Privacy Policy

01 Interpretation and Definitions

• Account: A unique account created for You to access our Service.
• Application / Service: The software program named Aletto.
• Company ("We", "Us", "Our"): Tandavaworks Global LLP, Chennai, Tamil Nadu, India — acting as Data Fiduciary / Controller.
• Personal Data: Any data about an identifiable individual.
• Username: A unique public name (your @username) you choose to identify yourself to other users. It is your Handle. The app calls it a username for a person and a handle for a channel; they are the same thing, drawn from the same list of names.
• Connection: Another Aletto user you are connected with. A connection is mutual: one of you sends a request, and once the other approves it, each of you can ping the other. If both of you send a request, you are connected at once. The app lists your connections as Mutuals.
• Recipient: A person (a Connection, or an email address you provide) to whom a ping is delivered.
• Ping: A message you schedule by time, or send now, or that goes off on an event you choose. It can go to yourself, to your Connections, to a Circle, or to a Channel. In the app, a ping that goes only to you is called a Reminder, and one that goes to anyone else a Message. (Earlier versions of the Service called a ping an "alert".)
• Voice Note: An audio recording you make in the app and attach to a ping or post. Unlike dictation, it is stored: it is content, not a way of typing.
• Saved Place: A place you save (a name and map coordinates) to reuse when creating arrive & leave pings.
• Arrive & Leave Ping: A ping that goes off when your device enters, leaves, or remains ("dwells") for a set time within a virtual boundary (a "geofence") around a Saved Place. This lets it go off based on where you are, even while the app is closed. The size of the boundary (the radius) is set on each arrive & leave ping. Each arrive & leave ping is watched by one of its owner's phones at a time.
• Subscription: A recurring paid plan: Plus, Pro or Business. This word refers only to billing; following a channel is not a subscription.
• Credits: A consumable in-app balance used to send pings by paid delivery methods (currently email). Credits are bought once, included with a plan, granted monthly to signed-in free accounts, or received as an Invitation Reward.
• Invitation Reward: Credits given to both the person who invited somebody and the person who joined, once the new account has a verified sign-in and its first ping has reached someone else.
• Automatic Ping: An arrive & leave ping or a YouTube or Twitch ping, which goes off on an event rather than on a clock. Plans limit how many can be active at once.
• Delivery Method: How a ping or post reaches a person: by app notification (push), by email, or as a browser notification. The app labels this "Delivery".
• Circle: A named group of people you are already connected with, used as the audience of a ping. A circle does not by itself create a connection with anyone.
• Channel: A stream of posts by its owner, which other users may choose to follow. A channel is public, unlisted, or private. Only approved followers can see a private channel's posts.
• Post: An item in a channel. The owner writes it, or it is produced when one of their pings goes off. (Earlier versions of the Service called a post an "update".)
• Handle: The public @name that identifies a user or a channel. Users and channels share one namespace, so a handle is unique across both.
• Follower: A user who has chosen to receive a channel. Following is the consent, and a channel owner can never add a follower.
• Ping Content: What a ping or post carries: an optional message and up to 20 attachments (photos, voice notes and links), in any mix.
• Profile: The page other users see when they open your account: your name, username and photo, the public channels you run, and two figures about those channels.
• Web App: Aletto at www.aletto.app, used in a browser with the same account as the app. See §12.
• Pings tab: The list in the app of the pings that reached you and the notices about your account. (Earlier versions of the app called it the Inbox.)
• Invitation: An email, or a link you share yourself, asking somebody who is not on Aletto to join.
• YouTube or Twitch Ping: A ping that goes off when a public channel on a third-party platform (currently YouTube or Twitch) does something you chose to watch for.
• Watched Channel: The public channel on a third-party platform that a YouTube or Twitch Ping observes. It belongs to a third party, who is usually not an Aletto user. It is not an Aletto Channel.
• Reaction: An emoji you can leave on a channel, a post, or a ping that reached you. You can hold one per item, and choosing another replaces it.
• Arrive & Leave Request: An ask sent to another user proposing that they create an arrive & leave ping on their own device, for a place, radius and triggers you propose, with you as a recipient. They decide whether to create it.
• Connection Request / Permission: A request by one user to connect with another, and the authorization that results. It can be requested, approved, declined, or revoked.
• Verification Link: A single-use, time-limited link sent to an email address to verify ownership or to accept a request.
• Block / Report: Controls that let you stop another user from contacting you (Block), or flag a user or content for our review (Report).
• Data Principal / Subject / Consumer: You, the individual to whom the data relates.

