Privacy Policy

Account information. Email address, display name, password hash (we never store the password itself), two-factor authentication secret (encrypted) and recovery-code hashes, or the identity token returned by Google Sign-In if you use it. For each browser or phone you're signed in on: its browser or app type, what it reports about itself when asked (a phone's model and the system's version, in browsers that share them), when you signed in and last used the app there, the city its internet connection pointed to when you signed in and when you last used it (worked out on our own servers with MaxMind's GeoLite2 database; the address itself is not kept), and whether you chose to remember that device, so we can keep you signed in, sign you out when you're away and show you your signed-in devices in Settings so you can spot one that isn't yours. Billing details are handled by Stripe; we store only a customer identifier, plan and subscription status. For a team account we also store the organization's name, its billing email, seats and price, who its members are and their roles, and each member's part of the team's usage. When someone accepts a team account's offer online, we keep their name, title, work email, the time and their IP address with it as the record of the order. The team's owners and admins see how much of their part each member has used, as a percentage, never what it was used on; members of a team never see each other's messages or connections. A team's owners and admins may also set which integrations its members may connect and how far GENTs may go in them; we store those settings with the team. When an admin shares one of their own connections made with a key (a tool's API key or an MCP server) with the team, we keep a copy of that key, encrypted, for the team and in the account of each member it's for, and record each time a member's GENT task used it (who and when, never what for), which the team's owners and admins see as counts for the last 30 days. Members never see the shared key.

Waitlist and invites. If you ask for access we store your email and your beta application (name, company, what you'd use it for, your role, company size, how many messages you answer a day, which apps they're in, what kind of Google account you use, whether you'd do a setup call, how we can reach you for feedback, which testers' group you'd join with the messaging app number or username it needs, your phone number and your LinkedIn profile) to decide on access, to email you about it and to ask for your feedback during the beta. The application on our beta page comes in steps, and each step is kept once you press Continue: your name and email after the first, your company and what you'd hand off after the second, even if you don't finish. With each request or application we also keep where it was sent from: your IP address and the city and country it points to (looked up on our own servers), your device, system and browser, and your browser's time zone, language, screen size and the website that sent you there, to tell real requests from fake ones and to know who we're talking to. If you apply from inside the app, the same is kept. If a member invites you, we store your email, who invited you and whether you joined, and send you one email with the invite. Ask us and we'll remove a waitlist entry or invite.

Connected-account credentials. OAuth access and refresh tokens for each channel or agent you connect (for example Slack, Gmail, Outlook, Asana, GitHub, Zendesk), the app password of a mailbox you connect over IMAP, and the API key or token of a help desk you connect with one (Freshdesk, Front). Tokens are encrypted at rest with a key that is not stored alongside the database, and are bound to your customer identifier so they cannot be used for another customer.

Conversation data — only for conversations you switch on. By default every channel and every conversation is off. For an off conversation we keep only what the chat list needs to show it to you (its name, picture, time of the last message and a one-line preview of it); nothing in it is analysed, embedded or sent to an AI model. When you switch a specific conversation on, we import the recent message history of that conversation (both sides), store it, compute style profiles and numeric embeddings from it, and continue to receive new messages in that conversation until you switch it off. When a message replies to an earlier one, we keep the copy of the earlier message that the app sends with the reply (its words, who wrote it and a tiny preview of its photo), with the reply, so we can show what it answers, even when the earlier message is older than what we imported. Where the app records calls in the chat (for example Microsoft Teams calls and Slack huddles), we also keep each voice or video call in a conversation you switched on as a line in it: when it was, who called, voice or video, whether it was answered, missed or declined (or is still going on), and how long it lasted. We never receive or keep what was said on a call. On a review site, a conversation is a business location or app and its public reviews. On a help desk, a conversation is a queue of tickets, so this covers your customers' messages there and your team's internal notes, each kept marked as a note. We also store the drafts we generate, your edits to them, words you have typed in a reply box and not sent yet (so the same words are there on your other devices), what you sent, and your feedback ("sounds like me" / "not this one"), because those are how the Service learns your voice. When you park an email thread or task (put it out of the TODO list until a time you pick), we keep which thread it is, that time, and when you parked it, so it comes back to your TODO list then on every device, with a reminder. In those conversations we also keep which threads you've opened or marked done, and when, so a new one stays in your TODO list on every device until you've seen it. When nothing in your Activity needs you, it shows Your day: a short summary of the day across the conversations you switched on, written by the AI model from that day's messages in them (or from each one's own summary). We keep the latest one, so it isn't written again each time you look; it is replaced the next day.

People in your groups. When someone writing in a group you switched on also has a one-to-one chat with you on the same channel that you switched on, ALTRmode keeps with that one-to-one chat a short note on who they are to you and how you treat them (for example "your sister; warm, teasing is fine"). It is written by the AI model only from what ALTRmode learned in that chat about who the person is to you and how you write to them, never from its messages or facts about their life, and is checked so it holds no names, places, numbers or their own words. It is used only to draft your own replies in groups that person is in, only while that one-to-one chat is on, and is never shown to or sent to anyone in the group. It is replaced when what was learned changes, and deleted with the rest of what we kept for that one-to-one chat: 72 hours after you switch it off, when you disconnect the channel, or when your account is deleted.

Group message read details. Some connected messaging services provide individual read receipts for group messages. Where available, we use reader identifiers to show who read a message you sent. For services that send individual receipts, we keep reader identifiers with message and group identifiers in an encrypted connection cache, capped at 300 message entries per connection. When a service supplies the list only on demand, we fetch it when you open reader details using the message's read switch and do not retain it. This small receipt cache is separate from switched-on message-history processing and may include group messages you sent in chats that are off. The cache is not sent to an AI model. An entry is removed when its message is deleted; entries beyond the latest 300 are evicted, and the cache is deleted when you disconnect that channel. Some services do not provide reader details for every group or message.

Life (formerly the Journal). What you choose to tell ALTRmode about your own life on the Life page (and answers you type when a draft asks you something), plus the short replies it gives you there. Unless you turn off "Notice things in my messages" on that page, it also holds short notes ALTRmode picks out of what you yourself wrote in the chats you switched on (never from what others wrote), and who the person in a one-to-one chat is to you (for example your partner or your child) as learned from that chat, each marked with the chat it came from. It is private to your user account, is used only to draft your own replies (notes from the last 30 days, plus any note marked "Keep always" for as long as it is kept, and only when a conversation asks about it) and, when you ask CTRL about someone by how they're related to you (“text my wife”), to find who you mean, and you can edit or delete any entry at any time. When an answer you gave a draft, or a note picked out of your own messages, is something that stays true (for example how your work or product works), ALTRmode marks it "Keep always" itself; you can press "Stop keeping" or delete it. Notes you don't mark "Keep always" are deleted 30 days after they were added (section 8).

To-dos. Your to-do list in ALTRmode: what you add yourself, and what your To-dos GENT adds when someone in a conversation you switched on asks you to do something (for example "bring the charger tomorrow"). Each to-do holds a short title, notes, its day or time, its reminder time, whether it's done, and the conversation and message it came from. Its words are written from that conversation, so they can name the person who asked. It is private to your user account and used only to show you your list and remind you; you can change or delete any to-do at any time. If you connect a to-do app (Google Tasks, Microsoft To Do or Todoist), new to-dos go to that app instead, under its own terms (section 6).

