Privacy Policy

This Privacy Policy explains what information Alvitur ("we", "us") collects when you use our applications, websites, and APIs (the "Services"), how we use it, and the choices you have.

1. Information we collect

• Account information - email address, name, hashed password, and, if you use them, your phone number or Google account email for sign-in.
• Billing information - handled by Stripe. We store your Stripe customer reference, plan, and payment status; we never see or store full card numbers.
• Usage metering - for each AI request: model used, token counts, computed cost, timestamps, and an optional session identifier. This is required to enforce plan allowances.
• Prompts and generated content - the text your agent sends to AI models passes through our proxy to the model provider to generate a response. We do not use your prompts to train models.
• Local agent data - your agent's memory, skills, and session history are stored locally on your device in the Alvitur data folder, not on our servers.
• Diagnostics - error reports from the desktop app and our servers (error message, stack trace, app version, operating system) to fix problems quickly.
• Referrals - if you join through a referral link, we record which account invited you so credits can be granted.

2. How we use information

We use this information to operate and improve the Services: authenticate you, serve AI requests, enforce plan limits, process payments, grant referral credits, prevent fraud and abuse, provide support, and fix errors. We do not sell your personal information and we do not use your prompts or code to train AI models.

3. Sharing

We share information only with the processors needed to run the Services:

• Moonshot AI - receives the content of AI requests to generate responses (sent under our account, not linked to your identity by them);
• Stripe - payment processing;
• Cloudflare - network security and content delivery;
• SMS and identity providers - if you sign in by phone (SMS verification) or Google, those providers process the data needed for that sign-in.

We may also disclose information if required by law or to protect the rights, safety, and integrity of the Services.

4. Retention

Account and billing records are kept while your account is active and as required for tax and accounting. Usage metering rows are kept for up to 24 months. Error diagnostics are kept for up to 12 months. Prompts proxied to model providers are not persisted by our proxy beyond what is needed to deliver the response and meter usage.

5. Security

Passwords are stored using strong one-way hashing. Agent keys and API tokens are stored hashed; transport is encrypted with TLS. Access to production systems is restricted. No system is perfectly secure - report vulnerabilities to [email protected].

6. Your choices and rights

• Update your name and manage devices/agent keys from your account page.
• Cancel your subscription at any time; billing stops at period end.
• Request a copy or deletion of your personal data by emailing [email protected]. Deletion removes account data except records we must keep by law.
• Local agent data (memory, skills, sessions) can be deleted at any time by removing the Alvitur data folder on your device.

Depending on where you live, you may have additional rights (such as access, correction, portability, and objection) under laws like the GDPR or CCPA. We honor verified requests to the extent required.

7. Children

The Services are not directed to children under 18, and we do not knowingly collect their data.

8. Changes

We may update this Policy from time to time. Material changes will be announced by email or in-product before they take effect.

9. Contact

Privacy questions: [email protected].