Privacy Policy

1. Who is responsible

Alcove is run by Victor Hugo da Silva Ribeiro, an individual based in Brazil, who is the controller of your personal data ("we", "us"). For anything about privacy, including exercising your rights, write to [email protected]. The same address reaches the person in charge of data protection (the encarregado, under LGPD art. 41).

2. What we collect

Your account

• Email address and password, if you sign up with email. Your password goes straight to our sign-in provider, Firebase Authentication (by Google), which stores it hashed. Our servers never see it.
• Google sign-in. If you sign in with Google, Google shares your name, email address, profile photo address and Google account ID. We use the name to suggest your display name and the email address to identify your account. We don't use your photo.
• Sign-in protection. Firebase Authentication also processes your IP address and device details when you sign in, to protect accounts from abuse.
• Profile: the display name and username you choose, and the app's language.
• Account records: when your account was created, whether your email address is confirmed, and which version of this policy you agreed to, and when.

What you create in Alcove

• Routines: their name, description, icon, color and timer settings, and their tasks (title, comment, number of intervals and tags).
• Tags you create.
• Goals: what each one counts (one tag, or all your focus), its target, whether it's daily or weekly, the days it applies to, and the dates each version of it was in force.

Your focus activity

• For each day, by your local date: your total focus time, the intervals you completed, and the time spent on each task, with the task's title and tags as they were at the time.
• Each stretch of work the app records (when it was saved, for which task, how long, and whether the task was finished). This keeps your history right when you use several devices or work offline.
• Your streak, the badges you earn and when, and whether you've seen their notices.

Friends

• Who you follow and who follows you.
• Notifications about the people you follow: their new badges, and a short recap of how long they focused the day before.

The AI routine assistant

If you open Plan with AI and send a message, we send Google's Gemini model (on Gemini Enterprise Agent Platform) your messages in that conversation, the routines it proposed and what you did with them, your display name, today's date, the app's language and the names of your tags. It needs them to write a reply. The conversation isn't saved on our servers: it lives in your browser tab and is gone when you leave the Focus page. We only store how many messages you sent each day and their size in tokens, to apply the daily limit. If the assistant declines a request for safety reasons, we log the kind of request (for example, "weapons"), never what you wrote.

Emails we send you

To send account emails (welcome, address confirmation and password reset), we give your email address, and for the welcome email your display name, to Amazon Simple Email Service (SES). We keep the address and the time of each confirmation or password reset email for 2 days, to limit how often they can be requested.

Server logs and usage events

• Request logs. Every request to our servers is logged with your IP address, your browser and device (user agent), the address requested, the time, the response status and how long it took, a request ID, and your account ID when you're signed in. Errors are logged with their cause. We use these logs to keep Alcove running and secure, and to fix problems. For a sample of requests we also record performance traces: what the server did, and how long each step took.
• Usage events. While you're signed in, the app reports which pages you open (Focus, Dashboard, Credits and profiles, noting whether a profile is your own), when you start a radio station and how long you listen, and when you open the AI assistant. These events are linked to your account ID and kept in the same logs. We use them to learn which parts of Alcove are used, so we can improve it. No third-party analytics tool is involved, and they aren't shared with anyone.
• Error reports. When something breaks in the app on your device, it sends us a report: the error message and where in our code it happened, the page's address (without anything after a "?"), the app version, your browser and device (user agent), the time, and your account ID when you're signed in. They're kept in the same logs, and we use them only to find and fix bugs.
• Access logs. Brazil's Marco Civil da Internet (Law 12.965/2014, art. 15) requires keeping records of access to an application (IP address, date and time) for 6 months. We keep a copy of the request logs for that long, in a separate store only we can reach, and look at it only to answer a court order or to investigate abuse. If you delete your account, we keep a minimal record of it for the same 6 months (its account ID, email address, username, display name and when it was created and deleted), so those logs can still be tied to an account if a court asks.
• Other logs are deleted after 30 days. What's left are weekly totals for all of Alcove (for example, how many people were active in a week), which contain no account IDs and can't identify you.

3. Cloudflare Web Analytics

Our pages, this one and the home page included, load Cloudflare Web Analytics, a measurement script from Cloudflare. For each page view it reports to Cloudflare the page's address, the site you came from, your browser, operating system and type of device, your country (worked out from your IP address), and how quickly the page loaded (Core Web Vitals).

It doesn't use cookies or any other storage on your device, doesn't fingerprint you, and isn't linked to your Alcove account. Cloudflare uses your IP address only to receive the data and doesn't store it. We only see totals, which we use to find pages that load slowly.