Learning from your work. To make drafts and GENT work better for you, ALTRmode learns from what you do. When you type a comment with an action (Try another on a draft, Draft it, or Follow up, Try again or Ask for changes on a GENT's work, or a note on why you said Not now to one), our AI provider reads it with what it was about and anything that should hold next time is kept as a voice rule (TUNE → Voice), a play (Playbook) or a Life note. Once a day it also reviews the drafts you sent, rewrote, turned down or asked again for and the GENT work that ended since the last review. What it reads for this is not stored anywhere: it is read for that one request and dropped, and only what it learned is kept, where you can see, change or delete it. Voice rules are private to your user account. Turn it off on TUNE → Voice ("Learn from how my drafts and GENTs went"). What it learns stays in your account: it is never used for another account or another customer, never combined across accounts, and never used to train AI models.

Help and CTRL chats. What you ask on the Help and CTRL pages and the answers you get (in CTRL, also the changes it proposed and what came of them), kept so you can reopen a chat from any device you sign in on. They are private to your user account (others in your workspace don't see them), you can delete any chat or all of them on the page, and each is deleted automatically 30 days after you last used it.

Playbook. What you and the people in your workspace teach its GENTs about how you handle situations (for example how you deal with a refund request), and what they learn from the decisions you make when a GENT asks before a step, from what you type when you follow up on a GENT's work or ask it to try again, and from the daily review described below, written in general terms. It is shared within that workspace, is used only to guide the GENTs' work for it, and stays until you delete a play there or delete the workspace.

Location, time zone and calendar (About you). Your device's time zone, or the time zone you pick in Settings. Location is on by default (turn it off in Settings). Once you allow your device's location, the exact position your device reports every few minutes while the app is open, and, in our phone app, also while it's closed (“Also when the app is closed”, on by default: the app explains this and asks for your phone's location permission when you first open it, and it runs only if you choose “Allow all the time”; a notification shows while it does, and it stops when you turn it off in Settings → About you or take the permission back) (we keep only the latest one, plus the street, neighbourhood and city it is in and the kind of place the map shows there, such as a restaurant or a beach, looked up with OpenStreetMap's Nominatim service), the city the internet connection you use the app from points to (worked out on our own servers with MaxMind's GeoLite2 database; the address itself is not kept, and this product includes GeoLite2 data created by MaxMind, available from maxmind.com), and the places you name there (for example “Home”). If you haven't named a Home, we work it out from where your phone usually is at night, kept as one spot with a count of nights (never a history of where you were) and deleted with the rest when you turn location off. If you link a calendar, we read its entries for today and the next 90 days when a reply is being written, and when you open the Calendar view to see them yourself (there also the past 90 days, if you ask); they are not stored. When location is on, CTRL is also told the street, neighbourhood or named place you're at (never the coordinates themselves), so it can answer things like the weather where you are, and a web lookup it starts for you may name that place. Replies may mention where you are or your plans only when someone asks, said the way you would (“at a restaurant in South Beach”), at most the place or street (never a house number), and not at all if you turn off “Use my location in replies”; entries marked private are only ever described as “busy”. Turning location off deletes the stored position and the connection's city; removing a calendar stops all access to it.

Task and agent data. If you connect a tool for AI agents (for example GitHub, Jira or Notion) and a conversation is set to allow it, we store the task description, approval decisions (with any note you add on why you said Not now, which our AI provider reads when you save it, as described under Learning from your work), run status and the result that was relayed back into the conversation, with the task's progress: what its GENTs did and said to each other and to you, what you tell them while they work, and short notes they keep for the next task in the same conversation, which later GENT work there reads for 14 days. When Claude Code works on a GitHub repository you selected, or reviews a pull request there before you merge it (including one GitHub Copilot opened), a copy of that repository is made in a temporary, isolated workspace run by Anthropic for that task, and the code, the request and the result are processed by Anthropic on our behalf under the same no-training terms. Your GitHub token is not placed in that workspace. If that repository explains how to preview it, Claude Code may take screenshots of the screen it changed. We keep those screenshots, and its review of the pull request, with the task so you can see them before you decide whether to merge, and they are deleted with the task. Files a GENT works with (ones you attach on the CTRL page or on a GENT's work, or one you have CTRL hand it from a conversation you switched on, such as a screenshot someone sent there, or one sent earlier in the conversation the work is for, which the GENT takes when your request refers to it) and files a GENT makes for you are kept with the task, encrypted, for 7 days and then deleted; photos and PDFs among them are shown to the AI model doing that task, and a GENT may read text files among them (a web page, a script) when the task needs it. A file goes to a tool you connected only as part of a change that tool makes for you, such as publishing a web page you asked it to put live.

Usage, device and log data. Actions in the app, timestamps, IP address, browser type, error logs, and per-request usage metrics (tokens, model, cost) that we use for billing and abuse prevention. We also keep a security audit log of important actions on your account (for example signing in, connecting or disconnecting an account, changing a setting that controls sending, downloading your data, and which version of these terms you accepted when you signed up), with the IP address and browser where it matters. Cookies and similar technologies are described in section 9A; the app uses no advertising, analytics or cross-site tracking cookies.

Website visitors. If you browse our public website and press Accept in its cookie banner, our analytics and advertising partners collect details of that visit through their cookies (section 9A).

Notifications. If you allow notifications, the address your browser or the mobile app gives us for delivering them, and the notifications we send you (for example who wrote and a short preview, or a reply written for you to check and send, or a to-do's reminder with its words, or that a thread you parked is back, with its subject; in the Android app, a chat's notification shows its unread messages with who wrote them, the chat's picture, and the reply your ALTR drafted or is about to send). When you press a button on a notification (Send, Reply, Allow…), your device sends us that choice, with that address so we know it's yours, and what you typed in it. Notifications stop on a device when you sign out there, including when you're signed out after being away or from another device.

Test versions of the phone app. While the phone app is in testing, you install it through Apple's TestFlight or Google Play's testing program, under Apple's or Google's own terms. For Android you first join our testers' group on Google Groups, which shows us the Google account you join with; you can leave the group at any time. Apple and Google also pass us the crash reports, feedback and screenshots you choose to send from a test version, and counts of installs and use.

Feedback and support requests. What you write when you send feedback or contact us from the app, any screenshot you add, and where in the app you were when you sent it. If you write to us through the Contact page on our website, whether or not you have an account, your name, email address, the topic you chose and your message; the form doesn't use cookies, and the IP address it's sent from is used only for a short time to stop spam and not stored with it.

Where it comes from. From you (including the address or name of someone you write to with New message); from the accounts you connect (your messages and the messages of the people you talk with in the conversations you switch on, contact names and pictures, calendar entries); from your device (time zone, and location if you turn it on); from the people who invite you; and from service providers (Stripe for payment status, Google or Microsoft when you sign in with them, Gravatar for public profile pictures, and Kickbox, which tells us whether an email address you sign up with can receive mail).

Sensitive information. We do not ask for health, religious, political, sexual, biometric, genetic or similar sensitive information. Your conversations, your Life notes and the messages of the people you talk with may nonetheless contain it; if they do, we process it only to provide the Service as you direct, never to profile you or anyone else, and you can delete it at any time (section 8). Voice messages are turned into text so they can be read and answered; we do not keep the audio and we never create voiceprints or other biometric identifiers.

Accessibility requests. We never ask whether you have a disability. If you tell us about one, for example when you report an accessibility barrier or ask for an accommodation or another format (Terms, section 17A), we use what you share only to answer that request and fix the barrier, on the basis of your explicit consent, which you give by sending it and can withdraw at any time. It is kept with that support request (section 8), never used for marketing, profiling or anything else, never sold or shared, and we delete it sooner if you ask. Display choices such as text size, light or dark theme, or your device's reduce-motion setting are just preferences: we don't treat them as health information and never use them to infer anything about you.