02 Collecting and Using Your Personal Data

Types of data collected

• Contact Information: Email, first name and last name. These come from Google Sign-In, or from the email address and password you register with in the app or on the website. We never receive your password; the sign-in provider checks it.
• Guest use: You may use Aletto as a guest without creating a permanent account. A guest can view content, search for and view people, and create pings for themselves only, delivered as app notifications. A guest cannot add email addresses, create circles or channels, follow channels, connect with or invite people, ask for an arrive & leave ping, or use paid delivery. A guest gets no free credits and never appears in other users' search results. The Service still needs to store a guest account's data to work, and that data is tied to the installation. If you sign out without first linking the guest account to a Google or email account, the account and its data are permanently lost, and we cannot recover them.
• Profile & Username: A unique public username and display name. With your photo, these identify you, and if discoverability is on, they let others find you. You can remove your photo at any time. Display names and channel names may not imitate Aletto itself.
• Starter profile picture: If a new account has no photo, we create a picture from its initials using DiceBear (see §4), which receives your display name to draw it. Within about an hour we copy the picture into our own storage and stop using DiceBear's address. Until then, a device showing your picture fetches it from DiceBear. You can replace or remove it at any time.
• Your profile as others see it: Any signed-in user who opens your profile sees your name, username and photo, the public channels you run, how many of them there are, and how many people follow them in total. Unlisted, private and suspended channels are never shown there. Your email address, timezone and connections are never shown on a profile. A channel's own screen does not name its owner, but your profile does, so running a public channel links it to you for anyone who opens your profile.
• Your profile link: Share my profile gives you a link to your profile (link.aletto.app/s/…) to send however you like. Opening it sends no connection request and connects nobody; the person can send you a request from your profile if they want to. A signed-in user who opens it sees your profile as described above. Anyone else, including someone without the app, sees only your name, username and photo, with links to install Aletto, and apps that show link previews may show your name and photo too. The link does not work for people you have blocked, or while your account is suspended or deleted.
• Preferences: Your timezone, your language, and how you like dates and times written (12- or 24-hour clock and the order of day, month and year). They are stored with your account so that every device you use, and the notifications and emails we write for you, follow them. Until you choose a language, we use your device's language.
• Device identifiers & multiple devices: For each device, a persistent UUID, a notification (FCM) token, and basic metadata for secure routing, such as its name, model and operating-system version. We also record when each phone last opened the app and, from a check-in the app makes at most every six hours (in the background where the phone allows it), when it last confirmed that notifications are arriving. We use those times only to notice a phone that has stopped receiving pings (see §11). You can remove any device at any time.
• Additional Email Addresses: Addresses you add and verify for delivery or for verification links, with their verification status and which kinds of pings each one receives. When you verify an address, it is switched on for your own pings. Pings from people and circles, and channel posts, stay off until you turn them on. If somebody else later signs in to Aletto with an address that is verified on your account, the address moves to their account, you receive a notice naming the address, and we tell neither of you anything about the other.
• Pictures and files you upload: Your profile photo, a circle's picture, a channel's picture, and the photos and voice notes you attach to a ping or post, whether you upload them in the app or on the website. All are uploaded over HTTPS and stored with our storage provider (see §4). Every picture is re-encoded on upload, which removes the EXIF metadata a camera embeds, including the GPS coordinates of where the photo was taken. A voice note is stored as recorded. We do not transcribe it, and nothing in the Service converts it to text. You can replace or delete any of them at any time.
• Ping and post content: The message you write, the schedule or trigger you set, who you addressed it to, and up to 20 attachments (photos, voice notes and links). We store this because it is what the Service exists to deliver, and we keep it until you delete the ping or your account. It is never used for advertising or profiling.
• Web session data (browsers only): One strictly necessary session cookie and a matching session record when you sign in at www.aletto.app, as described in §12.
• Invitations to people who are not on Aletto: If you invite somebody by email, we process their email address and the fact that you invited it. We do this to send the invitation and to enforce anti-spam limits: one invitation per address per sender, ever; at most three from anybody; and at most ten sent by you in a day. Every invitation carries a one-click unsubscribe. An address that unsubscribes goes on a suppression list that permanently stops any Aletto user from inviting it again. The invitation says who invited them and nothing else: no ping content and no preview. We do not read, import, or store your contacts or address book. If you would rather we processed nothing, share the invitation link yourself instead.
• Invitation rewards: If somebody creates an Aletto account by opening your invitation link, we record that their account joined through your invitation. It is one record per new account, and only the first invitation they open counts. When their account has a verified sign-in and their first ping has reached someone other than themselves, we give each of you the Invitation Reward and note when it was paid. The notices we send about it do not name the other person. We use this record only to pay the reward and to stop it being claimed twice or farmed.
• Connections & Recipient Data: The user identifier, username, display name and email addresses of people you connect with or send to, the status of any connection request between you, and the delivery choices each of you made for the other. Your username, name and photo are visible to your connections. Only add people who have agreed to receive pings.
• Location Data (only if you use arrive & leave pings): The map coordinates and name of each Saved Place you create, the radius of each arrive & leave ping, and the boundary crossings (arriving at, leaving, or dwelling at a Saved Place) that trigger your arrive & leave pings. To detect these crossings, your device's operating system monitors your location in the background, subject to the permission you grant. Saved-place coordinates are stored encrypted and are visible only to you. They are used solely to power your arrive & leave pings: never for advertising or profiling, and never shared with your connections. When an arrive & leave ping goes off, the phone checks its position against the boundary itself and sends Aletto only which ping went off and whether you arrived, left or stayed, never your coordinates. The people that ping goes to receive the ping you wrote, which tells them you arrived at or left that place. We do not build a location history or track your continuous movements. We only process the arrive, leave and dwell events for the places you choose. If your phone has no connection when it crosses a boundary, it keeps the crossing (which ping, whether you arrived, left or stayed, and when) on the phone, up to the most recent 50, and sends it when the connection returns. The ping then says when the crossing happened. The boundaries are registered and monitored on a physical phone, so each arrive & leave ping is watched by one of your phones at a time, at first the one it was created on. Your other devices and the website show which phone that is (its name and model). You can move an arrive & leave ping to another of your phones with Watch on This Phone; the first phone then stops watching it. If you reinstall Aletto or sign in again on the same phone, its arrive & leave pings return to it. Arrive & leave pings are entirely optional. If you never create a Saved Place or grant location permission, no location data is collected.
• Circle Data: The circles you create (name, description, colour and picture), who is in each one, and each member's status (added, invited, accepted, declined, left, removed or muted), with timestamps. Members of a circle can see the other members. If you decline or leave a circle, we keep that fact so the owner cannot silently add you again.
• Channel Data: For the channels you own: the name, description, picture, colour, @handle and visibility (public, unlisted or private), and the posts in them. For the channels you follow: which delivery method you chose, whether you muted the channel, any daily limit you set, and how far you have read. For a private channel: who has asked to follow it and whether the owner has answered. A public or unlisted channel's name, description, picture, handle and posts are public information (see §6). No channel's list of followers is ever public.
• YouTube and Twitch Ping Data: The public identifier of the channel you asked us to watch (for example a YouTube channel id), the trigger you chose, and the most recent observation we made of that channel, such as its latest video id or whether it is currently live. That observation is what lets us tell a change from a repeat. Where a platform supports it, we register a callback with that platform so it can notify us of new content; the credentials for that callback are stored encrypted. We do not ask for, receive, or store your login, password, token, or account information for YouTube, Twitch, or any other platform. We do not read anything that is not publicly visible on the channel. We also keep the watched channel's public picture, refreshed about once a day. Video titles and pictures we receive from YouTube or Twitch are removed from your ping history and Pings tab after 28 days (see §14).
• Reaction Data: Which channel, post or ping occurrence you reacted to, the emoji you chose, and when. You hold one reaction per item, so choosing another replaces it rather than adding to it. Who can see a reaction is described in §8.
• Arrive & Leave Requests: When you ask another user to create an arrive & leave ping, we store the request until they create the ping or decline it, or you withdraw it. That record holds who asked, who was asked, the proposed place, radius and triggers, the status, the ping it led to, and timestamps. We keep a record of a declined request so the same person cannot be asked again straight away. If they create the ping, the place you proposed is saved on their account, marked "Auto created", used only by that ping, and deleted with it.
• Connection Requests & Permissions: The users involved and the status of each request (requested, approved, declined or revoked), with timestamps. Approving a request records the connection in both directions.
• Blocking, Reporting & Moderation Data: When you block a user, we record the blocking relationship so we can stop contact. When you report a user or content, we collect the report (the reason you select, the reported content or identifier, and timestamps) and any automated or manual moderation outcomes. We use this to keep the Service safe and to comply with law. We also record connection requests you decline, so they are not shown to you again. You can review them alongside blocked users under People → Blocked & Declined. See §10.
• Email Verification Links: The destination email and a one-time, short-lived token, which is invalidated once used.
• Subscription & Purchase Data: Your plan, its status, renewal or expiry date, whether the current period is a free trial, your credit balance, the date your monthly credits next refill (worked out from when you signed up or bought your plan), and your credit transactions, including any monthly free credits and Invitation Rewards. We never receive or store full card or bank details. Apple or Google processes the payment, and RevenueCat handles validation and entitlements using a pseudonymous token and the product purchased.
• Advertising Identifiers & Ad Data (mobile apps only): Google AdMob may process device advertising identifiers and coarse ad-interaction data. That means the Google Advertising ID on Android, and on iOS the IDFA only where you permit tracking through Apple's App Tracking Transparency (ATT).
• Advertising Cookies & Ad Data (website, where ads are shown): On pages of www.aletto.app that carry an ad, Google AdSense may set or read cookies and similar identifiers in your browser and process your IP address, browser details and coarse ad-interaction data, subject to your consent where it is required (§3).
• Diagnostics & Usage Data (mobile apps): Crash reports and diagnostics (Firebase Crashlytics). A small set of usage events (Firebase Analytics): one-time milestones (the app's first opening, your account being created, your first connection, and your first ping created, sent and received), the fact that an invitation was shared or emailed, and the reason category when a ping could not be sent (for example, not enough credits), together with your plan level. These events carry no ping content, no recipients, no email addresses and no places. The website sends none of them.
• App integrity (mobile apps): To keep automated abuse away from our servers, the app obtains a short-lived token from Firebase App Check, backed by Google Play Integrity on Android and Apple App Attest on iOS, that shows a request comes from a genuine copy of Aletto on a real device. The token says nothing about who you are or what you do in the app.

