, siblings, partner's name, children's names, and any additional context you enter |
| Loved one profiles | Name, your relationship, hometown, birthday, personality, favourite phrases, biography, nicknames, profession, language |
| Photos | Any photo you attach to a loved one's profile |
| Memories | Every memory entry you record |
| Conversations | Every chat and call thread, and every message in it |
| Continuity notes | The running summary that lets a later conversation remember an earlier one |
| Voice samples | The audio file you recorded or imported |
| Balances (cached) | A local copy of your remaining minutes and texts, for display |
This data is protected by iOS file protection and your device passcode. If you have iCloud Backup or iCloud Keychain enabled, your device backup may include it — that copy is governed by Apple's privacy policy, not this one.
Deleting the app deletes all of it, permanently and unrecoverably. So does deleting a loved one's profile from inside the app. We cannot recover any of it for you.
4. Information our own servers hold
Our backend runs on Google Firebase (Cloud Functions and Firestore) in the United States. It holds very little, and none of it identifies you by name:
| What | Why | Retention |
|---|---|---|
| Your account record — a Firebase user ID and the app-specific identifier Apple issues for you. No name, no email address | So your purchased balance is yours and survives a reinstall or a new device | Until you delete your account |
| Your balance ledger — remaining call seconds, remaining texts, whether the one-time greeting has been used | So a purchased balance is not held on the device where it could be edited, and so nobody can grant themselves unlimited paid minutes | Life of the account, plus what tax and accounting law requires for the underlying transaction record |
| Voice authorisation records — your account identifier, the voice name, and the date you confirmed you had the right to use the voice | So there is a record of the authorisation if a family member later disputes a voice | For as long as the cloned voice exists |
| Purchase validation records | To verify an App Store transaction actually happened before crediting minutes | Life of the account, plus statutory accounting retention |
| Operational logs | Errors, timings, instance counts, and whether a safety intervention fired | Approximately 30 days, per Google Cloud Logging's default retention |
What our servers deliberately do not hold: your name, your email address, your payment details, your conversations, your memories, your photos, or any audio. The only identifier they hold is the one Apple issues for this app specifically, which cannot be used to identify you anywhere else.
Conversation text passes through a Cloud Function on its way to the AI provider. It is held in memory for the duration of that single request and is not written to a database.
Safety logging. When the app's crisis-detection check fires, we record that it fired, at what level, and against which pattern — attached to your account identifier. We do not record the message that triggered it. We do this to monitor how often the safeguard fires and whether it is working, not to build a record of anyone's worst moments.
5. Third parties who process your content
This is the section that matters most, so it is written out in full.
Your permission comes first. None of the transfers described below happen until you have seen them described inside the app and agreed to them. The in-app screen names each company, states what it receives and what it never receives, and takes an explicit yes. It can be re-read at any time in Profile → AI & Data Sharing, and the permission can be withdrawn there, which stops these transfers.
Equal protection. Each company below acts as our processor under a written data processing agreement. Those agreements require them to protect your personal data to a standard at least equal to the one set out in this policy: to process it only on our documented instructions and only for the purpose described here, not to use it to train their own models, not to sell or share it, to keep it confidential and secured, to notify us of any personal data breach, to permit deletion on our instruction, and to apply the European Commission's Standard Contractual Clauses to any transfer out of the UK or EEA. Where a provider changes its terms in a way that falls short of that standard, we will stop using it.
5.1 Google (Gemini API) — text
Receives: the persona instructions built from the loved one's profile and your own profile (your first name only, never your surname), the continuity note, and the messages in the current conversation, including what you write or say.
Does not receive: your email address, your Apple ID, your payment details, the account identifier our own servers use, your device identifiers, or your IP address (the request is made by our server, not by your phone).
Important and honest caveat: the persona instructions are built from what you entered, so they contain your first name and any family details you filled in, and the name and biography of the person who died. Your surname is never included — the persona is given only the name it calls you by. Your conversation contains whatever you say. None of that is attached to an account we can trace back to you, but it is not anonymised text. If you would prefer less of it to be sent, leave the optional profile fields blank — the app works without them.
Used for training? We use the Gemini API under terms that do not permit your content to be used to train Google's models. Google may retain content briefly for abuse monitoring under its API terms. See Google's API terms and privacy policy.
5.2 Cartesia — voice
Receives: the trimmed voice clip (up to ten seconds) used to create the voice, the name you gave that voice, the language, and the text of the persona's spoken replies to be turned into audio.