Voice notes you record. In a chat whose app takes voice notes, you can record one with the microphone button in the reply box. The microphone is used only from your tap until you stop or delete the recording; nothing is recorded before you tap it, and nothing is sent until you press Send. A voice note you send is held encrypted on our servers only until it has gone out to the chat app (and deleted a day later if it was never sent). Like the voice messages others send you, your own voice notes, the ones you record here and the ones you record in the chat app itself, are turned into text by OpenAI so the Service understands what you said in the conversation; that text is kept with the message, the audio is not.

Talking to CTRL. When you tap the microphone in CTRL (or use Talk to CTRL from the phone app's icon or a widget), the microphone listens only while CTRL shows “Listening” or waits a few seconds for a “stop”: it stops when you stop talking, after a few seconds of silence, when you press End, or when you leave the page or put the app away. What you said is sent to OpenAI to be turned into text; the audio isn't kept by us, and the text is kept in that CTRL chat like a request you type. CTRL's answers are read out by your phone's or browser's own voice on your device; we don't send them anywhere to be spoken. When you ask CTRL through Siri on an iPhone, Siri (Apple) hears you and turns what you said into text under Apple's own privacy terms, and we receive that text, not your voice; Siri reads CTRL's answer out. For this, the app keeps a key on your iPhone (section 9A). On Android you can also switch on “ALTRmode on”: the phone then listens for those words itself, on the device, and opens CTRL's panel when it hears them. Until then nothing is recorded, kept or sent anywhere (and it only listens while there's sound). It listens only in your car: with your permission (Nearby devices), it notices when your phone connects to a car's Bluetooth or to Android Auto; that is checked on the phone and never sent to us; a notification shows the whole time it listens, and you can stop it there or in Settings. On Android you can make ALTRmode your phone's assistant: the assistant gesture then only opens CTRL's panel; ALTRmode doesn't ask for or read what's on your screen, and on a locked phone it does nothing until you unlock it.

If you connect Gmail, ALTRmode requests the following Google scopes, and uses them only as described:

• https://www.googleapis.com/auth/gmail.modify — to list your email threads so you can choose which to switch on, and to read the messages in the threads you have switched on. This is used to learn how you write to that correspondent and to understand the incoming message you are replying to. We do not read threads you have not switched on. We use it to change your mailbox only to keep Gmail in step with what you do in ALTRmode, and only for switched-on threads: marking mail as read when you open that conversation in ALTRmode; archiving its inbox mail (removing the Inbox label, as Gmail's Archive button does) when you mark it done or reply to it from ALTRmode; and, when you press Report spam on a message we flagged as phishing, a scam or spam (or turn on reporting it automatically), applying Gmail's own Report spam to that message. When we email you a notification at that Gmail address, we also archive that notification email (found by its own message ID; nothing else is searched or read) once you have dealt with everything in it, as the notification on your phone goes away. Each can be turned off in Settings → Preferences → In your apps; reporting automatically is off unless you turn it on. We never delete mail, and never change labels or folders for any other reason. The same scope is used to send a reply from your Gmail account, either after you approve or edit a draft, or automatically in a thread you have set to automatic sending, and to send a new email you write yourself in ALTRmode (New message, or writing to a correspondent whose conversation is off, which switches it on first). We never send anything from a thread that is off, never start a conversation on our own, and never send marketing or messages of our own. The same scope also lets us read the list of “Send mail as” addresses configured on your account, so that mail you sent from an alias is recognised as yours, a reply goes out from the same address the conversation was already using, and you can choose another of them for a reply, and the email signature set for each of those addresses, so a reply sent for you ends with your own signature as it would from Gmail. We only read these settings; we never change any Gmail setting. A signature you design in ALTRmode instead is stored with your account; pictures you upload into it are kept at a long random link so the people you email can see them, and are deleted when you remove them from the signature or disconnect the mailbox.
• openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile — to sign you in and to show your name and profile picture in the app. Your name is also used so replies are written as you.

If you connect Google Calendar (Settings → About you), ALTRmode requests https://www.googleapis.com/auth/calendar.calendarlist.readonly — to see which calendars you have — and https://www.googleapis.com/auth/calendar.events.readonly — to read those calendars' entries for today and the next 90 days, so replies can answer questions about your plans and availability, and so you can see them yourself in the app's Calendar view (which can also show the past 90 days). Calendar entries are read when needed rather than stored. Only if you also choose “Let GENTs add events”, ALTRmode requests https://www.googleapis.com/auth/calendar.events — to add, move or cancel an event when a conversation settles on a meeting or you ask for a reminder. Each change is shown to you for approval first unless you set that conversation to act automatically, invites go only to addresses given in the conversation, and it never changes your calendar settings or sharing.

If you connect Google Chat, ALTRmode requests https://www.googleapis.com/auth/chat.spaces.readonly and https://www.googleapis.com/auth/chat.memberships.readonly — to list your direct messages, group chats and spaces and who is in them, so you can choose which to switch on; https://www.googleapis.com/auth/chat.messages — to read messages in the conversations you have switched on, to send your approved or automatic replies there, to change or delete a message of your own when you choose Edit or Delete for everyone on it, and to add or remove the emoji reaction you choose on a message; https://www.googleapis.com/auth/chat.users.readstate — to mark a conversation read when you open it in ALTRmode, and to notice when you have read it in Google Chat; and https://www.googleapis.com/auth/directory.readonly — to show your coworkers' names and pictures, which Google Chat does not provide to apps, and to search your directory by the name you type when you start a New message (shown to you, not kept). We never create, change or delete spaces or memberships (a New message goes only into a direct message you already have with that person), and never change your directory.

If you connect Google Drive as a tool for GENTs, ALTRmode requests https://www.googleapis.com/auth/drive.readonly — to find and read the files a request in a switched-on conversation is about (a price list, a contract term, a figure in a sheet) and answer from them. Only if you press Allow changes on it does ALTRmode also request https://www.googleapis.com/auth/drive.file — which reaches only files ALTRmode created and files you pick yourself in Google's own file picker — to create a file or folder, upload a file from the conversation, update a Doc or text file, add rows to a Sheet, put a new version on a file or comment on one, when a request asks for it. Each change is shown to you for approval first unless you set that conversation's GENTs to act automatically; a change to a file or folder that was already in your Drive also waits until you pick it in Google's picker (it opens from the change's card, loaded from Google only then), and picking it is your approval of that change. We keep the ids of the files ALTRmode made or you picked, encrypted with that connection, so it knows which it may change. We never delete, trash, move or share your files. If you connect Google Meet, ALTRmode requests https://www.googleapis.com/auth/meetings.space.created — to make a meeting link when a conversation settles on a call — and https://www.googleapis.com/auth/meetings.space.readonly — to read your own recent meetings and their transcripts when you ask for a summary or a follow-up. What a GENT reads in Drive or Meet is used for that task and not kept, except the task's result (section 1).

If you connect Google Tasks as your to-do app, ALTRmode requests https://www.googleapis.com/auth/tasks — to list your task lists and open tasks, to add a task when someone in a switched-on conversation asks you to do something (with its due day), and to change or tick off a task when asked; each change is shown to you for approval first unless you set that conversation's GENTs to act automatically. We never delete your tasks or task lists. If you connect Google reviews, ALTRmode requests https://www.googleapis.com/auth/business.manage — to list the Business Profile locations you manage, read their reviews, and post, edit or remove your business's public reply to a review, after you approve it or automatically if you set that location to Automatic. We never change your business's profile information. Reviews are public; your replies are posted publicly under your business's name.

