Your accounts are private.
We keep them that way.

• Connecting a channel shows its threads, and nothing in them is read until you switch one on. You can only switch on threads you have been writing in yourself, so strangers and spammers never reach it.
• What ALTRmode learns from your account (your voice, your Playbook, your Life notes) is saved in your account and used only there. Nothing one customer teaches it ever reaches another customer.
• Your data is never sold or shared, never used for ads, and never used to train AI models. Our use of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements.
• Settings → Plan & account → Download my data saves everything we keep about you as one file. Disconnect deletes a channel's threads at once and ends our access at the provider where it allows that. Delete account removes everything.

• Every connection to ALTRmode uses TLS, and browsers are told to use nothing else (HSTS).
• Message content, drafts, what your ALTR learned, summaries, notes, files and every credential are encrypted with AES-256-GCM before they reach the database, so the database and its backups hold only ciphertext. The keys are kept outside the database and rotated under a versioned keyring.
• Each connected account's credentials are bound to the customer they belong to: copied into another account, they can't be opened. Credentials are never sent back to the browser.
• Files people send you aren't stored: they open from the original app each time, unless you hand one to a GENT.

• Two-step sign-in with an authenticator app is required for every account, with recovery codes shown once. Five wrong passwords or codes lock sign-in for 15 minutes.
• Passwords are stored only as strong one-way hashes, and every one-time link or code is stored hashed. Reset links last an hour and work once.
• A browser you don't mark as remembered signs out after an hour without activity. Settings → Plan & account → Security lists every signed-in device, and signs any of them out.
• Important actions on your account (signing in, connecting or disconnecting, changing what may be sent, downloading your data) are kept in a security audit log.

• Our support and admin tools show counts, statuses and scores, never message text or the names and addresses of the people you talk to.
• Access to production systems is limited to authorised people and logged.
• Our logs never record what your messages say, what the AI wrote about them, or any password, key or token.

To draft and check replies, the messages needed go to our AI providers: Anthropic, and OpenAI for some steps such as voice-note transcription. Both act as our processors under commercial terms that forbid training on your data; they may keep requests for up to 30 days to detect abuse. We don't keep the prompts we send, only what you see: your drafts and your Help and CTRL chats.

• GENTs work with your own sign-ins and only where you let them work. Changes wait for your OK unless you allow a tool to act on its own.
• No GENT can buy anything for you, and an offer to buy something is never agreed to in your name.
• In the threads you switched on, every incoming message is checked for phishing, scams and dangerous files first. Nothing is drafted or sent for a flagged message, and its links are disarmed.