Purposes of processing

We process your data to:

• create and secure your Account, operate your profile and username, and (where you enable it) let others find you;
• write notifications and emails in your chosen language and date format;
• register your devices and route pings to them, and verify email addresses and operate verification links;
• deliver pings to you and your Recipients;
• create and manage Saved Places, and trigger arrive & leave pings when you arrive, leave or stay;
• manage Connections and connection requests;
• create and operate Circles, and work out who a circle ping should reach at the moment it goes off;
• operate Channels and deliver their posts to the people who follow them, by the delivery method each follower chose, and carry follow requests for private channels between the person asking and the owner;
• observe the public channels your YouTube and Twitch pings watch, and detect the change you asked about;
• store the photos, voice notes and links you attach, and show them only to people allowed to see them;
• record and display Reactions;
• carry Arrive & Leave Requests between the two people involved, and enforce the limits on them;
• send the invitations you ask us to send, and honour unsubscribes and the suppression list;
• pay Invitation Rewards to both people once the conditions are met, and stop them being claimed twice or farmed;
• sign you in to the web app and keep that session for as long as it lasts;
• operate blocking, reporting and content moderation;
• provide and manage Subscriptions and Credits, including monthly free credits, and prevent fraud;
• display and measure advertising in the mobile apps and on the website, subject to your consent;
• provide an in-app Help & FAQ and support, and let you export a copy of your data;
• keep backups so the Service can be restored after a failure;
• check that requests come from genuine copies of the app, and understand where new users stop using it (the milestones described above);
• maintain security, limit abuse and support accessibility; and
• comply with law.