If you tap Google Photos in a reply box's attach sheet, ALTRmode requests https://www.googleapis.com/auth/photospicker.mediaitems.readonly — to open Google's own photo picker and receive only the photos and videos you pick there (up to 10 at a time), which are then attached to your reply like any file you attach. We can't see or search the rest of your library. This access is for that one pick: it isn't a connection, no long-lived token is requested, and the short-lived one (about an hour) is kept encrypted only until the picked files have been added, then deleted. Photos come with the details Google includes (such as the camera and the time taken) but without their location.

Gmail and Google Chat message content is stored in our database only for switched-on threads and is deleted 72 hours after you switch the thread off, as soon as you disconnect Gmail, or when your account is deleted. Gmail content is sent to our AI model providers (Anthropic, and OpenAI for some steps) solely to generate drafts and classifications for you, under contractual terms that prohibit the provider from training on it. Gmail data is never sold, never shared with advertisers or data brokers, never used for advertising or profiling unrelated to your requested replies, and never used to train general-purpose or third-party AI models. Humans at MeMaMu LLC do not read your Gmail content except (a) with your explicit consent for support, (b) as required for security investigations or to comply with law, or (c) in aggregated, de-identified form for internal operations. Our internal support and quality tools show counts, statuses and scores for your conversations, never their text or the names and addresses of the people in them.

ALTRmode's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke ALTRmode's access to your Google account at any time from the app (Disconnect) or from myaccount.google.com/permissions. Revocation stops all further access immediately and triggers deletion of cached Gmail data within 7 days. Disconnecting one Google service in the app deletes our access to it at once; because Google keeps one permission for all of ALTRmode's Google services, ALTRmode leaves your Google account's list of connected apps when you disconnect the last of them.

Each of these asks only for what the Service needs, and, as everywhere, reads only the conversations you switch on:

• Outlook / Microsoft 365 mail (Microsoft Graph: Mail.ReadWrite, Mail.Send, User.Read, offline_access) — to list the people you have written to, read mail with the correspondents you switch on, mark it read when you open it here, send your replies and the new emails you write yourself here from your mailbox, move it to your Archive folder when you mark it done or reply to it here, move a notification email we sent you there to Archive once you have dealt with what it was about, and move a message to Junk Email when you report it as spam (each can be turned off in Settings → Preferences → In your apps). We never delete mail.
• Microsoft Teams (Chat.ReadWrite, ChatMessage.Send, User.ReadBasic.All, Presence.Read.All, Presence.ReadWrite, Files.ReadWrite.All, and, only where your organisation's administrator allows it, team channel permissions) — to list your chats, read the ones you switch on, send replies and reactions, mark chats read, show whether the person is online, show you as available while you have ALTRmode open (unless you turn that off in Settings), and share a file you attach from your OneDrive with the chat's members. When you start a New message, we search your organisation's people by the name you type (shown to you, not kept) and open a one-to-one chat with the person you pick. So new messages arrive straight away, Microsoft notifies our servers when a message arrives in one of your chats; the notice says only which chat and message, never what it says, and we act on it only for chats you switched on (we then read the new message as above) and keep nothing from the rest.
• Slack — to list your conversations, read the ones you switch on, send your replies, reactions and files, and mark them read. When you start a New message, we list your workspace's people to find the one you type (shown to you, kept in memory for a few minutes, never stored) and open a direct message with the person you pick. If you turn on the Moderator in a channel and you are a workspace owner or admin, it also reads the channel's purpose and topic as its rules, removes other people's messages that break them and can remove someone from the channel (section 4B).
• Discord — you add the ALTRmode bot to a server you manage. It reads that server's text channels you switch on and posts your replies through a channel webhook under your Discord name and picture. We receive your Discord user id, name and picture and the server's name; we cannot read your direct messages. If you turn on the Moderator in a channel and give the bot's role moderation rights in Discord, it also reads the server's rules channel, description and the channel's topic as its rules, and removes messages that break them and can time out, remove or ban their senders, with the reason in Discord's audit log (section 4B).
• Asana, Trello, monday.com, GitHub Issues, Jira and Linear — to list your projects, boards, repositories or teams, read the tasks, cards, items or issues (on GitHub, pull requests too) and their comments in the ones you switch on, and post your replies as comments (files you attach are added to the task; GitHub doesn't take files on comments). When a reply is set to (or, on Automatic, suggested to) mark the task done or hand it back, we do that one change after the comment: completing the task, setting its status column, moving the card to a Done list, closing the issue or moving it to a done status, or assigning it to the person who gave it to you or to someone you pick (to list who you can pick, we read the names of the project's, board's or repository's members when you open a task; we don't keep that list). To suggest which, we read who completed or reassigned your recent tasks after your comments. Trello, GitHub and Linear are also used to clear your notifications about a board, repository or team when you open it here, and Asana to mark the items about a task read in your Asana Inbox when you open, answer or finish that task here (we read your Inbox items to find them and don't keep them). Here we create a task, card, item or issue only when you make one yourself with New task, as you, in the project you made it from (with the title, description and person you gave it); a GENT you allow may create them as described under Tools for GENTs below. We never delete tasks or issues.
• Zendesk, Freshdesk, Intercom, Help Scout and Front — to list the groups, team inboxes, mailboxes or inboxes you can work in, read the tickets in the ones you switch on (what your customers wrote, your team's replies and internal notes, and their files), and post your reply on a ticket as you: to the customer, or as an internal note only your team sees. When a reply is set to (or, on Automatic, suggested to) mark the ticket done or hand it back, we solve or close it, or take you off it so it returns to its queue. With New ticket (Zendesk, Freshdesk and Help Scout) we open a ticket, as you, to the customer address you type, in the queue you made it from, with your subject and message; nothing opens one on its own. The same sign-in is also a tool for that help desk's GENT (see Tools for GENTs below). Freshdesk and Front are connected with a key or token you give us, stored encrypted like any other credential. Your customers' messages are processed on your behalf (see the DPA).
• Facebook Messenger and Instagram — through a Facebook Page you manage (and the Instagram professional account linked to it): to list the people who messaged it, read the chats you switch on (their name, picture or @username, messages and files), mark them seen when you open them here, and send your replies as the Page or the account. Meta allows these replies only within 24 hours of the person's last message. We keep the Page's access token, encrypted; disconnecting deletes it, and you can remove ALTRmode in Facebook Settings → Business Integrations.
• Google reviews (Business Profile), Trustpilot, the App Store and Google Play — to list your business locations, Trustpilot business or apps, read the reviews in the ones you switch on (the reviewer's public name, rating and words, and your earlier replies), and post your reply as your business. Replies are public: they show under the review for anyone. App Store Connect and Google Play are connected with a key you give us (an App Store Connect API key, a Google service account key), stored encrypted like any other credential.
• Other mailboxes (IMAP/SMTP) — you give us your address and an app password, which we store encrypted like any other credential and use only to read mail with the correspondents you switch on, mark it read, send your replies and file them in your Sent folder, move it to your Archive folder when you mark it done or reply to it here, move a notification email we sent you there to Archive once you have dealt with what it was about, and move a message to your Junk folder when you report it as spam (each can be turned off in Settings → Preferences → In your apps). We never delete mail. You can revoke the app password at your mail provider at any time.
• Tools for GENTs (for example GitHub, Jira and Confluence, Notion, HubSpot, Salesforce, Shopify, Stripe, QuickBooks, Xero, Calendly, Cal.com, DocuSign, Zoom, Google Meet, Webex, Google Drive, OneDrive and SharePoint, Box, Clari, Google Tasks, Microsoft To Do, Microsoft Planner, Todoist, AWS, Northflank, Cloudflare, Vercel, DigitalOcean, Fastly, Hetzner Cloud, Presto, other calendars, MCP servers you add yourself, and other AI agents you connect, such as Manus, Grok (xAI), or an agent of your own, including one built in Microsoft Copilot Studio, Salesforce Agentforce, Relevance AI or Lindy) — each asks for the access its GENT needs to do the work you or your conversations give it, and is used only for that work. What a GENT reads there is used for the task and not kept, except the task's description, result and files described in section 1. An MCP server you add, including the ready-made ones under Integrations (such as Snowflake or Linear), is run by whoever operates it, under their own terms, and receives what a GENT sends it for your task. The same goes for an AI agent you connect: it works on your own account with its provider, under that provider's terms, and receives the request a GENT hands it (the text of the task and the files it came with, not your other tools or messages). A work app or help desk you connect as a channel (Asana, Trello, monday.com, GitHub, Jira, Linear, Zendesk, Freshdesk, Intercom, Help Scout, Front) is also a tool for its GENT, on the same sign-in and in the conversations you allow it: it looks up tasks, issues, tickets and a customer's earlier tickets there, and, asking you first unless the conversation is on Automatic, creates or updates them, comments or adds internal notes, and changes their status, tags or who has them. It never sends a reply to your customers; that is written and sent in the conversation itself.

