Privacy Policy

1. Who we are

Remly is a semantic, cross-source search and knowledge layer, operated by REMLY LLC. Remly runs as a web platform at app.remly.it, with a companion Mac app that indexes files on your device. Company: REMLY LLC. Contact: team@remly.it. Website: remly.it.

2. What we collect

Account data: when you sign in, we receive your name and email. We use your name to personalize Remly and your email to identify your account and send essential service communications.

Usage data: we store your subscription status to determine feature access, and records of your AI usage: a token counter for the current billing cycle, daily usage totals, and a log of each AI call (the model used, token counts, estimated cost, the type and identifier of the context it related to, and a timestamp). These records hold counts and metadata, not the content of your queries. The billing-cycle counter resets each cycle; the daily totals and per-call log are kept with your account data.

Content you connect: when you connect a cloud source, Remly indexes the content and metadata you authorize so you can search and ask across it. Indexed content is stored in our database (see section 5). Slack is an exception: it is searched live at the moment you query it and is never indexed or stored by us.

Local Mac files: the companion Mac app indexes files you choose. Your files stay in place on your Mac – Remly does not copy your file library into the cloud or keep the originals. To make them searchable, the app sends text extracted from those files to our API to create embeddings; for images and scanned documents it sends the image itself so the text can be extracted. The derived index (chunks, embeddings, metadata) is, per folder, either kept local-only on your device or synced to our cloud – your choice. Local only controls whether that index is retained in our cloud and synced across your devices; it does not mean processing happens entirely on your Mac. When you use Ask over local files, excerpts and file paths are sent to our API and our AI provider to produce the answer.

Activity: your searches and conversations are stored per account to provide the service. They are not visible to other accounts and are not browsed by staff as a matter of course.

3. How we use your data

We use your data to provide and operate Remly: to authenticate you, run semantic search and Ask across your connected sources and local index, manage your subscription, enforce plan limits, and send essential service communications. We do not sell your data.

4. Who we share data with (subprocessors)

We share data only with the providers needed to operate Remly: Google (sign-in); Clerk (authentication); Supabase (database and storage – Postgres with pgvector); Vercel (hosting and serverless functions); Inngest (background job processing); OpenAI (semantic search, embeddings, and the Ask feature – OpenAI does not train on data sent through its API); Stripe (payments – we do not store card details); Resend (essential and, if you opt in, product-update emails); and PostHog (product analytics – usage events, processed in the US region; cookie-based and only active if you accept analytics cookies).

Sources you connect: separately from the providers above, you can direct Remly to connect to Google Drive, Gmail, Google Calendar, Notion, Slack, GitHub, Jira, Confluence, Dropbox, and Granola. These are integrations you choose and authorize, not processors we send your data to, and your use of them remains subject to their own terms.

5. Where your data lives, and encryption

Cloud-indexed content is stored in Supabase (Postgres with pgvector), encrypted at rest. OAuth tokens receive an additional application-level encryption layer before storage. All connections are encrypted in transit over HTTPS/TLS – browser to our API, our API to provider APIs, the Mac app to our API, and our API to the database. The Mac app talks only to our web API, never directly to the database. The derived index that stays on your Mac is protected by your Mac’s own disk security when FileVault is enabled; we don’t yet add a separate application-level encryption layer to it there.

6. Cookies, tracking, and analytics

Remly uses a small number of essential cookies to keep you signed in and to process payments; these are set by our authentication provider (Clerk) and payment provider (Stripe). We do not use cookies for advertising and we do not sell information collected through cookies. In regions that require it (such as the EU and UK), we request your consent before setting any non-essential cookies.

Analytics: we use PostHog to understand how the site and product are used – which pages are viewed and which features are clicked. It is cookie-based and runs only if you accept analytics cookies in our consent banner; if you decline, no analytics cookies are set and nothing analytics-related is sent. We collect usage and interaction events, never the contents of your files, searches, or documents. These events are processed in PostHog’s US region. You can decline at any time, and declining stores no analytics cookies.