Discoverability and Visibility Controls

When you enable "Allow others to find me," your username, display name and profile photo may appear in other users' search results, so they can send you a connection request. You can turn it off at any time in your profile. That stops new users from finding you by search; existing connections are unaffected. Guests never appear in search results. Anyone who reaches your profile another way (for example from a circle you share or a ping you sent them) can still open it.

03 Advertising and Your Consent

The mobile apps display ads through Google AdMob. Ads may be personalized or non-personalized depending on your region and consent.

• Consent at startup (EEA, UK & Switzerland): We present a consent message at startup through Google's User Messaging Platform (UMP), as Google's EU User Consent Policy requires, before showing personalized ads or using non-essential storage. You can change your choice later in Settings → Ad Privacy Settings.
• iOS App Tracking Transparency: On iOS, we ask permission through Apple's ATT prompt before any cross-app tracking. If you decline, you see non-personalized ads.
• Opting out: You can reset or limit your advertising identifier in your device settings, decline ATT or consent, or withdraw consent in the app. We then instruct AdMob to serve non-personalized ads.
• Children: We do not knowingly serve personalized ads to users below the applicable age (see §21).
• Paid plans: Members on a paid plan see no ads, in the apps or on the website. Pages about an arrive & leave ping never carry an ad.

Advertising on the website

Pages of www.aletto.app may display ads through Google AdSense to visitors who are not signed in and to members on the free plan. Each page shows at most one ad, clearly labelled, below the page's own content.

• Third-party cookies: Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to our site and/or other sites on the Internet. Learn more in How Google uses information from sites or apps that use its services.
• Consent (EEA, UK & Switzerland, and US states that require it): Before any ad loads, we show Google's consent message, provided through Google's certified consent management platform. Ads may be personalized or non-personalized depending on your choice. You can change your choice at any time with the Privacy & cookie settings link shown beside every ad.
• Opting out: You may opt out of personalized advertising by visiting Google's Ads Settings, or opt out of some third-party vendors' use of cookies for personalized advertising at www.aboutads.info (or www.youronlinechoices.eu in Europe).
• What we do not share: We do not give Google or any advertiser your name, email, pings, messages, contacts or places. Signed-in pages that carry an ad do not pass your identity to the ad network; the ad is matched to the page and, where you consent, to Google's own cookies.

04 Third-Party Services

• Google Play Services & Google Sign-In
• Firebase Cloud Messaging, Firebase Authentication, Crashlytics, Analytics & App Check: notification delivery to phones, tablets and browsers; sign-in with Google or with an email and password; crash diagnostics; the usage milestones described in §2 (mobile apps only); and checking that requests come from a genuine copy of the app, using Google Play Integrity on Android and Apple App Attest on iOS.
• Zoho ZeptoMail: sends our emails (pings and posts by email, verification links, invitations and account notices). It receives the recipient's address and the content of that email.
• DiceBear: draws the starter profile picture for a new account without a photo, from the display name it is given (see §2).
• Backblaze B2: storage for the pictures, photos and voice notes you upload. It holds a private store for everything attached to pings and posts and for circle pictures, and a public store for profile and channel pictures and for public channel content. Both are in the EU (Amsterdam) region. Private files reach you through our own server at media.aletto.app, and only after we have checked who is asking.
• Cloudflare: the content delivery network that serves public files from cdn.aletto.app. Cloudflare processes each request, including the IP address of whoever opens a picture, in order to deliver it.
• Google Maps Platform: displays the map used to choose and view Saved Places (arrive & leave pings only).
• RevenueCat: subscription and purchase management.
• YouTube Data API Services: used only to read public information about the channels your YouTube pings watch, and to receive notifications when one of them publishes. By using YouTube pings you are also bound by the YouTube Terms of Service. Aletto is not affiliated with, endorsed by, or sponsored by YouTube or Google. We send no personal data about you to YouTube: a request identifies a channel, not a user.
• Twitch: used only to read the public live status of the channels your Twitch pings watch. Aletto is not affiliated with, endorsed by, or sponsored by Twitch. As with YouTube, no personal data about you is sent.
• Google AdMob / Google AdSense: advertising in the mobile apps (AdMob) and on the website (AdSense), and Google's consent message for both.
• Apple App Store & StoreKit / Google Play Billing: payment processing.

05 Sharing Your Information

We do not sell your Personal Data for money. We share it only:

• With Recipients and Connections you choose. Ping content and your username, name and photo are shared with the people you send to or connect with.
• With the members of a Circle you create or join. Members can see who else is in it.
• With the followers of a Channel you run. For a public or unlisted channel, that means publicly: its name, description, picture, handle and posts can be seen by anyone, including people who are not Aletto users and search engines. A private channel's posts go only to followers you approved. No channel's list of followers is published.
• On your profile, with any signed-in user who opens it: your name, username and photo, and your public channels with their follower total.
• Through your profile link, with anyone it reaches: your name, username and photo (see "Your profile link" above).
• With other users through search, only if you enable "Allow others to find me".
• With processors under contract: Google Firebase, Backblaze B2 and Cloudflare (for the files you upload), Zoho ZeptoMail (our email delivery provider), DiceBear (starter profile pictures), RevenueCat, the Apple and Google stores, and Google AdMob and Google AdSense.
• With the person who invited you, or whom you invited, only in this sense: when an Invitation Reward is paid, each of you is told that a reward was paid, without the other being named.
• With anyone holding an email of yours, for as long as the file links in it last: a photo or voice note in an email can be opened by whoever the email is forwarded to, for about 30 days. See the note in §2.
• With a person you invite by email. The invitation tells them who invited them, and nothing more.
• For legal reasons, where required by law or to protect rights and safety.