Disconnecting any of these revokes our access where the provider allows it (Microsoft, monday.com, Atlassian (Jira), Intercom and Help Scout access, and Freshdesk and Front keys, are removed by deleting the stored tokens; you can also remove the app in your account settings there) and deletes the conversations, drafts and learned style for that account. Removing a tool for GENTs likewise ends our grant at GitHub, Google, HubSpot, Box, Salesforce and Zoom, and uninstalls our app from your Shopify store; Atlassian, Microsoft, Notion and Webex access ends when the stored tokens are deleted. If you remove ALTRmode on the provider's side instead (uninstall it from your Shopify store, remove it from Zoom) or your Atlassian account is closed, we delete that tool's connection when the provider tells us. As Atlassian's developer terms require, once a week we send Atlassian the Atlassian account IDs we hold (only those IDs and when we stored them) so it can tell us which accounts were closed. A Shopify store's customer data and deletion requests are answered too; GENTs look orders and customers up per task and keep no customer records of their own.

• to provide the Service: import switched-on conversations, learn your per-relationship style, generate drafts, send approved or automatic replies, show group-message reader details when the connected service provides them, run agent tasks you authorise, and keep your to-do list and remind you of it;
• to improve drafts and GENT work for you personally, using your edits and feedback, the comments you type with an action and a daily review of how your drafts and GENT work went (this is per-customer learning, not shared training; see "Learning from your work" in section 1);
• to secure the Service: authentication, two-factor, fraud and abuse detection, rate limiting, audit logging;
• to protect you from phishing, scams, malware and spam: each incoming message in a switched-on conversation is checked (by automatic rules and, as part of the same model request that reads it for drafting, by our AI provider) before anything is drafted, and a flagged message is shown to you with a warning instead of being answered. When you press Report, or turn on automatic reporting, we ask your mail provider to move that message to its spam or junk folder, which also informs that provider's spam filter;
• to keep what your connected tools hold from reaching the wrong person: before an agent (GENT) looks something up for a message, and again before a reply written from what it found can go out, our AI provider reads the request or the reply together with who will read it (the channel, their address, who else is in the conversation) and judges whether it is theirs to see. If it may not be, or the check can't run, nothing starts or is sent until you decide;
• to keep a community channel you run to its rules, only where you turn on the Moderator: each new message from someone else there is checked by our AI provider against the rules you write, the ones the channel publishes and what you decided before in that channel, and one that breaks them is removed, and its sender timed out, removed or banned, as you allow (section 4B);
• to bill you and to measure per-customer usage and cost;
• to support you and to communicate about the Service (transactional emails; no marketing to your connected contacts, ever);
• to prevent bulk messaging and spam from your accounts (the sending limits described in section 3 and in the Terms);
• to keep a record of what you agreed to, and to establish, exercise or defend legal claims;
• to comply with law and enforce our Terms.

We do not use your account, your messages or your connected services for advertising, we never sell or share your information, and we do not build profiles of you or of the people you talk with for any purpose other than writing your own replies.

Where the GDPR, the UK GDPR, the Swiss FADP or a similar law applies, we rely on these legal bases:

• Performing our contract with you: your account, the channels and tools you connect, importing and learning from the conversations you switch on, drafting and sending replies, showing group-message reader details where the connected service provides them, running GENT tasks, billing, and support.
• Your consent: your device's location (asked by your browser or phone; location is on by default, but your device's position is used only once you allow it there), calendar access, notifications, the microphone (asked by your browser or phone, used only while you record a voice note or talk to CTRL, or, if you switch on “ALTRmode on”, to listen on your phone for those words), letting ALTRmode notice things in your messages for the Life page, the optional analytics and advertising tags on our public website (section 9A), anything you tell us about a disability in an accessibility request (your explicit consent, section 1), and anything else the app asks you to turn on. You can withdraw consent at any time by turning the feature off; that doesn't affect what was done before.
• Our legitimate interests, balanced against your rights: keeping the Service and its users secure, screening messages for phishing, scams and spam, checking that what your connected tools hold isn't shared with someone who shouldn't see it, preventing bulk messaging and abuse, keeping records of what was agreed, improving the Service from usage counts and costs (not from your content), the city your internet connection points to while location is on (so “where are you?” and “the weather here” work before you allow your device's location; turn location off in Settings to stop it), and emailing people about their access request or invite, answering messages sent through our website's Contact page. You can object to these at any time (section 10).
• Legal obligations: tax and billing records, answering lawful requests from authorities, and telling you and regulators about a data breach.

An email address is needed to create an account; everything else is optional, but some features can't work without it (for example, replies in a conversation you haven't switched on). For the messages of the people you talk with, you are the controller and we act on your instructions (section 7).

ALTRmode uses AI to decide what a draft says, whether a message looks like a scam or needs you, and which GENT should take a task. None of these make decisions about you that have legal or similarly significant effects in the sense of article 22 of the GDPR: you choose whether any conversation may send on its own, can review every reply first, and can switch any of it off at any time. We don't use automated decisions or profiling to decide anything about the people who write to you, with one exception you control: the Moderator.

If you run a community channel (a Discord server's channel, a Slack channel where you are an admin) and turn on the Moderator there, AI judges each new message from other people against that channel's rules and suggests a step: removing the message, or also timing out, removing or banning its sender. It asks you first on a card unless the channel is on Automatic, where it takes a clear-cut step on its own; a ban and anything it isn't sure of always wait for you. It judges only the one message and the few before it, keeps no profile of anyone, and learns only from your own decisions in that channel. You are the controller of these decisions and decide the channel's rules (section 7); a member who disagrees can ask you, as the channel's owner, to look again, and a timeout or ban can be lifted in the platform at any time.

