Privacy

Recur is software that runs on your own computer. It works fully without an account. If you turn on the optional encrypted backup, an encrypted copy of your list is stored on a backup server that can’t read it (see below). Otherwise, no server receives your data.

What Recur reads

When you connect an email account, Recur connects straight from your computer to your mail provider over encrypted IMAP. It searches for messages that look like billing emails (receipts, invoices, trial and renewal notices) from roughly the last 13 months, and downloads only those. When you import an .mbox or .eml file, it reads that file on your computer.

What Recur stores

• For each billing email: the sender’s address and name, the subject, the date, and the amount, currency, billing period and dates extracted from it. The email body is not saved.
• Your email address, server name and scan progress.
• Your edits, check-in answers and subscriptions you add by hand.

All of this is kept in a database in Recur’s data folder: ~/Library/Application Support/Recur on macOS, ~/.local/share/recur on Linux, %APPDATA%\Recur on Windows. On macOS and Linux the folder and database are readable only by your user account.

Your email password

If you choose to remember it, your app password goes in the macOS Keychain or the Linux system keyring. Otherwise it stays in memory until you quit Recur. It is never written to Recur’s database or to a file.

What leaves your computer

The connection to your own mail server and, only if you turn them on, the two optional features below. Recur has no ads, and nothing else leaves your computer. When you open a “manage or cancel” link, your browser visits that service’s website like any other link.

Optional encrypted backup and sync

Backup is off until you sign in under Settings → Back up & sync. Without an account, everything stays on this computer, exactly as described above.

• What is backed up: your subscription list (the extracted receipt details), your edits, hidden and confirmed items, check-in answers, and whether you’ve finished setup.
• What is never backed up: your email or app passwords, sign-in tokens for Google or Microsoft, your mail server and username, the backup sign-in token, and this computer’s scan progress.
• Encryption: everything is encrypted on your computer with a key protected by your passphrase (AES-256-GCM; the key is derived with PBKDF2, 600,000 rounds) before it’s uploaded. The backup server stores only scrambled data and can’t read it, and neither can whoever runs it.
• No reset: if you forget your passphrase and lose your recovery key, your backup can’t be recovered, by you or by anyone else. Your data on this computer is not affected.
• Your email address is used only to send you a sign-in code. It isn’t linked to anything inside your encrypted backup.
• What the backup server can see: that you have an account (your email), how many records you have and how large they are, when they change, and which of your devices sync.
• Leaving: Settings → Back up & sync → Delete backup removes everything from the server. Signing out keeps your data on this computer.

Optional anonymous usage stats

Off by default, and separate from backup. If you turn it on, Recur sends, at most once a day, its version number and a random install ID that isn’t linked to your email, your backup or this device’s backup sign-in. The server stores a one-way hash of that ID and doesn’t keep IP addresses.

Deleting your data

Settings → Delete all Recur data removes the database and the saved password from this computer, and signs this computer out of backup. An encrypted backup, if you made one, stays until you delete it under Back up & sync. Disconnecting an account removes the password and keeps the subscriptions already found. Recur never changes or deletes anything in your mailbox.