We do not share your personal data with YouTube or Twitch. A YouTube or Twitch ping asks those platforms about a channel, and the request carries no information about who is watching it.

A link to a channel, a post or a profile is a short code. It does not reveal internal identifiers or when the item was created. Opening it shows only what the person opening it is allowed to see.

When you use "Share Aletto" to recommend the app, your device's share sheet sends only a link to our store listing. We do not collect who you share it with.

06 Circles and Channels

Both let one ping reach more than one person, and they are opposites in who chooses.

Circles — you choose the audience

• You can only add someone to a circle if you are already connected with them. A circle is a label over connections you already have; it never creates one.
• The first time you are added to someone's circle, you are a member straight away. There is no invitation to accept. What makes this possible is the connection you already approved, which is what lets the two of you ping each other at all; a circle only groups people its owner could already reach.
• If you leave a circle or decline an invitation to it, that changes. A later add becomes an invitation you must accept, and a decline blocks any further invitation to that circle for 14 days. The owner is never told that you declined: your invitation keeps showing as not yet answered. Being removed by the owner does not work this way; they can add you back directly, because removing you was their decision.
• Members can see the other members of a circle they are in.
• You can mute a circle to stay in it without receiving its pings, or leave it. If you leave, the owner cannot silently re-add you; a re-invitation has to be accepted again. We keep the record of your leaving in order to enforce that.
• Membership is worked out at the moment a ping goes off, not when the ping was created. If you leave, you stop receiving immediately.

Channels — the follower chooses

• Unlisted channels are not shown in Discover or on your profile, but they are not private: anyone with the link can view one.
• Private channels (available on the Plus, Pro and Business plans) are not listed anywhere. A person with the link can see the channel's name, description and picture, so they know what they are asking to join, but only followers the owner approved can see its posts, including their photos and voice notes. Those files stay in our private store (see §2).
• Asking to follow a private channel is private in both directions. The owner sees who is asking. If the owner says no, the person who asked is never told; their request keeps showing as waiting. We keep the refusal so the same request is not raised again.
• If an owner's plan changes, a private channel stays private. We never make a channel public because of a billing change; we may only stop new posts being made in it until the plan allows it again.
• A channel owner can never add a follower. Following is the consent, and it is always the follower's own action. For a private channel, the owner can refuse a request, but can never create one.
• The list of followers is never public. An owner sees how many people follow and the breakdown by delivery method. They do not get a list of names. A follower count is not reduced when someone mutes a channel, so it cannot be used to tell who muted.
• Your public channels appear on your profile with their total number of followers (see §2).
• As a follower, you choose which delivery method a channel reaches you by. You may set a daily limit on how many of its posts reach you, and you may mute or unfollow at any time. Because you choose the delivery method, you pay any credits a paid method costs (see the Terms).
• A channel handle comes from the same namespace as usernames, which stops a channel from taking a user's handle or impersonating them.
• Posts may be written by the owner, or produced automatically when one of the owner's pings goes off. Followers are not told which. Either way, the post appears in the channel.
• A post's photos and voice notes are as visible as its words: public in a public or unlisted channel, and followers-only in a private one.

07 YouTube and Twitch Pings

A YouTube or Twitch ping watches a public channel on a third-party platform and tells you when something you chose happens: a new video, a stream going live or ending, or a subscriber count passing a number.

• We never connect to your account on those platforms. We do not ask for, receive, or store your username, password, or any access token for YouTube, Twitch, or any other service. We cannot see your subscriptions, viewing history, or anything else private to your account there.
• We read only what is public about the channel you named. We store the identifier of that channel and our most recent observation of it, for example the id of its latest video, or whether it is currently live. We keep the last observation because it is the only way to tell a change from a repeat.
• Requests carry nothing about you. When we check a channel, the request identifies the channel, not the user watching it. If several people watch the same channel, we check it once for all of them, which also means the platform cannot learn how many Aletto users follow it.
• Notifications from the platform. Where a platform can tell us the moment a channel publishes, we register a callback with it so we do not have to keep checking. The shared secret for that callback is stored encrypted.
• The watched channel's owner is a third party. They are usually not an Aletto user, have no relationship with us, and are not notified that you watch them. We hold no personal data about them beyond the public channel identifier and public details such as the channel's name, avatar and the latest video's title and thumbnail.
• Deleting a YouTube or Twitch ping stops the observation. When nobody is watching a channel any more, we stop checking it altogether.

Your use of these pings is also subject to the terms of the platform concerned, including the YouTube Terms of Service and the Google Privacy Policy. Aletto is not affiliated with, endorsed by, or sponsored by YouTube, Google, or Twitch.

08 Reactions and Who Can See Them

You can react to a channel, to a post, or to a ping that reached you. A reaction is an emoji. We record what you reacted to, which emoji you chose, and when.

