No Ticket Needed

Appearance

Understanding Windows Recall — What It Records and Your Privacy ​

Applies to: Windows 11 on Copilot+ PCs
Article Type: Informational
Last Updated: 2026-07-29

Summary ​

Recall takes periodic snapshots of your screen so you can search your own past activity in plain language — "the spreadsheet with the Q3 travel budget" instead of a filename you no longer remember. This article explains what it captures, where that data sits, how to check whether it is switched on, and how to exclude, pause, or delete what it has recorded.

Prerequisites ​

  • Windows 11 running on a Copilot+ PC. Recall is not present on other hardware.
  • Your own sign-in. No admin rights are needed to view or change your own Recall settings.
  • On a work-managed device, company policy can override every setting below. Section 6 covers that.

Instructions ​

1. What Recall Actually Does ​

Recall is a local search tool over your own screen history. While it is running, Windows saves snapshots — still images of your screen — every few seconds, then reads the text and images in them so you can search that history later.

  • You open Recall, type a description of something you saw, and it returns matching moments on a timeline. Selecting one shows the snapshot and offers to reopen the app or page it came from.
  • Snapshots are captured only while you are actively using the PC. Recall stops while the screen is locked or the device is idle.
  • Recall records what appears on your screen, not what you type. It is not a keystroke logger.
  • Recall does not send prompts or snapshots to Microsoft, and it does not answer questions from the internet. That is a different feature — see How to Use Microsoft Copilot in Windows.

Note: Recall is limited to Copilot+ PCs — machines with a neural processing unit rated at 40 TOPS or higher, 16 GB of RAM, 256 GB of storage, and at least 50 GB free. A standard Windows 11 laptop cannot run it, and no update adds it.

2. Check Whether Recall Is On ​

This takes under a minute and answers the question most people actually have.

  1. Press Windows + I to open Settings.
  2. Select Privacy & security in the left sidebar.
  3. Look for Recall & snapshots in the list of settings on the right.
  4. If Recall & snapshots is not in that list, your PC is not a Copilot+ PC and Recall is not installed. You are done.
  5. Open Recall & snapshots and look at the Save snapshots toggle at the top of the page. Off means nothing is being recorded.

Verification: When Recall is on and saving, a Recall icon appears in the system tray at the right end of the taskbar, next to the clock. No icon means no snapshots are being taken. To open Recall itself, press Windows + J or select that tray icon.

3. Where the Snapshots Live and What It Takes to Open Them ​

This is the part that gets misreported most often, so here it is plainly.

  • Snapshots stay on the device. They are written to your PC's own drive in an encrypted store. They are not uploaded to Microsoft, not copied to OneDrive, and not used to train AI models.
  • The store is tied to your hardware. Windows encrypts the snapshots with keys held in the PC's TPM security chip, so pulling the drive out and reading it on another machine does not surrender the data.
  • Opening Recall requires Windows Hello. Your face, fingerprint, or PIN unlocks the timeline every session. A password alone does not open it.
  • You control how much is kept. On the Recall & snapshots page, select Storage to set the maximum space snapshots may use. When that limit is reached, Windows deletes the oldest snapshots first, so the practical retention window depends on the size you allow.

Two honest caveats worth knowing:

  • Deleting the original file does not delete the snapshots that show it. Snapshots are separate copies of your screen and survive on their own until you delete them or they age out.
  • Anyone who can unlock your PC as you can open your Recall history. Lock your screen with Windows + L when you step away — with Recall on, an unattended laptop exposes months of activity rather than whatever is on screen at that moment.

4. Exclude Apps and Websites, and What Recall Filters on Its Own ​

Recall filters some things automatically and lets you exclude the rest by hand.

What it filters without being asked:

  • Sensitive information. The Filter sensitive information toggle on the Recall & snapshots page is on by default. It skips content that looks like a password, a credit card number, or a national identification number.
  • Private browsing. Windows behind an InPrivate window in Microsoft Edge, or an incognito or private window in Chrome, Firefox, or Opera, is never saved.
  • Protected video. Content covered by digital rights management is not captured.

