Privacy Policy
Last updated: August 18, 2026
Short version: We do not sell your personal information. We collect the minimum needed to send you recall alerts. You can delete your account or unsubscribe at any time.
Who we are
Recalled.co ("Recalled.co," "we," "us") is a free consumer-safety service operated in the United States. We aggregate official product-recall notices from the U.S. Consumer Product Safety Commission (CPSC), the National Highway Traffic Safety Administration (NHTSA), the U.S. Food and Drug Administration (FDA), and USDA/FSIS, and we help you check whether products you own have been recalled.
What we collect
Information you give us
- Email address — required for recall alerts, provided when you sign up or subscribe to a filter.
- Account information (if you create an account) — name and profile details from your sign-in provider (email/password, Google, GitHub, or similar). Authentication is handled by Clerk, our identity provider.
- Saved products — brand, model, category, UPC, purchase date, nickname, and optional notes about products you save to your account to receive personalized alerts.
- Search and filter preferences — categories, brands, or product queries you've chosen for email alerts.
Information collected automatically
- Basic analytics — page views, referring site, browser type, approximate location (city or region), and performance metrics, via Vercel Analytics and Vercel Speed Insights. This data is aggregated and does not identify you individually.
- Cookies — used only for authentication (session cookies set by Clerk) and analytics. We do not use advertising cookies or third-party tracking.
Information we do not collect
- We do not collect payment information. Recalled.co is currently free.
- We do not collect health, biometric, or precise-location data.
- We do not access your camera or barcode scanner without your action — barcode scanning happens locally in your browser and images are never uploaded to our servers.
How we use your information
- To send you the recall alerts you signed up for (weekly email digest, plus personalized alerts when a product you saved matches a new recall).
- To match products you save against our recall database.
- To operate and improve the service — fix bugs, monitor performance, prevent abuse.
- To respond to your questions if you contact us.
We do not use your data for advertising. We do not build behavioral profiles.
Who we share it with
We share information only with service providers who help us operate the site, under contracts that prohibit them from using your data for their own purposes:
- Vercel — hosting, analytics, and edge infrastructure.
- Neon — database hosting.
- Clerk — authentication.
- Resend — sending transactional email.
- UPCitemdb — product-metadata lookup when you enter a UPC. We send only the UPC number, not your identity.
We will disclose information if required by a valid legal process (subpoena, court order) or to protect the safety of users or the public. We will not sell, rent, or trade your personal information to third parties for their marketing purposes.
How long we keep it
- Email subscriptions — kept until you unsubscribe. Unsubscribing removes your email from active mailings within 24 hours.
- Account data — kept while your account is active. When you delete your account, we delete your saved products, alerts, and profile within 30 days. Aggregated, non-identifying analytics may be retained.
- Analytics data — Vercel retains aggregate analytics for up to 12 months.
Your rights
Regardless of where you live, you can:
- Access the information we hold about you — email privacy@recalled.co.
- Correct your information — update your account settings, or email us.
- Delete your account and all associated data — email privacy@recalled.co.
- Unsubscribe from email at any time — click the unsubscribe link in any email, or turn off product alerts from your account.
- Opt out of alerts without deleting your account — click "Turn off product alerts" in any email.
California residents (CCPA/CPRA) and EU/UK residents (GDPR) have additional rights, including the right to portability and the right to object to certain processing. Email privacy@recalled.co to exercise them. We do not sell personal information under any legal definition.
Security
We use HTTPS for all traffic, industry-standard authentication (Clerk, JWT-verified server-side), and encrypted database connections. No system is perfectly secure — if we ever discover a breach that affects you, we will notify you as required by law.
Children
Recalled.co is a consumer-safety tool intended for adults. We do not knowingly collect information from children under 13. If we learn we have, we will delete it. If you believe your child provided information to us, email privacy@recalled.co.
International users
Recalled.co is operated from the United States, and our recall data covers U.S. federal agencies. If you use the service from outside the U.S., you understand that your information will be processed in the United States, which may have different data-protection laws than your country.
Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top will always reflect the most recent revision. If we make material changes, we will notify subscribed users by email at least 14 days before the changes take effect.
Contact us
Questions or requests: privacy@recalled.co