• One reaction each. Choosing a second emoji replaces the first; choosing the one you already have takes it back.
• Skin tones are counted together. 👍 and 👍🏿 are one reaction with one total. We do not count them separately, because a tally split by skin tone would turn a reaction row into a report about the people who left it, which nobody tapping a thumbs-up agreed to publish.
• No emoji carries a special meaning, and none is reported to a sender by name as an acknowledgement.
• Only emoji and symbols can be stored. Anything that could be a letter or a digit is refused, so a reaction cannot be used to write text under somebody else's message.
• You can react to a channel or its posts if you follow it or own it.
• The owner may be told. When you react to a ping, the person who sent it may get a notification saying that you reacted and with which emoji, if they could already see who the ping went to; otherwise they are told only how many people reacted. The owner of a channel is told only how many people reacted to a post, never who. Each owner can turn these notifications off.

A reaction is not private from the person who sent you the ping. If you would rather not respond at all, simply do not react.

09 Arrive & Leave Requests

You cannot create an arrive & leave ping on somebody else's device. What you can do is ask them to set one up, for example "tell me when you get home".

• You can only ask someone you are connected with. The ping that results is sent by them to you, which your connection already allows.
• You propose the place, the radius and the triggers, and we send that proposal to the person you asked. They see it as a ready-filled arrive & leave ping, which they can create on their phone or decline.
• If they create it, the ping is theirs. It runs on their phone and they own it. They can change its message, add other recipients, move it to another of their phones, pause it or delete it at any time without your permission or knowledge. For as long as the ping exists, they cannot change the place, radius or triggers you asked for, and they cannot remove you. What it can do depends on their plan, not yours. You are simply one of its recipients.
• You cannot choose who else is told. Creating it adds you; if they want other people to receive it too, that is their decision. You are told when they create it, but you are not notified of later changes, a pause or a deletion.
• You may have one open request per person, and after a decline there is a waiting period before you can ask again. You are not told that they declined; your request keeps showing as waiting. We keep the record of the request and the decline in order to enforce this.
• They can decline without giving a reason, and we never block or delay a decline.

The location data involved is theirs, is covered by the Location Data section of §2, and is never shared with you as coordinates: you receive the ping's message, not their position. The ping never sends their position when it goes off.

10 Blocking, Reporting and Moderation

To keep the Service safe, you can block and report other users, and we apply content moderation to messages and pings.

• Blocking: Blocking a user stops them from contacting you, connecting with you, or sending you pings, and hides each of you from the other's search and profile view. We store the blocking relationship to enforce it, and we never tell the blocked person. You can manage blocked users under People → Blocked & Declined. Blocking does not affect channels: a channel you follow keeps reaching you until you unfollow it, and a channel's owner is never told who follows it.
• Reporting: You can report a person, a ping or post, a channel, or a circle. We collect the reason you select, the reported content or identifier, and related metadata, and we may review it manually or with automated tooling. Every report is ultimately a report against an account (for a channel or a circle, its owner), because that is what a moderator can act on. Naming the specific channel, post or circle lets us keep a copy of the thing complained about, since it could otherwise be changed before anyone reviews it.
• Moderation: We may automatically screen or filter message content for prohibited material. We may suspend or remove usernames, content, relationships, or accounts that violate our Terms. We may retain moderation records for safety, dispute handling, and legal compliance.

11 Notifications and Your Devices

Pings and notifications are delivered to your registered devices through Firebase Cloud Messaging and shown by your device's notification system. A browser can also be one of those registered devices (see §12). Everything that reached you is also kept in your Pings tab in the app.

• What appears on a lock screen: The notification's title says who it is from (for example "Ping from Ana Silva @ana") or, for an arrive & leave or YouTube and Twitch ping, what happened (for example "Ana Silva @ana arrived at Office"); a channel post is titled with the channel's name. The body shows the message, and the sender's photo or initial may appear beside it. This is the same on every plan. We may choose, for everyone at once, to show a short prompt to open the app in place of the message text. The title is always shown, so anyone who can see your lock screen can see who pinged you. If that matters, use your device's settings to hide notification content on the lock screen.
• Language: Notification titles and the text we write around a message (not the message itself) are written in your chosen language.
• Per-device and per-address controls: Each source chooses where it reaches you. On a person's page you choose which of your devices, and which one email address, get their pings; on a channel's page you do the same for its posts; a circle's pings arrive wherever its owner's pings to you go. In Devices & Emails you choose the devices, and the one address, that get your own pings. A paid delivery method such as email reaches one address per source.
• System & account notifications: Important system and account notices reach all of your registered devices, even one you have switched off for every source, so you don't miss messages about your account. Examples are subscription or credit changes, monthly free credits arriving, pings paused automatically, an email address moving to another account, a new sign-in, and other security and account messages. These are operational messages tied to your use of the Service, not marketing.
• Operating-system permissions: Delivery still depends on the notification permission you grant the app at the operating-system level, which you can change at any time in your device settings. Arrive & leave pings also depend on the location permission you grant, including background access (see the Location Permission note in §2).
• Stopping ping emails: Every ping email has a stop link at the bottom, and it tells your mail app how to unsubscribe. Opening the link only shows a button; nothing changes until you press it. On a ping from somebody else, it stops email from that person for all of their pings. Their pings still reach you by your other delivery methods, you can turn their emails back on in the app, and the sender is not told. On a ping of your own, it removes email from that one ping; if email was the only way that ping reached anyone, the ping is paused until you give it someone to send to. The stop page names nobody, because emails get forwarded.
• Phones that stop receiving: We stop sending to a phone that appears to have stopped receiving pings: one that has not been used for 30 days while another phone on your account has, or an Android phone that has not confirmed receiving a notification for 60 days although pings were sent to it. An iPhone cannot confirm receipt in the background, so the second rule does not apply to iPhones. Such a phone is listed under Not receiving pings in Devices & Emails, the arrive & leave pings it watches are paused, and opening the app on it brings the phone back.
• Between phones: If you have no working phone when a ping is sent to you, for example while you reinstall the app, but you used one in the last 30 days, the ping is still kept in your Pings tab for when you sign in again. It is not pushed to you later. This never applies to anything you blocked, muted or switched off.

