← Back to Recit

Before you publish this The controller's identity and contact route, the AI provider, the hosting provider and the log retention period are all filled in. Two things left: add Resend to section 5 when transactional email goes live — it receives student email addresses and is a further cross-border transfer — and confirm MaxRetentionSec=30day is actually set in journald on the server, because section 6 now promises it. Then delete this box. Have a Philippine data-privacy practitioner review the notice before you take money from anyone — it describes what the software actually does, but that is not the same as being sufficient under RA 10173 for your circumstances.

Privacy Notice

How Recit collects, uses and protects your personal information.

Last updated: 31 July 2026

This notice is issued under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.

1. Who is responsible for your data

The Personal Information Controller (PIC) for Recit is:

SCP
Dumaguete City, Negros Oriental, Philippines
Data Protection Officer / privacy contact: morningdewdgte@gmail.com

If you have any question about this notice or about how your information is handled, write to the address above.

2. What we collect

We collect only what the service needs to work. Specifically:

Category	What it is	Why we hold it
Account details	Your email address and a cryptographic hash of your password.	To create your account, sign you in, and contact you about your access.
Subscription details	Your plan, remaining AI grading credits, access expiry date, and the fact that a license key was redeemed.	To give you what you paid for and to stop access when it lapses.
Study records	The exam answers you write, your scores, the rubric breakdowns, written feedback, and whether each score was self-assessed or AI-graded.	To show your results, let you retake exams, and track your progress over time.
Session records	When each sign-in was created, last used, and when it expires. The session token itself is stored only as a hash.	To keep you signed in and to enforce the limit on simultaneous devices.
Server logs	Standard web-server records, which may include your IP address, the time of a request and the page requested.	Security, troubleshooting and abuse prevention.

What we do not collect

Payment card details. Payment for a license key is arranged outside this application. We never see or store card or bank credentials.
Your name, school, address, phone number, or date of birth.
Any documents you upload — students cannot upload documents to Recit.
Tracking or advertising cookies. See section 7.

3. Why we may process your data, lawfully

We rely on the following criteria for lawful processing under sections 12 and 13 of the Act:

Performance of a contract with you — running your account, delivering the library and exams you bought, and recording your results.
Your consent — specifically, sending an answer you wrote to an external AI provider for grading. See section 4. That consent is given each time by choosing AI grading, and is never assumed.
Our legitimate interests — keeping the service secure, preventing license-key sharing and abuse, and keeping records of transactions.

4. AI grading, and when your answers leave our system

This is the most important part of this notice. Checking your own answer is completely private. Asking for an AI grade is not — it sends your answer to a third party, which may be outside the Philippines.

Self-check (free) — nothing leaves our server. When you choose “Check myself”, your answer is saved to our database, the stored model answer is shown to you, and you score yourself. No external service is contacted, and your answer is never transmitted anywhere.

AI grading (costs a credit) — your answer is transmitted. When you choose “Grade with AI”, the following are sent to the AI provider we have configured:

the text of the answer you wrote;
the examination question and its model answer;
the relevant legal provisions the question was drawn from.

Your email address, your name and your account details are not sent. The provider is not told who wrote the answer.

Our current AI provider is Ollama Cloud, whose servers may be located outside the Philippines. This is a cross-border transfer of personal information within the meaning of the Act, and by choosing AI grading you consent to it. We remain accountable for that information under section 21 of the Act. If you would rather your writing was never sent to an AI provider at all, use the free self-check instead — it is available on every question and does not expire.

Where Recit itself runs. Our server is hosted by DigitalOcean in Singapore. Your account details, your answers and your results are therefore stored outside the Philippines from the moment you create an account, not only when you ask for AI grading. That is also a cross-border transfer within the meaning of the Act. It is not something you opt into separately: it is how the service is provided, and we remain accountable for your information under section 21 wherever it is held. Choosing self-check keeps your writing away from the AI provider; it does not keep it inside the country.

5. Who else can see your data

You. Your answers and scores are visible only to your own account. Other students cannot see them.
The operator of Recit, who administers the service and has technical access to the database.
The AI provider, in the limited circumstances in section 4.
DigitalOcean, which hosts the server on our instruction.
Government authorities, where we are legally compelled to disclose.

We do not sell your data, share it with advertisers, or use it to train AI models.

6. How long we keep it

Account and study records — for as long as your account exists. The point of the service is to let you retake an exam months later and compare, so results are kept until you delete them or ask us to.
Session records — until the session expires or you sign out, and no longer than 30 days.
Server logs — 30 days.
Record of a redeemed license key — kept after account deletion, with no link to you, purely to prevent the same key being used again.

7. Cookies

Recit sets exactly one cookie, ls_session. It keeps you signed in. It is marked HttpOnly, so scripts in your browser cannot read it, and Secure whenever the site is served over HTTPS. It contains a random token, not your identity. There are no analytics, advertising or third-party cookies. Your theme and last-open tab are stored in your browser's local storage and never sent to us.

8. How we protect your data

Passwords are stored using scrypt with a unique salt per password. We cannot read your password, and neither could anyone who obtained our database.
Session tokens and license keys are stored only as hashes.
Every request for study records is checked against the signed-in account, so one student cannot read another's answers even by guessing identifiers.
Answer keys are withheld by the server until you have committed an answer.
Access to the administrative functions is restricted to the operator.
Traffic is encrypted in transit when served over HTTPS.

No system is perfectly secure. In the event of a personal data breach posing a real risk of serious harm, we will notify the National Privacy Commission and the affected users within 72 hours of knowledge of the breach, as section 20(f) of the Act and NPC Circular 16-03 require.

9. Your rights

Under sections 16 and 18 of the Act you have the right to:

Be informed that your data is being collected and processed — this notice.
Access the data we hold about you.
Object to processing, including withdrawing consent to AI grading (simply stop using it — self-check remains available).
Rectify data that is inaccurate.
Erasure or blocking — have your data removed.
Data portability — obtain a copy in a structured electronic format.
Damages for inaccurate, incomplete or unlawfully obtained data.
Lodge a complaint with the National Privacy Commission.

Exercising them

Two of these you can exercise yourself, immediately, from inside the app:

Download my data — Account › Privacy. Produces a complete JSON file of your account, attempts, answers and scores.
Delete my account — Account › Privacy. Permanently erases your account, every answer and every score. This is immediate and cannot be undone, and no refund of unused credits or subscription time follows from it.

For anything else — correction, objection, or a question about this notice — write to morningdewdgte@gmail.com. We will respond within a reasonable period and in any case no later than 15 working days.

10. Complaints

If you believe your rights under the Data Privacy Act have been violated, please raise it with us first at morningdewdgte@gmail.com so we can put it right. You may also complain directly to:

National Privacy Commission
5th Floor, Delegation Building, PICC Complex, Roxas Boulevard, Pasay City 1307
complaints@privacy.gov.ph · privacy.gov.ph

11. Children

Recit is intended for law students and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a minor has registered, contact us and we will delete the account.

12. Changes to this notice

If we change how your data is handled — particularly if we change AI provider or add a new recipient — we will update this page and change the date at the top. Where the change is significant, we will tell account holders directly. Continuing to use Recit after a change means you accept the updated notice.

13. About the study material

Not a privacy matter, but it belongs with the things you should know before you rely on this service: the case digests and examination questions in Recit are generated with AI assistance from source documents and can be inaccurate. Verify anything you intend to rely on against the original decision or statute, and do not submit generated text for academic credit as though it were your own research.