Privacy Policy

This Privacy Policy describes how Alfred ("we", "us", "the app") handles information when you use our macOS desktop workspace application. Alfred is a personal tool for organizing notes, databases, and calendar events.

1. Information we collect

We collect only the information needed to operate the app:

• Account information: email address and password (stored as a hash by our authentication provider), plus an optional display name and avatar.
• Content you create: workspaces, pages, databases, tasks, uploaded files, and canvas drawings that you author inside the app.
• Google account data (if you connect Google Calendar): OAuth access and refresh tokens, the list of calendars on your Google account, and calendar event details (title, description, time, location, attendees) for events within the time window the app displays.
• Technical data: minimal logs (timestamps, error messages) needed to operate and debug the service.

2. How we use your information

• To authenticate you and keep your session secure.
• To store and render the content you create inside the app.
• To read and, when you request it, create or modify events on calendars you have connected via Google OAuth.
• To diagnose errors and improve reliability.

We do not sell your data. We do not use your data to train machine learning or AI models. We do not show advertising.

3. Google user data

Alfred's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We request only the Calendar scopes needed to read your calendar list and read/write events on calendars you choose.
• Google user data is used solely to provide the in-app calendar features you see. It is never sold, never used for advertising, and never used to train AI models.
• Access and refresh tokens are stored encrypted at rest in our database and are accessible only to the account that authorized them.
• You can disconnect Google access at any time from the app's Integrations settings, or by revoking access at myaccount.google.com/permissions. Disconnecting removes the stored tokens and cached calendar data.

4. Where your data is stored

Your content and account data are stored on Supabase (PostgreSQL database and object storage). The application is hosted on Vercel. Both providers are contractually bound to process data on our behalf under their respective data processing agreements.

5. Sharing

We do not share your personal data with third parties except as strictly necessary to operate the service (our hosting and database providers named above), to comply with applicable law, or with your explicit consent.

6. Data retention and deletion

We retain your data for as long as your account is active. You may delete your account at any time by contacting us at the address below; when you do, your workspaces, pages, databases, uploaded files, and stored Google tokens are permanently deleted from our systems within 30 days.

7. Security

We use industry-standard measures including TLS in transit, encryption at rest, and row-level security policies that prevent users from reading each other's data. No system is perfectly secure; please use a strong, unique password.

8. Children

Alfred is not directed at children under 13 and we do not knowingly collect personal information from them.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.

10. Contact

Questions or requests related to this Privacy Policy can be sent to gsmash95@gmail.com.