Drafts, classifications and agent tasks are generated by third-party large language models (currently Anthropic Claude, and OpenAI GPT models for some steps, such as writing drafts). To do this we send the model the relevant incoming message and the recent messages of that conversation (which include what the other people in it wrote), a limited number of your prior replies with that person (as examples of your style), a description of your style, and any task context. Photos and PDFs in those messages, the ones you send included, are read by the model once into a short description that is kept with the message (the file itself is not kept), so replies and summaries know what they show. When a message refers to someone or something only another of your own recent conversations explains, the lines of those conversations that mention it are sent too, only so the model understands the message; a reply written with them is never sent automatically, it waits for you. A message you type and send from ALTRmode is sent to the model, with the conversation's last few messages, who it is with (its name, the names of the people in it, and a line on who they are to you) and whether you typed it on a phone or a computer (from your browser type) so it can tell which word you meant, so misspelled words can be fixed: just before it goes, or right after where the app lets a sent message be edited (then it is corrected by editing it) (Settings → Fix my typos before sending, on unless you turn it off; forwarded messages are never sent for this). When something was fixed, the words as you typed them are kept with that message, so you can see what changed, and are deleted with it. While the setting is on, it also learns from your own edits of messages you sent (here or in the app itself): a word you corrected, and a word you put back after a fix changed it. Those words are kept, encrypted, in your account only, sent to the model with the messages it fixes so it fixes the same slip the same way and leaves those words alone, and deleted when you disconnect that account or delete yours; they are never used for anyone else. For a Claude Code task, the model also reads the repository you selected. Where you turn on the Moderator, each new message from someone else in that channel is sent with the 8 messages before it, the channel's rules and your past decisions there, so the model can judge whether it breaks the rules. Voice messages in a switched-on conversation are transcribed by OpenAI so they can be read and answered, and so is what you say to CTRL when you talk to it, so it can act on it. Model output is returned to you for review unless you have set the conversation to automatic. AI output can be wrong; see the Terms.

These providers process the data on our behalf under their commercial API terms: they do not train their models on it and do not use it for any purpose of their own. They may keep a request and its response for up to 30 days solely to detect abuse and keep their services safe, after which it is deleted. We do not store the prompts we send or the text the model returns, other than the drafts you see and your Help and CTRL chats (section 1).

When a message in a switched-on conversation contains a link, our servers may open that page (for some sites, such as Instagram and Facebook, through their public embed service) so a reply, or the work you asked a GENT to do, can understand it; the site sees a request from our servers, not from you. The same goes for the preview card shown under a link, including one in a message you are still writing: our servers read the page's title, description and picture to draw it, and keep it only briefly in memory.

Users. We never sell or share our users' personal information (your account, your messages, your connected services and how you use the app), and never use it for advertising. We disclose it only to:

• Infrastructure and processing providers acting on our instructions: Northflank (hosting, databases), Cloudflare (content delivery, TLS and DDoS protection for the app's web address, so it handles the pages and your IP address as they pass through), Have I Been Pwned (when you choose a password, to refuse one known from a data breach; it receives only the first 5 characters of a hash of it, never the password or anything about you), Anthropic (AI models, and isolated workspaces for Claude Code tasks), OpenAI (AI models for some steps, such as writing drafts, and transcription of voice messages), OpenStreetMap's Nominatim (the area name for a location you share), Google (sign-in, Gmail and Google Chat APIs, Pub/Sub notifications), Slack (Slack API), Microsoft (Outlook and Teams through Microsoft Graph), Discord, Asana, Trello, monday.com, GitHub, Atlassian (Jira), Linear, Zendesk, Freshdesk, Intercom, Help Scout, Front, Trustpilot, Apple (App Store Connect), Google (Business Profile and Google Play) and Meta (Messenger and Instagram, through its Graph API) (their APIs, for the accounts you connect), GitHub and the other tools you connect for GENTs (section 3), Stripe (payments), Resend (the emails we send you, and messages you send to our support address), Kickbox (checking that an email address used to sign up can receive mail), Automattic's Gravatar (looking up the public profile picture of an email correspondent, from a scrambled form of their address), Expo, Google Firebase Cloud Messaging and Apple Push Notification service (delivering notifications to the mobile app) and the push service of your web browser (delivering browser notifications);
• The platforms you connect, when you or your settings instruct us to send a message or start a task there;
• Authorities or third parties when required by law, subpoena or court order, or to protect the rights, safety or property of MeMaMu LLC, our users or the public;
• A successor in a merger, acquisition or asset sale, subject to this policy.

Website visitors. If you browse our public website and press Accept in its cookie banner, details of that visit (never anything from an account) go to the analytics and advertising partners named in section 9A, such as Google and Meta. This is the only information we share for advertising, and only with your consent.

Switched-on conversations necessarily include messages written by the people you correspond with. You are responsible for ensuring you may process their messages this way under the laws that apply to you and for any disclosure or consent they require. We process such messages only on your behalf, only within the conversation they came from, and never contact those people ourselves. If you are a data controller under GDPR or similar law, we act as your processor for that data under our Data Processing Addendum, which is part of the Terms.

A reply its user lets ALTRmode send on its own ends, unless they turned this off, with a short line saying so and a link to a public page explaining ALTRmode. Opening that page tells us nothing about who you are beyond what any web server sees (such as your IP address and browser, in our server logs); it sets no tracking cookies, and we don't connect your visit to the conversation the link came from.

If you are someone who writes to a ALTRmode user and want to know what we hold about you, or want it deleted, write to privacy@altrmode.com. Because we process your messages only on that user's behalf, we will pass your request on to them and help them answer it, and we will delete what the law requires us to. ALTRmode never contacts you on its own, never sends you marketing, and is built not to be usable for bulk or unsolicited messaging: it sends only in conversations its user has recently been writing in, and only as that user.

A user who turns on the Moderator in a community channel they run decides its rules and is responsible for telling the channel's members that messages there are checked against them with AI and may be removed, and their senders timed out, removed or banned. If that was done to you and you think it was wrong, ask the channel's owner: they decide, and can undo a timeout or ban in the platform.