Does not receive: your messages (only the persona's replies are spoken), your name, your email address, your Apple ID, your payment details, or the account identifier our own servers use.
Stores: the resulting voice model — a voiceprint — until it is deleted. See section 6.
Used for training? We use Cartesia under terms that do not permit your voice data to be used to train their models. See Cartesia's privacy policy.
5.3 Apple
- Sign in with Apple authenticates you. Recall requests your name and nothing else — the email scope is not requested, so Apple does not return an address and none is stored anywhere. The given name Apple returns is written to your device only; it is not passed on to Firebase or to any other service except as the first name inside a conversation.
- Speech recognition transcribes what you say during a call. The app requests on-device recognition, and uses it whenever your device supports it for the selected language. Where a language is not supported on-device, iOS may send audio to Apple for transcription under Apple's privacy policy.
- The App Store processes all payments. We never see your card, and Apple gives us only a signed receipt for the transaction.
5.4 Google Firebase — accounts and backend
Firebase provides our authentication, our database, and the functions that call the services above. Google acts as our processor.
Receives and stores: an identifier that Apple issues for you which is specific to this app, held on your account record so we can recognise the account across reinstalls. Alongside it: your balance of minutes and texts, the transaction IDs of your App Store purchases, and the record of your confirmation that you were authorised to use a voice.
Does not receive: your email address — we never request one from Apple — or your name, which stays on your device.
Why: this account record is what makes your purchased minutes yours. Without a stable identity tied to your Apple ID, reinstalling the app would lose everything you had paid for.
Passes through but does not store: the persona instructions, your conversation text and the replies to be spoken. These transit a Cloud Function on the way to the services in 5.1 and 5.2 and are not written to our database. Our function code contains no statement that writes conversation content to storage.
Does not receive: your payment card or bank details, which never reach us — the App Store handles payment and gives us only a signed receipt.
Deletion: deleting your account deletes the authentication record, the ledger and the attestation. See section 9.
See Firebase's privacy documentation.
5.5 Nobody else
There is no analytics SDK, no advertising SDK, no attribution SDK, and no crash-reporting SDK that receives your content. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not disclose it to data brokers.
6. Voice data and biometric information
Creating a voice from a recording produces a voiceprint, which is biometric information under laws including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington's My Health My Data Act. This section is our written notice and retention schedule.
What we collect. A voice clip you record or import, and the voice model derived from it.
Why. For the single purpose of synthesising speech in that voice inside the app, at your request. For no other purpose.
Consent. Before any clip is uploaded, you must confirm in the app that you are the legal next of kin of the deceased or otherwise have explicit legal authority to use their voice. That confirmation is a condition of the upload, and it is enforced on our servers — an upload without it is rejected. We record the date of that confirmation.
Where it goes. The clip goes to Cartesia, which stores the derived voice model. We do not keep a copy of the clip on our servers; your own copy stays on your device.
How long we keep it. Until you delete it. Deleting a loved one's profile in the app issues a deletion request to Cartesia for that voice model and removes the local sample. Absent a deletion request, we will delete voice models no later than three years after your last use of that voice, or when the purpose for collecting it is satisfied, whichever comes first.
We do not sell, lease, trade, or otherwise profit from voice or biometric data, and we do not disclose it except to Cartesia as our processor, or where compelled by law.
Deceased people. The person whose voice is recreated cannot consent. That is why the authorisation confirmation exists, and why the deletion right in section 9 extends to any person who can show they are next of kin of the deceased, whether or not they use Recall.
7. Consumer health data
Conversations in Recall are about bereavement, and may reveal information about your mental and emotional state. Some laws — notably Washington's My Health My Data Act and Nevada SB 370 — treat that as consumer health data.
- We collect it only because you choose to write or say it, and only to provide the conversation you asked for.
- It is stored on your device, not on our servers.
- It is processed by Google as described in section 5.1 in order to generate a reply.
- We do not sell consumer health data, and we will not, absent a separate signed authorisation from you, which we do not currently seek and have no plans to seek.
- You may withdraw your consent, and request deletion, at any time — see section 9.
