Permissions & data

Channel membership is the boundary

The bot indexes only channels it has been invited to. A query can retrieve evidence only from ingested channels the requester currently belongs to, including private channels.

Membership is checked before retrieval and again before delivery. Changed or deleted evidence suppresses the answer. Cross-channel results are never posted publicly; answers and searches are private to the requester. The database enforces the same boundary with row-level security; see tenant isolation.

What RecallHQ processes

RecallHQ stores channel text, thread replies, message metadata, and derived search chunks and embeddings. It excludes its own output, non-content system events, file contents, DMs, and Slack Connect channels.

Retrieved message content is supplied to the configured embedding and generation providers and, when enabled, the reranking provider. RecallHQ does not use Slack API data to train models.

Edits, deletion, and removal

• Message edits rebuild affected search content.
• Deletion events remove source text and derived chunks.
• Confirmed /recall forget #channel disables ingestion and purges indexed channel content.
• Bot removal, channel archive or deletion, token revocation, and app uninstall disable access and queue content cleanup.

There is no automatic age expiry for indexed data. Removing content from the running database does not erase pre-existing backups. Ask your app owner about the active backup and retention policy before sharing sensitive data.

A separate public demo

The Beacon workspace is a fictional dataset. The public demo and playground have anonymous access to that synthetic corpus only. They do not accept Slack tokens, read your installation, or retrieve real workspace data.