• In a conversation that is on, messages are deleted 90 days after they were sent, however few the conversation has. A few may wait up to 7 more days while your ALTR finishes learning from them. What it learned from them stays while the conversation is on, encrypted: examples of how you answered (the message and your reply), your style profile and its summary of the conversation. That is what keeps your replies sounding like you, and it is deleted with the conversation.
• Group-message reader identifiers in the encrypted connection cache are limited to 300 message entries per connection, evicted as newer entries arrive, removed when their message is deleted, and deleted when the channel is disconnected. Services queried for reader details on demand are not retained here.
• A key a team admin shared with the team is deleted, with every member's copy, when the admin stops sharing it or the team account is cancelled; a member's copy goes when they leave the team or are taken off the list. Records of a member's GENT tasks using a shared key are kept for a year, and deleted with that member's account.
• The key that encrypts the copy of your chats kept on a device (section 9A) is kept until you sign out on that device, reset your password or delete your account, or until it is the oldest of more than 20.
• Switching a conversation off stops processing immediately. If it stays off for 72 hours, its messages, drafts, learning examples, style profile, summary and voice checks are deleted (the 72 hours let you switch it back on after a mistake without it having to learn you again).
• A conversation that is on but has had no messages for a while (30 days, or a shorter time you choose in Settings) rests: it stops being processed as if it were off, but keeps what your ALTR learned there, because it switches itself back on when the next message arrives. Its messages are still deleted 90 days after they were sent, as above. If you switch a resting conversation off yourself, the 72 hours above apply.
• The record of a device you're signed in on is deleted when that sign-in ends: when you sign out there or from Settings → Plan & account → Security, reset your password or delete your account, or after 30 days without use on a device you chose to remember (otherwise after an hour without activity, and 12 hours at most).
• Help and CTRL chats are deleted 30 days after you last used them, or when you delete them on the page.
• What the learning loop reads (your comments, messages, drafts and GENT work) is never stored: it is read for one request and dropped. What it learned (voice rules, plays and Life notes kept always) stays until you delete it on TUNE, and goes with your account; a voice rule for one conversation also goes with that conversation.
• Life page notes are deleted 30 days after they were added (from 5 November 2026 for notes added before then), unless they are marked "Keep always" (by you, or by ALTRmode for a lasting answer or noticed note); kept notes stay until you delete them. You can delete any note sooner.
• Words you typed in a reply box and haven't sent are deleted when you send them or empty the box, and 30 days after you last typed in it.
• The key the iPhone app keeps for asking CTRL through Siri lasts 30 days from when the app last renewed it, and stops working at once when you sign out of the app there, sign out of other devices or reset your password.
• What you say to CTRL when you talk to it isn't kept as audio: it's turned into words as you finish speaking, and the words are kept in that CTRL chat like a request you type, and deleted with it (above).
• Files you attach in a reply box, voice notes you record included, are deleted once they've been sent, a day after you attached them if you never send them, and a week after sending started if a send never finished (a message scheduled for later keeps its files until it goes). The short-lived Google access for a Google Photos pick is deleted when the picked files have been added, and within an hour in any case.
• Which threads you've opened or marked done is kept while the conversation is connected, and deleted when you disconnect its channel or delete your account.
• A channel's Moderator settings (on or off, your rules for it, the rules it read from the channel, and the newest 30 of your decisions it learned from, each a few words on what the message was, without names) are kept encrypted while the conversation is connected; you can forget any decision in the Moderator's panel, and all of it is deleted when you disconnect the channel or delete your account. The record of each step it took or asked about is kept with your other GENT work.
• A parked thread's record is deleted when you open it once it's back, mark it done or unpark it, and 30 days after it came back if you never opened it.
• Your day's summary in Activity is replaced when a new one is written, and deleted 2 days after it was written, when you disconnect a channel, and with your account.
• To-dos stay until you delete them; one you mark done is deleted 30 days after you ticked it off. Disconnecting a channel doesn't delete your to-dos (they are your own list), but you can delete any of them at any time.
• Disconnecting a channel revokes the token and immediately deletes everything we kept for that account: its conversations, messages, drafts, learned style and the typo corrections learned from your edits there.
• Deleting your account (Settings → Plan & account → Delete account, or by emailing privacy@altrmode.com from your sign-in address) cancels any subscription, revokes our access to every connected service and immediately deletes all personal data, conversation data, learned style, tokens and drafts. We keep only billing records held by our payment processor and a record that an account was deleted, as the law requires (up to 7 years); they are not linked to your messages and not used for any other purpose.
• Records of what you agreed to (such as the version of these terms you accepted) and the security audit log are kept while your account exists. When you delete your account they stay without your account linked to them, only as long as needed to establish or defend legal claims.
• Feedback and support requests, notifications, and usage records are kept while your account exists and deleted with it. The in-app usage measurement (section 9A) is deleted after 13 months, and the IP address in it after 90 days.
• A message sent through the Contact page on our website is kept for one year so we can answer it and follow up, then deleted; ask us and we delete it sooner. Our replies stay in our support mailbox.
• A waitlist entry or invite, with your beta application and where it was sent from, is kept while we decide on it and, once you join, while your account exists; the IP address in it is cleared after 90 days. It is deleted when you ask us or delete your account.
• Server logs (which include IP addresses) are kept for a short time to run and secure the Service, and then deleted by our hosting provider. They never hold what your messages say, the names in them, or your contacts' phone numbers or email addresses: a log line names a conversation or message only by our internal id, and a contact only by a one-way code.
• Backups roll off within 35 days of deletion.

All traffic is encrypted in transit (TLS), except to a server of your own that you chose to connect over plain http (we warn you first, and never send a password to it). The content of your conversations (messages, drafts, words you typed and haven't sent, the examples and style your ALTR learns from, chat summaries and your day's summary, your Life notes, your to-dos, your Playbook and your Help and CTRL chats) is encrypted in our database with AES-256-GCM, and so are tokens, app passwords, authenticator secrets; the keys are held outside the database, so a copy of the database or its backups does not reveal them. Content is decrypted only inside our servers while it is being used for you. Only conversations you have been writing in recently can be switched on, so people with no recent history with you cannot get a reply from the Service, and messages that look like phishing, scams, malware or spam are never answered or acted on. Work an agent would do for someone who may not be entitled to what it finds, and replies that may share such information, wait for you instead of going ahead on their own. The Service never buys, orders or pays for anything on your behalf because a message offered it. Two-factor authentication is mandatory for password accounts. Access to production systems is limited to authorised personnel and logged, and our support tools display neither message content nor the names and addresses of the people you talk to. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and any required authority without undue delay.

The device copy also uses a local timestamp to avoid reopening an outdated inbox after you mark a conversation done. That timestamp contains no message content or chat identifier and is not used for measurement.

We use one cookie, which keeps you signed in, and, while you sign in with Google, short-lived ones that tie the sign-in to your browser (up to 10 minutes) and keep an invite you arrived with (up to an hour). If you tick "Remember this device" when you sign in, it lasts 30 days after you last used the app there; otherwise it ends when you close the browser, and we end the sign-in after an hour without activity (or 12 hours at most). The app also keeps small settings in your browser's storage, such as your theme, text size and background, whether you last chose to remember this device and when you last used the app in any of its tabs (so an hour away signs you out in all of them; signing out removes what's kept in your browser's storage except your theme, text size, cookie choice, whether to remember this device and its notification token), the chat you last opened and where you were reading in it, which tab you had open and how far you'd scrolled (so a refresh brings you back), your list filters, whether your chat list shows beside other pages, which tips you have dismissed, the time zone you picked in Settings (a copy of what your account keeps), and, if you allow them, that location and notifications are on. While you're signed in, the iPhone app also keeps a key in the iPhone's Keychain so you can ask CTRL through Siri with the app closed: it works only for CTRL, stays on that iPhone (never in a backup or iCloud), can be read only while the iPhone is unlocked, is removed when you sign out there, and stops working as soon as that sign-in ends (section 8). It also keeps on your device words you've typed in a reply box and not sent yet (a copy of what our servers keep for your other devices, section 1), and a message you've sent until our servers have it (so it isn't lost if the page reloads); each is removed once it's sent. So the app opens at once, it also keeps on your device a copy of your chat list and your most recent conversations (their messages and the replies drafted in them), the same things it shows you; the copy is used only to show them before our servers answer, is never sent to us or anyone else, and is deleted when you sign out, delete your account, or the sign-in page opens on that device. It is encrypted (AES-256) with a key made for that device alone. Our servers keep that key, encrypted, with the device's browser type and when the key was made and last used, and give it only to you while you are signed in. So the app can open at once, even with a slow or missing connection, your browser or phone app also keeps the key on the device, in a protected form the app can use but can't read out, and the app checks it with our servers each time it opens with a connection. The key is deleted from our servers when you sign out on that device, reset your password or delete your account, and the oldest one when you have used more than 20 devices. Signing out on the device deletes the copy and the key there at once; in the other cases they are deleted the next time the app opens on that device with a connection. Something you share into the app from another app (a photo, a link, a file) is kept only on your device (in the phone app's temporary files, or in your browser's storage for the installed web app) until you pick the chat to send it in, then removed; it reaches our servers only when you send it, like any file you attach. The Android app also gives your phone the names and pictures of your most recent chats so its share menu can offer them; they stay on the phone and are removed when you sign out. It also keeps, on the phone, what each chat's notification shows (so its buttons can show what they did), until that notification is gone, and the chat pictures it shows for a day. To avoid telling you twice about a message the chat's own app (such as Slack or Gmail) already notifies you of, it checks on the phone whether that app is installed; which apps you have is never sent to us. All of these are needed for what you asked the app to do, so they don't require a consent banner. Inside the app we measure, on our own servers, which pages and features signed-in users open, when, on what kind of device, browser, screen, time zone and language, and from which IP address, to understand how the app is used, fix what doesn't work, help you when you ask us, and keep accounts secure (such as noticing use from somewhere unexpected); nothing is stored on your device for it, it never includes message text or names, it is never shared or used for advertising, the IP address is removed from it after 90 days, and the rest is deleted after 13 months or with your account. When something in the app fails in your browser, it also sends us an error report: the error as our code or the browser wrote it, where in our code it happened, the page (without its web address's parameters) and the app version. It is kept the same way, and the full report is in our server logs for the short time section 8 gives, to find and fix the fault. If a notification's button in the phone app can't reach us, the app tells us the same way when you next open it: the kind of error, whether the phone was on Wi-Fi or mobile data, and whether Data Saver, battery saving or a limit on the app in the phone's settings was on. A preview of a link in your messages (for example a video) loads from that site when you open it, and that site may set its own cookies under its own policy. We use no fingerprinting.