12 Using Aletto in a Browser (www.aletto.app)

You can also sign in to Aletto at www.aletto.app and use it in a browser. It is the same account and the same data as the app, not a separate service and not a marketing page. This section describes only what is different about using it in a browser.

Signing in

On the web you sign in with Google, or with an email and password, in your browser. If you have no Aletto account yet, signing in on the website creates one. Guest accounts are available in the mobile app only. Your password is checked by our sign-in provider and never reaches our servers. Your sign-in token is not kept in the browser's storage; it is exchanged once, on our server, for a session.

Cookies and browser storage

• What it is: A single strictly necessary session cookie named __Host-aletto_session. It holds a random token and no personal data. The token points to a session record on our server, which is what actually identifies you.
• How it is set: Secure (HTTPS only), HttpOnly (scripts cannot read it), SameSite=Lax, and scoped to www.aletto.app alone. It cannot be sent to our link domain, to advertisers, or to anyone else.
• How long it lasts: 14 days, after which you sign in again. Signing out deletes the cookie and the session record on our server, so the token cannot be reused.
• Language choice: If you pick a language at the foot of a page while signed out, a cookie named aletto_lang remembers it for one year. It holds only the language code (for example de), is HttpOnly and SameSite=Lax, and is never set unless you pick one. Once you sign in, your account's language is used instead.
• Browser notifications: If you turn them on, we keep one random installation identifier in your browser's local storage, so the browser keeps the same identity each time it registers. It contains no personal data.
• Shared or public computers: The session survives closing the browser. Sign out when you finish on a device that is not yours.

What the browser session records

• The session record holds your user identifier, when the session was created, when it was last used, and when it expires.
• Your IP address is processed on every request to limit abuse and protect the Service. That is our legitimate interest in security. It is kept in the technical record described in §14, not shown to anyone.
• Suspending or deleting an account takes effect on the very next page load, because the session is checked on our server rather than trusted from the cookie.

Browser notifications

• The browser is its own delivery method, separate from your phone. Enabling notifications in a browser does not affect your phones or tablets, and vice versa.
• They work through your browser's push service and Firebase Cloud Messaging, using a background service worker. Enabling them registers that browser like any other device, with a push token and basic metadata, which you can remove at any time.
• Nothing is enabled without you asking. We request the browser's notification permission only when you turn browser notifications on, and you can revoke it at any time in your browser's site settings.

What the website loads, and what it does not do

• No analytics, and ads only where described. The website carries no analytics and no third-party trackers of its own. The code it loads from anywhere other than our own servers is Google's Firebase library, used for sign-in and notifications, and, on pages that carry an ad, Google AdSense and Google's consent message, as described in §3. In each case Google receives the request for that file (see §4).
• No purchases. You can see your plan, credit balance and history in a browser, but subscriptions and credits are bought in the mobile app through the app stores. Our website handles no payment data.

Uploading, inviting and account actions in a browser

• Files. Photos and voice notes you attach on the website, and the pictures you set for your profile, a channel or a circle, are handled exactly as in the app (see §2). Recording a voice note uses your browser's microphone permission, and only when you press record.
• Invitations by email sent from the website follow the same limits and the same one-click unsubscribe as in the app.
• Export My Data and Delete Account are available on the website. Before either runs, we ask you to sign in again in the browser, so that a session left open on a shared computer cannot be used to take or erase your data.

Public pages. Some links, such as a shared channel, a shared post or an invitation, open a page that does not require signing in and carries no session cookie. Those pages show only content that is already public. A link to a private channel shows only its name, description and picture.

13 Platform-Specific Information (Android / iOS)

Android (Google Play)

Purchases use Google Play Billing, and advertising uses the Google Advertising ID. Our practices are also summarized in the Play Data safety section. You can reset or delete the Advertising ID in Android settings. If you use arrive & leave pings, Aletto requests foreground and background location access (fine/coarse location and background location) solely to detect arrivals and departures at your Saved Places. The operating system delivers boundary crossings to the app. Aletto declares no foreground location service and does not keep a location process running. You can manage or revoke this in Android's location settings.

iOS (Apple App Store)

Purchases use the Apple App Store / StoreKit. Cross-app tracking for personalized ads requires your permission through App Tracking Transparency. Our practices appear in Apple's App Privacy ("nutrition label") on the App Store. Apple is not responsible for the Service or its data practices. If you use arrive & leave pings, Aletto requests "When In Use" and then "Always" location access so those pings can go off in the background. You can adjust or revoke this in iOS location settings.

14 Storage, Transfers and Retention

Your account data is stored securely on private servers. The pictures, photos and voice notes you upload are stored with Backblaze B2 in the EU (Amsterdam). Public files are delivered through Cloudflare (see §4). Some processors, such as Google, RevenueCat and Cloudflare, may store or process data outside India, including in the US and the EU; international transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses. We retain data only as long as necessary for the purposes stated here, or as required by legal, tax and accounting obligations.

