Privacy Policy
DRAFT. This text has not been legally reviewed yet and may change before Alcove is released.
Alcove is a personal dashboard for content that you and the AI agents you connect supply: articles, todos, events and birthdays. This policy explains what Alcove stores, why, and the choices you have. Alcove is operated by Daniel Barta, a sole trader in Hungary ("we"), who is the controller of your data. Contact: support@alcovesurface.com. TODO(Daniel): add the postal address and tax number required for the controller identity.
The short version
- We store the content you or your connected agents put into Alcove so we can show it to you on your devices.
- There are no ads in Alcove. We do no tracking and use no third-party analytics or advertising SDKs.
- We do not sell your data and do not share it with data brokers or advertisers.
- AI agents you connect see your Alcove data only after you approve them, and you can disconnect them at any time. We never receive your conversations with them.
- You can export your data and delete your account from inside the app.
Data we store
- Account. An account identifier, the sign-in identity linked to it, your timezone, and active sessions on your devices.
- Todos. Titles, notes, projects, labels, priorities, deadlines, reminders, recurrence and completion history.
- Articles. Article content, categories, bookmarks, read state, and the share links you create.
- Events. Event details supplied by you or your agents and your response (for example Interested or Going).
- Birthdays. Names, dates, optional birth year and notes that you or your agents add.
- Settings. Section visibility, colour theme, notification preferences and similar choices.
- Device tokens. If you allow notifications, we store your device's push notification token (issued by Apple) to deliver reminders. It is removed when you sign out, revoke notifications or delete your account.
- Media. Images attached to your articles or events, either uploaded or imported from a link you or your agent provide. We store our own copy so the app does not load the original host's trackers.
- Agent connections. For each AI agent you authorize: the name it registered with, the address it is sent back to after you approve, the permissions you granted, when it was connected, last used or disconnected, and usage counters for fair-use limits. Access tokens issued to the agent are stored only in protected form.
- Feedback. When you or a connected agent send feedback to Alcove (for example that something could not be done, or a feature request), we store its type, the short summary and details it contains, the tool and error involved, which agent sent it and its app or agent version, so we can fix problems and improve Alcove. Feedback is stored in the EU with your account, included in your data export, deleted with your account and otherwise deleted 180 days after it was sent.
- Operational data. Limited technical logs (for example error types, counts and status codes) used to keep the service running and secure, plus usage counters used to enforce fair-use limits. These logs do not contain the content of your todos, articles, events, birthdays or notes, your name, your email address or sign-in tokens. They are kept by Cloudflare for up to 7 days. TODO(Daniel): confirm log retention period.
We do not ask for access to your contacts, location, photos library or social accounts. We do not collect your conversations with AI agents, their chat history or memory, or files you give them: Alcove receives only what an agent sends in a request to Alcove (for example the title of a todo it creates).
Sign in with Apple
You sign in with Apple. Apple gives us a stable identifier for your account and, if you choose to share it, an email address (which may be an Apple private relay address). We use these only to sign you in and, if needed, to contact you about your account. Apple does not give us your password.
AI agents and MCP
You can connect your own AI agents (for example ChatGPT or Claude) to Alcove through the Model Context Protocol (MCP). An agent connects only after you sign in to Alcove and approve it on a consent page using OAuth. The consent page lists what the agent can access: it can read, add, change and delete your articles (including categories, bookmarks and share links), todos (including projects, labels, reminders and repeats), events (including your responses), birthdays, settings and theme. Access is all or nothing. An agent cannot see your Apple ID or password, cannot manage your subscription and cannot delete your account.
- What Alcove receives from an agent. Only the requests it makes to Alcove and the content in them. Alcove does not receive or store your conversation with the agent.
- What the agent receives from Alcove. The Alcove data it reads or changes for you. The agent's provider (for example OpenAI or Anthropic) handles that data under its own terms and privacy policy, as an independent company that you chose to use, and it may process it outside the EU.
- Images. When an agent asks Alcove to import an image from a web address, Alcove's servers fetch that one address and store a copy; the image's host sees a request from Cloudflare, not from your device.
- Your control. You can see each connected agent and disconnect it at any time in Settings → Connected agents; it loses access immediately. Without an active subscription, agents are refused until it is active again, except to send feedback.
Sharing
When you create a share link for an article, anyone who has the link can read that article and its images until you revoke the link or delete the article. Recipients do not see your identity, categories or the rest of your library. A recipient may save an independent copy to their own library while the link works.
Subscriptions
Alcove is offered as an auto-renewable subscription purchased through the App Store. Apple processes the payment; we receive only the subscription status needed to unlock the service, never your payment details.
