Security
Free doesn't mean careless.
The short answer: your recordings are unlisted and only reachable with the exact link you send. Nobody can browse them, search them or stumble into them. Here's exactly how that works, in plain English.
Only the link opens it
Every recording gets a long random link code. There is no feed, no search, no browse page and no way to guess or list other people's recordings.
Stored privately, never public
Your video file lives in private storage. It never has a public address. When someone watches, we hand out a temporary playback link that stops working shortly after.
No password to steal
Sign in with Google, Apple, or a one-time email link. Rekkko never stores a password for your account, so there is nothing to leak or reuse elsewhere.
Your library is yours
The database enforces this, not just the app: your recordings, comments, viewing numbers and settings can only be read by your own signed-in account. Even if someone got hold of a page that shouldn't be theirs, the data behind it stays shut.
Playback links expire
The address that streams your video is signed and short-lived. If someone copies it out of their browser, it goes dead soon after — they'd need your share link again, and that link obeys your password, expiry and off switch.
Optional password, properly protected
Add a password to any link. It's stored using a slow, salted hashing method built for passwords, so it can't be read back out. Repeated wrong guesses get throttled and then blocked for a while, so nobody can sit there trying combinations.
Delete means delete
Delete a recording and the video file goes with it, along with its comments and reactions. Links to it stop working immediately.
Where it is hosted
Rekkko runs on Lovable Cloud, built on Supabase. Your account, database and video files are stored in the Europe region, on Amazon Web Services infrastructure in Ireland, and that region is fixed. The website is served from a global edge network so pages load fast wherever you are. Lovable is SOC 2 Type II and ISO 27001:2022 certified and GDPR compliant — its reports and subprocessors are public at trust.lovable.dev.
How sign-in works
You sign in with Google, Apple, or a one-time link sent to your email. That link works once and expires. Because there's no password on your Rekkko account, the most common way accounts get broken into simply doesn't apply here. Your session is yours alone, and signing out clears it.
Controls you have on every link
- Add a password so only people who know it can watch.
- Set the link to expire in 7, 30 or 90 days.
- Switch a link off entirely — it stops working straight away.
- Recordings stay out of search engines unless you deliberately allow it.
What Rekkko never does
- We never sell your personal data.
- We never use your recordings to train advertising systems.
- We never sit and watch your videos. Access happens only for a support request you send us, or a legal obligation.
- Watching a Rekkko never requires an account, so viewers aren't tracked into a profile.
The honest limits
A private link is a private link, not a vault. Anyone you send it to can forward it, so send it to people you trust — and use a password for anything sensitive. Videos are not end-to-end encrypted, which means Rekkko's systems can process your file to play it back. And Rekkko is built by one person, so treat it as a great way to send a two-minute walkthrough, not as the place to store regulated records.
Found something? Tell me directly.
If you spot a security problem, message me and I'll look at it the same day. No forms, no ticket queue.
Last reviewed September 13, 2026. See also Privacy and Terms.
Rekkko is a product of Spark CX FZE, licensed by SPC Free Zone, Sharjah, UAE. Write to farhan@spark.cx.