8. Legal bases (UK/EU users)
| Purpose | Legal basis |
|---|---|
| Providing the app and its conversations | Performance of a contract (Art. 6(1)(b)) |
| Creating and using a cloned voice | Your explicit consent (Art. 9(2)(a)), biometric data |
| Conversation content revealing emotional state | Your explicit consent (Art. 9(2)(a)) |
| Safety interventions and abuse prevention | Legitimate interests (Art. 6(1)(f)) — protecting users' vital interests and preventing misuse |
| Purchase validation and fraud prevention | Contract and legitimate interests |
| Keeping accounting records | Legal obligation (Art. 6(1)(c)) |
You can withdraw consent at any time by deleting the relevant profile or your account, which stops the processing that depends on it. Withdrawing consent does not affect processing that already happened.
Our servers are in the United States. Where personal data is transferred out of the UK or EEA, it is done under the European Commission's Standard Contractual Clauses as incorporated in Google's and Cartesia's data processing terms.
9. Your rights and how to use them
You can do most of this yourself, immediately, without asking us:
| You want to | Do this |
|---|---|
| See everything held about you | Open the app — it is all there. Profile → Export produces a copy. |
| Correct something | Edit the profile or memory in the app. |
| Delete one loved one, their voice, and every conversation with them | Delete that profile in the app. This also deletes the cloned voice at Cartesia. |
| Delete your account and everything in it | Profile → Delete Account & Data. |
| Delete everything, absolutely | Delete the account as above, then delete the app. |
| Stop AI features without losing anything | Profile → pause interactive AI features. |
| Withdraw permission to send your content to Google, Cartesia or Apple | Profile → AI & Data Sharing → Stop sharing. Chat and calls stop; everything else stays. |
| Withdraw biometric consent | Delete the loved one's profile, which deletes the voice model. |
For anything you cannot do in the app — including a request as next of kin about a deceased person's voice, or a request under CCPA/CPRA, GDPR, or a state biometric law — write to support@stefanoanania.com. We will respond within 30 days (45 days for CCPA requests, extendable once where permitted).
Because we hold no name and no email address on our servers, we may be unable to verify a request about server-side records. Almost everything about you is on your device, where you can read, export and delete it without asking us. Where we cannot verify a request, we will say so rather than guess.
Non-discrimination. We will not degrade the app, change your price, or deny you service for exercising a privacy right.
Appeals. If we refuse a request, you may appeal by replying to our response. UK/EU users may also complain to their supervisory authority; California users may complain to the California Privacy Protection Agency.
10. Security
- API keys for AI providers live in Google Secret Manager on the server. They are never in the app.
- The app can obtain only short-lived, single-session, synthesis-only tokens.
- Our database rejects all direct client access; every read and write goes through our authenticated functions.
- Data on your device is protected by iOS file protection and your passcode.
- All transport is over TLS.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulators as required by law.
11. Children
Recall is for adults. We do not knowingly collect personal information from anyone under 18.
12. Changes
The in-app data-sharing disclosure is versioned. Adding a provider, a new category of data, or a new purpose raises that version, and the app asks everyone for permission again against the new text rather than carrying the old agreement forward.
If we change this policy we will update the date at the top. For a material change — a new category of data, a new provider, or a new purpose — we will tell you in the app before the change takes effect, and where the law requires it, ask for your consent again.
13. Contact
Stefano Anania 525 N Sycamore Ave, Los Angeles, CA 90036, USA support@stefanoanania.com
California collection notice (CCPA/CPRA summary)
| Category (Cal. Civ. Code § 1798.140) | Collected? | Where it lives | Sold or shared? |
|---|---|---|---|
| Identifiers (given name; app-specific Apple identifier) | Yes | Name: your device only. Apple identifier: your account record at Firebase. We hold no email address | No |
| Personal records (§ 1798.80) | Yes, if you enter them | Your device only | No |
| Protected classifications (age, family status) | Yes, if you enter them | Your device only | No |
| Commercial information (purchases) | Yes | Apple; our ledger at Firebase | No |
| Biometric information (voiceprint) | Yes | Cartesia, until deleted | No |
| Internet activity | No | — | No |
| Geolocation | No | — | No |
| Audio (voice sample, call audio) | Yes | Your device; Cartesia; Apple for transcription | No |
| Sensitive personal information (biometrics, health/emotional content) | Yes | See sections 6 and 7 | No |
| Inferences | No | — | No |
We do not use sensitive personal information for any purpose other than providing the service you asked for, so no "Limit the Use of My Sensitive Personal Information" link is required. We have not sold or shared personal information in the preceding twelve months.