How we use your data
Only to provide Alcove: storing and syncing your content across your devices and the agents you connect, sending the reminders you set up, checking your subscription status, enforcing limits that protect the service, keeping it secure, and responding to support requests. We do not use your content to build advertising or behavioural profiles, we do not sell it, and we do not train AI models on it.
Legal bases (GDPR): providing the service you signed up for (performance of a contract) for your content, account, agent connections, reminders and subscription status; our legitimate interest in a secure, reliable service for operational logs and abuse limits; and legal obligations where they apply. TODO(Daniel): legal review of the legal bases.
Where your data is stored
Your account data (your content, media, settings, sessions, agent connections and device tokens) is stored in the European Union, on Cloudflare's EU jurisdiction: the databases, file storage and per-account services that hold it are restricted to EU data centres. Some processing happens elsewhere, and we want to be clear about it:
- Request handling. Each request from your device or agent is handled at the nearest Cloudflare location, which may be outside the EU, before it reaches the EU storage. Short-lived caches of sign-in data for agent connections may also be held there.
- Sign in with Apple. Apple processes your sign-in. We receive the identifier and, if you share it, the email address described above.
- Notifications. Reminders are delivered through Apple Push Notification service. When you turn on notification content on the lock screen (off by default), the notification text (for example a todo title or a birthday name) is sent to your device through Apple; otherwise the notification carries only a generic text such as "You have a reminder" and internal identifiers. Agent activity notifications contain the agent's name and the number and type of items added; titles only when Show details on Lock Screen is on.
- Purchases. App Store subscriptions are processed by Apple.
- Your device. The app keeps a copy of your data on your device so it works offline and loads quickly. It is removed when you sign out or delete the app.
- Support email. Email you send to support is received through Cloudflare Email Routing and handled in Gmail.
TODO(Daniel): legal review of the transfer basis for the exceptions above (for example standard contractual clauses or the EU-US Data Privacy Framework), and whether Apple acts as a processor or an independent controller for each service.
Service providers
We use these providers to run Alcove. They process data on our behalf and only as needed to provide their service:
- Cloudflare, Inc. hosting, storage (EU jurisdiction), request handling, operational logs and support email routing.
- Apple Inc. / Apple Distribution International Ltd. Sign in with Apple, push notification delivery and App Store purchases.
- Google (Gmail) the mailbox where support email is read and answered.
We do not use any other processors, analytics, crash reporting or advertising services.
Who receives your data
- Our service providers listed above, only to run Alcove.
- AI agents you connect and their providers, for the data they access for you (see "AI agents and MCP").
- People you share a link with, for that one article and its images.
- Authorities, only if the law requires it.
No one else. We do not sell or rent your data.
How long we keep data
- Your content and settings are kept until you delete them or delete your account, including while your subscription is not active, so you can export your data or continue later. TODO(Daniel): decide whether long-inactive accounts are deleted after a set time.
- Deleted items are removed right away. A small marker without content (the item's id, type and deletion time) stays so your other devices learn about the deletion and the id is not reused; sync change records are pruned after 30 days.
- Sign-in sessions on your devices expire after 30 days; the browser sign-in used to approve an agent after one hour. A Sign in with Apple attempt started in the browser is kept for at most 10 minutes (one use) and then deleted.
- Agent access tokens expire after one hour and are renewed with a refresh token that expires after 30 days without use; disconnecting an agent ends both at once.
- Export files can be downloaded for 7 days and are then removed.
- Feedback you or your agents send is deleted 180 days after it was sent, or earlier with your account.
- Device tokens are kept until you sign out, turn off notifications, Apple reports them invalid, or you delete your account.
- Operational logs are kept by Cloudflare for up to 7 days.
- Support email is kept as long as needed to answer you. TODO(Daniel): set a retention period for support email.
Your choices
- Edit or delete any item in the app, or ask your agent to.
- Disconnect any agent in Settings → Connected agents.
- Turn notifications and notification text on the lock screen on or off.
- Revoke a share link at any time.
- Export your data or delete your account in Settings.
Export and deletion
- Export. In Settings you can request an export of your data as a downloadable file. It includes the feedback you or your agents sent.
- Deletion. In Settings you can delete your account. Deletion signs out every device, revokes agent connections and share links, and then removes your records and media. Independent copies that other people saved to their own libraries remain theirs.
- Backups. Deleted data may remain in encrypted backups for up to 30 days before it is overwritten. TODO(Daniel): confirm the backup retention period.
Children
Alcove is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect their data.
Your rights
Depending on where you live (for example under the GDPR), you may have the right to access, correct, export or delete your data, and to object to or restrict processing. Most of this is available directly in the app; for anything else, email support@alcovesurface.com. You may also complain to your local data protection authority.
Changes
If we change this policy we will update the date above and, for significant changes, tell you in the app.