What you exclude yourself:

  1. In Settings > Privacy & security > Recall & snapshots, open the filtering section. Depending on your Windows build it is labelled Filter lists or shown as two entries, Filter apps and Filter websites.
  2. Select Add app, pick an application from the list, and it disappears from future snapshots. A banking app, a password manager, or a clinical system belongs here.
  3. Select Add website, type the address, and press Enter. Website filtering works in Microsoft Edge, Chrome, Firefox, and Opera.
  4. Each entry you add appears in the list underneath, with a Remove option beside it.

Tip: The automatic filter works on patterns, so it recognises a card number but not a contract, a salary spreadsheet, or a candidate's CV — those are ordinary text to it. If a category of content must never be captured, add the app that opens it to the filter list rather than relying on the filter.

5. Pause Recall, Delete Snapshots, or Remove It Entirely ​

There are four separate actions here, and they do different things.

Pause it for the rest of the day

  1. Select the Recall icon in the system tray at the right end of the taskbar.
  2. Select Pause until tomorrow. The icon changes to show snapshots are paused and recording resumes the next day.

Stop it recording from now on

  1. Open Settings > Privacy & security > Recall & snapshots.
  2. Turn Save snapshots off. Recording stops immediately. Snapshots already taken remain until you delete them.

Delete what has already been recorded

  1. On the same page, select Delete snapshots.
  2. Choose Delete all, or pick a time range — the past hour, the past 24 hours, the past 7 days, or the past 30 days.
  3. Confirm. The deletion is permanent and the freed space is returned to the drive.

Remove the feature from the PC

  1. Select Start, type Windows features, and open Turn Windows features on or off.
  2. Clear the checkbox next to Recall, select OK, and restart when prompted.
  3. The Recall & snapshots page disappears from Settings.

6. Recall on a Work Computer ​

On a company-managed device, the decision is usually not yours alone — and that is worth understanding rather than resenting.

  • It is off by default on managed devices, and IT can keep it that way. Administrators can block the feature by policy. If you see Save snapshots greyed out with a note reading Some of these settings are managed by your organization, that is the policy, not a fault.
  • The genuine organisational concern is other people's data. Recall captures whatever is on your screen — a colleague's shared screen in a Teams meeting, a customer record, a payroll file someone emailed you, a patient list. Those are other people's confidential details, sitting in a searchable archive on your laptop, and none of those people agreed to it.
  • In regulated work this matters more. Health, finance, legal, and public sector employers have retention and data-handling rules that a local screen archive can cut across, including obligations to produce or destroy records on request.

If you want Recall enabled on a work device, ask rather than guess. Send IT this: "I would like to use Windows Recall on my Copilot+ PC. Does our data handling policy permit it, and which apps do I need to add to the Recall filter list?" That gets you a real answer, and the filter list you need, in one reply.

Troubleshooting ​

WARNING

With Recall on, an unlocked laptop exposes months of screen history rather than whatever happens to be on screen. Anyone who can sign in as you — a shared desk, a borrowed device, a family member on a home PC — can open the timeline. Lock the screen with Windows + L every time you walk away.

Symptom / ErrorPotential CauseSolution
No Recall & snapshots page in SettingsThe PC is not a Copilot+ PCRecall is not installed and no update adds it. Confirm your hardware in Settings > System > About.
Save snapshots is greyed outBlocked by company policySend IT: "Please confirm whether Windows Recall is permitted on my device under our data handling policy."
Recall finds nothing from last weekStorage limit reached, or it was pausedOpen Recall & snapshots > Storage and raise the limit. Windows deletes the oldest snapshots first when the limit fills.
A password appeared in a snapshotAutomatic filtering matches patterns, not contextDelete that time range in Delete snapshots, then add the app to the filter list as in Section 4.
Snapshots still show a file you deletedSnapshots are separate copies of the screenDelete them by time range in Delete snapshots. Removing the source file does not remove its snapshots.
Recall opens without a Windows Hello promptWindows Hello is not enrolled on the deviceSet it up in Settings > Accounts > Sign-in options. Recall relies on Hello to protect the timeline.