When you pick a file in Google Drive for a change a GENT asked to make (section 2), the app loads Google's own file picker from Google, only at that moment. It opens in a window from Google, which uses your own Google sign-in there under Google's privacy policy; ALTRmode sets nothing for it, it is never used for measurement or advertising, and the access to your Drive it is given lasts an hour at most and isn't kept.

Website visitors: optional analytics and advertising tags on our public website. Our public pages (the homepage, these legal pages and the page an automatic reply links to) may use tags from analytics and advertising partners, such as Google (Google Analytics and Google Ads) and Meta (the Meta Pixel), to count visits and measure and improve our ads. These tags set their own cookies and send the partner details of your visit (the page, your browser and device, your IP address and an identifier, and whether you joined our waitlist on that visit, never the email address you entered), which the partner may combine with what it knows about you under its own privacy policy. They load only if you press Accept in our cookie banner, and never if you press Decline or your browser sends a Global Privacy Control signal; we remember your choice in your browser. You can change it at any time with Your privacy choices at the bottom of our public pages (a withdrawal takes effect on the next page you open). These tags never run inside the signed-in app, the admin console or the phone app, never on the sign-in pages, and never receive your messages, data from your connected services (including Google user data) or anything else from your account: having an account doesn't change what they see, only the public page you are on.

In the app, at any time: switch conversations off, disconnect channels and tools, edit or delete your Life notes, Playbook and Help and CTRL chats, turn location, calendar and notifications off, download a copy of your data (Settings → Plan & account → Download my data, a machine-readable file you can take elsewhere), and delete your account (same place).

Your rights. Depending on where you live you may have the right to: know what personal information we hold and how we use it, and get a copy of it (access and portability); correct it; delete it; restrict or object to how we use it, including objecting to processing based on our legitimate interests; withdraw a consent you gave; opt out of the sale or sharing of personal information, targeted advertising or profiling (we never sell or share users' personal information; for website visitors, the only sharing is the optional tags in section 9A, which you can decline); limit the use of sensitive personal information (we use it only to provide the Service); appeal our decision on your request; complain to a data-protection authority; and not be treated differently for using any of these rights. We give every user these rights, wherever they live, as far as we can.

How to ask. Email privacy@altrmode.com from the address you sign in with. If you write from another address we may ask you to confirm the request from that address or by signing in, so nobody else can get or delete your data. Someone you authorise may ask for you if they give us your signed permission and we can confirm your identity with you. We answer within one month (45 days for US state laws), and tell you if we need more time, up to the extra period the law allows. Requests are free unless they are clearly unfounded or excessive.

Appeals. If we decline your request, in whole or in part, we will tell you why. You can appeal by replying to our answer with "Appeal" within 60 days; someone who didn't make the first decision will review it and answer within 45 days. If you are still not satisfied you can contact your state attorney general or your data-protection authority (in the EU or UK, the supervisory authority where you live or work; in Israel, the Privacy Protection Authority).

Complaints to us. If you are unhappy with how we use your personal information, you can complain to us first: email privacy@altrmode.com with "Complaint" in the subject. We acknowledge every complaint within 30 days, look into it without undue delay, and tell you the outcome. You can still go to your data-protection authority at any time (in the UK, the Information Commissioner's Office).

Do not sell or share, and opt-out signals. We never sell or share users' personal information, so users have nothing to opt out of. Website visitors opt out of sharing for advertising by pressing Decline in our cookie banner, or later choosing Your privacy choices at the bottom of our public pages and pressing Decline. A Global Privacy Control signal from your browser is honoured automatically as the same opt-out, without you having to do anything.

This section is our notice under the California Consumer Privacy Act as amended by the CPRA, and the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Nebraska and other states. In the past 12 months we have collected these categories of personal information about users, from the sources in section 1, for the purposes in section 4, and kept them for the periods in section 8:

• Identifiers: name, email address, account and customer ids, IP address, and the ids of your connected services, contacts, and people who read group messages.
• Customer records: the above, plus your plan and Stripe customer id (no card numbers).
• Commercial information: plan, subscription, AI-token purchases and usage.
• Internet or other electronic network activity: actions in the app, device and browser data, logs.
• Geolocation data: your time zone, the city your internet connection points to (for example where each of your devices signed in), and your precise location only once you allow your device's location.
• Audio and electronic information: the messages and emails of conversations you switch on, group-message reader details where available, and voice messages in them, including the voice notes you record and send (turned into text; the audio isn't kept, and one you record is held only until it has gone out), and the to-dos written from them; and what you say to CTRL when you talk to it (turned into text; the audio isn't kept).
• Professional information: your organization, team role, and what the work tools you connect hold for a task.
• Inferences: the description of your writing style and of each conversation that ALTRmode learns so replies sound like you, the voice rules and plays it learns from your work, and the notes on the Life page.
• Sensitive personal information: your account sign-in and connected-account credentials, precise location once you allow your device's location, health information you choose to tell us in an accessibility request (section 1), and the contents of mail, email and chat messages in the conversations you switch on. We use and disclose it only to provide the Service you asked for (including learning from your own drafts and GENT work to improve them for you), keep it secure and prevent abuse, as the CCPA permits, and not to infer characteristics about you.

We disclose each category for business purposes to the service providers and platforms listed in section 6, under contracts that limit their use to providing their service to us. We never sell or share users' personal information. For website visitors who accept the optional tags on our public website (section 9A), identifiers (IP address and cookie identifiers) and internet activity from that visit (the pages viewed, browser and device, and whether they joined the waitlist; never the email address or anything from an account) are shared with the advertising and analytics partners named there, which counts as "sharing" and targeted advertising under some state laws; visitors can opt out as section 10 describes, and a Global Privacy Control signal is honoured. We don't use personal information for profiling with legal or similarly significant effects or offer financial incentives for it, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. Your rights and how to use them are in section 10.

We are based in the United States and our database is hosted there; our providers may process data in other countries where they operate. When personal information is transferred from the EU, EEA, UK or Switzerland to a country without an adequacy decision, we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions) where it has one, and otherwise on the European Commission's standard contractual clauses with the UK addendum, together with the safeguards in section 9. You can ask privacy@altrmode.com for a copy of the relevant safeguards.

The Service is not directed at children under 18 and we do not knowingly collect their information. If you believe a child has provided us data, contact privacy@altrmode.com and we will delete it.

We may update this policy. Material changes will be announced in the app or by email at least 14 days before taking effect. The "Last updated" date above shows the current version.

MeMaMu LLC · ALTRmode · privacy questions and rights requests: privacy@altrmode.com · support: support@altrmode.com