Privacy Policy

Last updated: October 1, 2026

1. Introduction

This Privacy Policy describes how Hanamori Labs, LLC ("Company", "we", "us", or "our"), a Delaware limited liability company, operates Recall ("Service") available at recallmcp.com. This policy explains how we collect, use, and protect your information.

2. Information We Collect

Account Information

When you create an account, we collect your email address and authentication credentials via Firebase Authentication (Google sign-in or email/password).

Memory Data

The Service stores memory data that your AI agents create through the MCP protocol. This data is stored in encrypted, tenant-isolated namespaces. We do not read, analyze, or share your memory data.

Usage Data

On the public pages of recallmcp.com (not the dashboard or sign-in), Google Analytics measures page views and clicks, under the consent rules in section 8. We also collect API audit logs (endpoint called, timestamp, status code) for operational monitoring.

Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers or payment method details on our servers. We retain your Stripe customer ID for subscription management.

3. How We Use Your Information

  • To provide, maintain, and improve the Service
  • To process payments and manage subscriptions
  • To send transactional emails (account verification, billing)
  • To monitor and prevent abuse or unauthorized access
  • To respond to support requests

4. Data Storage and Security

Your memory data is stored in isolated, encrypted storage (Redis / Valkey) with per-tenant namespace separation. Business data (accounts, subscriptions) is stored in PostgreSQL with SSL encryption. All data is hosted on Railway infrastructure in the United States.

5. Data Retention

Memory data is retained for as long as your account is active. API audit logs are retained for 30 days. When you delete your account, all associated data is permanently removed.

6. Third-Party Services

We use the following third-party services:

  • Firebase Authentication — user authentication
  • Stripe — payment processing
  • Google Tag Manager and Google Analytics — usage measurement on the public pages (section 8)
  • X, TikTok and Meta — advertising pixels on the public pages that measure our ads (section 8)
  • Railway — infrastructure hosting
  • Honeybadger — error monitoring
  • Embedding providers (Voyage AI, Cohere, OpenAI) — semantic search embeddings (only embedding vectors are generated; raw content is not shared)

7. Your Rights

You have the right to:

  • Access your personal data
  • Delete your account and all associated data
  • Export your memory data via the API
  • Revoke API keys at any time
  • Opt out of the advertising pixels with Your privacy choices at the bottom of every page, or by sending Global Privacy Control

California residents: we do not sell personal information. The advertising pixels on our public pages may count as "sharing" for cross-context behavioural advertising; opt out as above.

8. Cookies, analytics and advertising

The dashboard and sign-in use only essential cookies: your authentication (Firebase session) and theme preference. They run no analytics or advertising.

The public pages of recallmcp.com use Google Tag Manager to load Google Analytics and the advertising pixels of X, TikTok and Meta. They tell us how people find and use the site and which of our ads bring visitors here, and the ad networks may use them to show our ads to people who visited.

  • What they collect: the pages you visit and the page you came from, clicks on the sign-up and install buttons, your IP address and browser and device details, and identifiers in cookies set by Google, X, TikTok and Meta.
  • In the European Economic Area, the United Kingdom and Switzerland, nothing loads until you choose: a banner asks, with Accept and Reject side by side, and Reject loads nothing. Your answer is kept for 12 months in the hc_consent cookie.
  • Everywhere else, they load after the page has finished. You can turn them all off with Your privacy choices at the bottom of every page. If your browser sends Global Privacy Control, we treat it as an opt-out from advertising automatically: the X, TikTok and Meta pixels stay off, and Google Analytics still counts visits unless you turn it off too.
  • Change your answer at any time with Cookie settings at the bottom of every page.
  • Cookies: hc_consent (your answer, 12 months); Google Analytics' _ga and _ga_* (up to 2 years); and X, TikTok and Meta's own cookies (as set by each network), the last three only with consent where required.
  • Google, X Corp., TikTok and Meta Platforms use this data under their own privacy policies and may process it in the United States. Legal basis: your consent in the EEA, UK and Switzerland; elsewhere, our legitimate interest in measuring our website and ads, with the opt-out above.

9. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Service.

11. Contact

For privacy-related inquiries, contact us at:

Hanamori Labs, LLC
1111b South Governors Avenue
Dover, DE 19904
United States
Phone: +1 (484) 291-8909