4. Cookies and storage on your device

We don't use advertising or tracking cookies, so there's no cookie banner. Alcove only keeps what it needs to work:

5. How we use your data, and why

When you create your account, we ask you to confirm that you've read and agree to this policy, and we record which version you agreed to and when. Where we rely on legitimate interests, we use only the data listed above and keep it for a short time, and you can object (see section 10). We don't make decisions about you based solely on automated processing.

6. What other people can see

Alcove has a light social side. Anyone signed in to Alcove can find you by your username and open your profile, which shows:

• your display name and username;
• how long you focused each day (totals only), and your streak;
• your badges;
• who follows you and who you follow.

People who follow you are told when you earn a badge, and may see how long you focused the day before in a recap. Your routines, task titles, comments, tags, goals and AI assistant conversations are never shown to other users. Profiles can't be seen by people who aren't signed in, or by search engines.

7. Who processes your data for us

We use these service providers (operators, in LGPD terms) to run Alcove. They process data only on our instructions, under their data processing terms:

• Google Cloud and Firebase (Google LLC): sign-in (Firebase Authentication), our servers (Cloud Run), the database (Cloud SQL), logs, monitoring and traces (Cloud Logging, Cloud Monitoring and Cloud Trace), and the AI assistant (Gemini on Gemini Enterprise Agent Platform). Under Google Cloud's terms, Google doesn't use what you send the assistant to train its models. Located in the United States.
• Cloudflare (Cloudflare, Inc.): hosting and delivering the website, network security, storage for the radio's audio (R2) and Web Analytics. Requests are handled in the Cloudflare data center nearest to you.
• Amazon Web Services (Amazon Web Services, Inc.): sending emails (Amazon SES). Located in the United States.

If you sign in with Google, Google's own privacy policy also applies to your Google account.

We don't sell or share your data with anyone else, unless the law or a court order requires it, or to protect the rights and safety of Alcove and its users. If Alcove is moved to a company (for example, one set up to run it), your data moves with it, under this policy, and we'll let you know.

8. International transfers

Our servers and database are in the United States, and Cloudflare may handle your requests in a data center outside your country. These transfers rely on the safeguards in our providers' data processing terms, such as standard contractual clauses (LGPD art. 33; GDPR art. 46) and, for providers certified under it, the EU–U.S. Data Privacy Framework.

9. How long we keep it

10. Your rights

Under the LGPD (art. 18) and, where it applies, the GDPR, you can:

• confirm whether we process your data, and access it;
• correct data that is incomplete, inaccurate or out of date (you can change your display name and username on your profile at any time);
• have data that is unnecessary, excessive or processed unlawfully anonymized, blocked or deleted;
• get a copy of your data in a portable format (JSON);
• have your account and its data deleted;
• know who we share your data with (see section 7);
• object to processing based on legitimate interests;
• withdraw consent, where we rely on it;
• complain to a data protection authority: in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados, gov.br/anpd); in the EU or the UK, your local supervisory authority.

To use any of these rights, email [email protected] from your account's email address, or tell us your username, so we can confirm it's you. We'll answer within 15 days.

You can download a copy of your data yourself, under Account → Privacy options on your profile. It's a JSON file with everything our database holds about you: your account and profile, routines, tags, goals, focus history, badges, follows, notifications, AI assistant message counts and the records of emails we sent you. Server logs aren't in it; write to us if you want those too.

You can delete your account yourself, under Account on your profile: type your username to confirm, and your account and everything in it (profile, routines, tags, goals, focus history, badges, follows and notifications) are deleted right away, together with your sign-in record at Firebase Authentication, and every device is signed out. This can't be undone. Copies in our backups are gone within 7 days, and server logs within 30. The access logs and a minimal record of the account (its ID, email address, username, display name and dates) are kept for 6 months, because Brazilian law requires it, and then deleted (see section 9). You can also email us and we'll delete it for you. You can sign out of all your devices from your profile at any time.

11. Security

• All connections use HTTPS.
• Your sign-in tokens are kept in HttpOnly cookies, which scripts on the page can't read, and never in your browser's storage.
• Passwords are handled by Firebase Authentication and never reach our servers.
• The database sits on a private network, only accepts encrypted connections, and is backed up daily.
• Access to production systems is limited to the people who run Alcove.

No system is perfectly secure. If a security incident could cause you significant risk or harm, we'll tell you and the ANPD (LGPD art. 48).

12. Children

Alcove isn't meant for children under 13, and we don't knowingly collect their data. If you're under 18, use Alcove only with permission from a parent or guardian. If you think a child under 13 has created an account, write to us and we'll delete it.

13. Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, such as new kinds of data, new purposes or new providers, we'll tell you by email or in the app before it takes effect, and ask you to agree again where needed.

14. Contact

Victor Hugo da Silva Ribeiro, controller of Alcove's personal data: [email protected].