Privacy and cookies

Who runs Recall Atlas

Recall Atlas is run by Frostinn ehf., a company registered in Iceland, which is the data controller for this website. You can reach us with the contact form at the bottom of this page.

The short version

You can use Recall Atlas without an account and without being tracked. We do not show ads, sell data or build profiles. Visitor statistics are only collected if you click Accept in the cookie banner, and you can change that at any time.

Visitor statistics (Google Analytics)

If you accept, we load Google Analytics 4 to count visits: pages viewed, the site that referred you, your approximate location (country and city, worked out from your IP address), device and browser type, and language. Google Analytics 4 does not store IP addresses. Google sets two cookies, _ga and _ga_VYHRQZSXSN, which keep a random ID for up to two years so repeat visits can be counted. We use the reports only to see which countries, recalls and pages people use, so we can improve the site.

The legal basis is your consent (GDPR Article 6(1)(a)). Google Ireland Limited processes the data on our behalf, and it may be transferred to Google LLC in the United States, which is certified under the EU–US Data Privacy Framework. Google keeps the data for no more than 14 months. If you decline, or never answer the banner, Google Analytics is not loaded at all and no request is sent to Google. Google's privacy policy.

What is stored in your browser

Without your consent we set no cookies. The site keeps two small settings in your browser's local storage. They never leave your device and we cannot read them:

• ra-consent: whether you accepted or declined visitor statistics, so we do not ask again
• ra-theme: light or dark theme, only if you picked one that differs from your device setting

If you accept statistics, Google Analytics adds the cookies _ga and _ga_VYHRQZSXSN described above. Clearing your browser's site data removes all of these.

Change or withdraw your consent

Use Change cookie settings (also at the bottom of every page) and choose Decline. Google Analytics then stops loading. Withdrawing consent does not affect statistics already collected.

Hosting and other services

The site is hosted on GitHub Pages (GitHub, Inc., USA). Like any web server, GitHub receives your IP address when you load a page and logs it for security purposes; we do not receive these logs. GitHub's privacy statement.

Fonts are served from recallatlas.org itself, not from Google. Some recall pages show a product photo that is loaded directly from the government agency that published the recall, so that agency's server sees your IP address. Links to official notices take you to the agency's own website, where its privacy policy applies.

The contact form is run by Tally (Tally BV, Belgium), which processes your message on our behalf (Tally's privacy policy). Nothing is loaded from Tally until you open the form.

The Recall Atlas app

The Recall Atlas app for Android works without an account. What you add to it (your things, cars, gear, children's birth months, the names of people and pets in your household, warranty dates and VINs) is stored only on your phone.

If you turn on alerts, the app sends our alerts server (run on Cloudflare, Inc.) what it needs to match new recalls: a random push token for your phone, your countries, time zone and quiet hours, and the things you watch (brand, product type, model, barcode, car make, model and year, product types, allergens, child-safety age tags and pet food brands). No names, birth dates, e-mail addresses or VINs are sent. The server sends the alert through Firebase Cloud Messaging (Google), which receives the push token and the alert text only. The legal basis is that you asked for the service (GDPR Article 6(1)(b)); allergens are sent only because you chose them, and are used only to match recalls.

Delete your data: in the app open More → Delete my data from the server. This removes your subscription and everything stored with it at once. Turning alerts off stops all sending. If Google tells us a push token no longer works, we stop sending to it. Records of which recalls were sent to you are kept for 30 days so you are not alerted twice.

Purchases: Recall Atlas Pro is paid through Google Play. RevenueCat, Inc. (USA) checks the purchase for us using a random ID; we do not receive your payment details. Lookups you start: scanning a barcode sends only that barcode to the Open Food Facts databases to find the product's name, and filling in a car from its VIN sends the VIN to the US government's NHTSA decoder. The app has no ads, no analytics and no tracking.

If you contact us

We use your name, email address and message only to reply to you, and delete them within 12 months after the conversation ends unless we need them for a legal claim. The legal basis is our legitimate interest in answering messages (GDPR Article 6(1)(f)).

Your rights

Under the GDPR and the UK GDPR you can ask for access to, correction or deletion of personal data we hold about you, ask us to restrict or stop processing it, and receive it in a portable format. Where processing is based on consent you can withdraw it at any time. Because we hold almost nothing about visitors, most statistics data can only be found through Google. You can also complain to a data protection authority: in Iceland that is Persónuvernd, or the authority where you live or work.

Children

Recall Atlas is a general information site and is not aimed at children. We do not knowingly collect data about children.

Changes

We will update this page if anything changes, and change the date below. Last updated 2026-10-17.

Contact us

Questions about this page, your data or a recall listed on Recall Atlas: use our contact form. It opens on tally.so.