7. AI training

We do not train AI models on your data, and there is no setting that turns training on. Content sent to our AI provider (OpenAI) is processed to return your results and is not used by them to train their models. If we ever offer a way to contribute your data to model training, it will be off by default and we will tell you before it ships.

8. Internal access

Production data access is tightly restricted; engineering staff may access the production database only for incident debugging, and we are putting access logging in place to record such access. We do not bulk-export your content.

9. Permission-aware search

Remly filters results using access information imported from each source. At index time it snapshots the access list it can read for a document; at query time results are filtered against that snapshot. Snapshots refresh on the next sync, so a permission change made in the source can take until then to appear in Remly. Personal connectors are scoped to your own account. The same filter applies to Search, Ask, and the MCP server.

10. How long we keep your data

Account data is retained until you delete your account. If you cancel your subscription, you keep access until the end of the period you have paid for. Your account is then frozen, and your indexed data is scheduled for deletion 30 days after the freeze begins. Deletion runs as a scheduled job rather than at an exact moment, so it can complete shortly after that date. Your local index lives on your device until you remove it – see section 11.

11. Account deletion

You can delete your account anytime from your account settings. Deleting ends your access straight away. Your account and indexed content are then held for 30 days before being permanently deleted; if you sign back in and resubscribe within that window, they are restored. After the window closes, deletion is permanent and cannot be undone.

Your Mac’s local index: deleting your cloud account does not erase the index the Mac app has stored on your device, and neither does signing out or dragging the app to the Trash. To remove it, delete the Remly folder at ~/Library/Application Support/Remly/ after uninstalling the app.

12. Data export

A data export feature (indexed documents, conversations, and settings) is planned. Once available it will appear in your account settings.

13. Your rights

You can request access to, correction of, or deletion of your personal data, and a copy in a machine-readable format. Contact team@remly.it; we aim to respond within 30 days.

EU/EEA residents (GDPR): you also have the right to restrict or object to processing and to lodge a complaint with your local data protection authority. Our legal bases: contract (account, subscription, service communications), consent (sending content to AI providers when you use Ask), and legitimate interests (enforcing fair-use limits).

14. California privacy rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the CCPA/CPRA.

Categories we collect: identifiers (name, email); commercial information (subscription status); internet or other activity (AI usage records – token counts, model, estimated cost, context identifiers, and timestamps); and the content you choose to connect or index. We collect these to provide and operate Remly, as described above.

We do not sell or share your personal information, and we do not use it for cross-context behavioral advertising.

Your rights: to know what we collect, to delete it, to correct it, and to opt out of sale or sharing (not applicable, as we do neither). We will not discriminate against you for exercising these rights.

To exercise any of these, contact team@remly.it.

15. Children

Remly is not intended for anyone under 16, and we do not knowingly collect data from children under 16. Contact team@remly.it if you believe a child has provided us data and we will delete it.

16. International transfers

REMLY LLC is based in the United States. If you are in the EU/EEA, your data is transferred to and stored in the United States; these transfers rely on Standard Contractual Clauses. Where required, we appoint a representative in the EU for data-protection matters.

17. Security and compliance

Remly is built with read-only connector access – we never create, edit, move, send, or delete content in the sources you connect, though some connectors register a webhook with the provider so we learn when something changes. Data is encrypted in transit and at rest, and sensitive tokens carry an additional application-level encryption layer. We support GDPR-style deletion now and data export soon. If a data breach affects your personal data, we will notify you and the relevant supervisory authorities as required by applicable law. We do not currently hold formal certifications such as SOC 2 or ISO 27001 (SOC 2 is on our roadmap). Remly is not HIPAA compliant and should not be used for protected health information.

18. Changes to this policy

We may update this policy. For material changes we will update the effective date and notify you by email or in-app. Continued use after changes take effect constitutes acceptance.

19. Contact

Questions or requests: team@remly.it. REMLY LLC · remly.it · team@remly.it