Raycast

GDPR overview

Implementation is concrete rather than declarative. Raycast publishes a data processing addendum, last updated on 4 December 2025 and incorporated into the terms, which names the GDPR, the UK GDPR and the CCPA explicitly: the customer is controller, Raycast is processor. Subprocessors are listed on the trust centre, with fifteen business days to object to a change. Schedule 1 documents TLS 1.3 in transit, AES-256 at rest and SOC 2 Type II cloud infrastructure. The addendum grants an annual audit right and the return or deletion of data at the end of the contract. The privacy policy sets out access, rectification, erasure, portability and objection rights, relies on adequacy decisions or contractual clauses for transfers, and names privacy@raycast.com. The enterprise page claims to be GDPR aligned. No Article 27 EU representative is named, which is worth noting for a British company.

Who owns the data?

Raycast's terms draw a clean line. You own everything you type in: inputs stay yours, and Raycast assigns you whatever copyright it might hold in the AI output. In exchange, uploading user content grants Raycast and its service providers, including the AI providers it routes prompts to, a non-exclusive, worldwide, royalty-free, sublicensable, perpetual and irrevocable licence to use, distribute and modify that content in order to provide or improve the service. Raycast may preserve or disclose content where the law requires it. Under the data processing addendum the customer is the controller and Raycast the processor, and the privacy policy states that personal data is never sold.

Reuse rights

You may reuse your inputs and your outputs freely, without asking Raycast for permission: the terms confirm that you own all input and that Raycast assigns you its share of any copyright in the output. The trade-off is responsibility. You must ensure that neither input nor output breaks the law or the terms, and you must comply with the conditions of the AI providers listed in the manual. Two caveats deserve attention. Output is not exclusive, because the same prompt can return the same answer to someone else, and by using the service you waive the right to sue Raycast over infringement claims attached to output. Store extensions are open source, so their code can be read and reused on its own terms, and local data can be exported with an optional encrypted backup.

Data retention & training

Hosting summary

Raycast stores personal data primarily on servers in the United States, and may transfer it to service providers there and in other jurisdictions. The data processing addendum describes that infrastructure as SOC 2 Type II compliant cloud hosting located in the US, subject to regular third-party security assessments including penetration testing. Data is encrypted with TLS 1.3 in transit and AES-256 at rest, multi-factor authentication is available, OAuth and bearer tokens handle authorisation, and third-party credentials remain in the user's own keychain. The architecture is local-first, so a large share of user data never leaves the device: cloud storage is limited to account data and opt-in features such as Cloud Sync and the Teams plan. Cross-border transfers rely on an EU or UK adequacy decision, or on contractual safeguards. No European hosting region is offered. Network lookups place the site's edge address in the United States on Amazon infrastructure, but that address is an anycast CDN node and says nothing about where the data itself is stored.