How long specific things are kept

• Your content: pings, posts, and the photos and voice notes attached to them are kept until you delete them or delete your account.
• File links in emails and notifications: about 30 days for an email and about 24 hours for a lock-screen preview. After that, the link stops working, even though the file itself remains until you delete it.
• Web sessions: 14 days, or until you sign out.
• Technical records of what the system did: request logs for about a fortnight, activity records for about six months, and security events for about a year, after which they are deleted.
• Backups: our database is backed up once a day, and each backup is deleted automatically after 30 days. Something you delete, including a deleted account, can therefore remain in a backup for up to 30 days before it ages out. Backups are used only to restore the Service after a failure, never to bring back data you deleted. Saved-place coordinates and other encrypted fields stay encrypted inside them.
• Moderation and safety records: for as long as needed for safety, dispute handling and legal compliance.
• Suppression list entries (addresses that unsubscribed from invitations): kept indefinitely, because deleting one would allow the person to be contacted again.
• Invitation Reward records: kept so that a reward is never paid twice. Each holds two internal account numbers, the invitation used, and the dates. Once an account is deleted, its number no longer points to any person.
• Place crossings waiting on your phone: until they are sent, up to the most recent 50. Uninstalling the app deletes them.
• YouTube and Twitch data: video titles and pictures a YouTube or Twitch ping brought in are removed from your ping history and Pings tab after 28 days, leaving the link. A watched channel's picture is deleted 28 days after we last refreshed it, and the result of looking a channel up by name is kept for at most 28 days. YouTube's rules allow at most 30.
• Places saved for a requested arrive & leave ping ("Auto created"): deleted when that ping is deleted.
• Device check-in times: kept with the device until you remove it or delete your account.
• Usage events and crash reports (mobile apps): kept by Google Firebase for the retention period set on our project, at most 14 months for usage events and about 90 days for crash reports.

15 Security

We use commercially acceptable safeguards, including:

• HTTPS encryption for all data sent to and from our servers;
• encryption of sensitive fields such as saved-place coordinates;
• a private store for attached photos and voice notes, reachable only through short-lived signed links issued after we check who is asking;
• daily backups of our database; and
• leaving card and payment handling to the app stores, so payment credentials never reach our servers.

Sensitive actions, such as deleting your account or exporting your data, may require you to sign in again. No method is 100% secure, and we cannot guarantee absolute security.

16 Accessibility

We aim to make Aletto usable by everyone. The app is designed to work with platform accessibility features such as screen readers (TalkBack and VoiceOver), dynamic text sizing, sufficient colour contrast, reduced-motion and reduced-transparency preferences. Accessibility settings you choose are applied on your device and are not used to identify or profile you. If you encounter an accessibility barrier, contact us (see §24) and we will try to help.

17 Help, FAQ and Support

The app includes an in-app Help & FAQ and a Contact Support option, both under Settings → Support, and a Send Feedback option under Settings → Feedback. When you contact us by email, we receive your message, your email address, and any details you include to help us respond, such as your username, app version and platform.

18 Your Rights (General & India DPDP Act)

Subject to applicable law, you may:

• access and export a copy of your data;
• correct, complete, update or erase it;
• withdraw consent at any time, as easily as you gave it (see §20);
• nominate another person to act for you; and
• seek grievance redressal with us (see §24) and, if it is not resolved, with the Data Protection Board of India.

Withdrawing consent may limit or end your use of the Service.

19 Regional Privacy Rights (EU/UK & US)

EEA & UK (GDPR)

Our legal bases are contract (to provide the Service), consent (for example, personalized ads and optional features), legitimate interests (security, reliability, backups, fraud prevention and moderation), and legal obligation. You have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Transfers rely on Standard Contractual Clauses or equivalent safeguards. You may complain to your local supervisory authority.

United States (CCPA/CPRA & similar)

We do not sell personal information for money. We may "share" limited identifiers for cross-context behavioral advertising, in the mobile apps and on the website's ad-supported pages, and only where permitted. California and certain other state residents may opt out of such sharing and of personalized advertising, and we honor recognized opt-out signals (such as Global Privacy Control) where required. You also have rights to know, access, correct and delete your information, and to non-discrimination. Use the in-app controls, the consent prompt, or our Data Request Form (which also serves as a "Do Not Sell or Share" request).

20 Export and Delete Your Data

• Export your data (in the app or on the website): Use Profile → Export My Data to download a copy of your Aletto data as a file you can save or share. You may need to sign in again first; on the website you always do.
• Delete your account (in the app or on the website): Use Profile → Delete Account. You will be asked to sign in again first.
• Update or delete in the app: You can update or delete your information at any time in your profile and in Settings.
• Web request: If you have uninstalled the app, use our Official Data Request Form.

21 Children's Privacy

The Service is for general audiences and is not directed to children under 13. We do not knowingly collect data from children under 13. Where local law sets a higher age, users below that age need verifiable parental or guardian consent, and we do not track, behaviourally monitor, or target ads to them. For example, India's DPDP Act treats anyone under 18 as a child, and the EU GDPR sets an age between 13 and 16 depending on the country. Purchases require legal capacity to contract (generally 18 or over). We delete any child's data that was collected without the required consent.

22 Changes to this Privacy Policy

We may update this policy. We will post the new version here, update the "Last updated" date, and give in-app notice of material changes where required. Continued use after changes take effect constitutes acceptance.

23 Governing Law

This policy and your use of the Service are governed by the laws of India, including the DPDP Act, 2023 and the IT Act, 2000, without prejudice to mandatory rights under the GDPR or applicable US state laws.

24 Contact Us & Grievance Officer

• Grievance Contact: Grievance Officer, Tandavaworks Global LLP
• Email: [email protected]
• Mailing Address: Chennai, Tamil Nadu, India.

We aim to acknowledge and respond to verifiable requests within the timelines required by applicable law.