Privacy Policy
Last updated: November 2026
01. Introduction
Welcome to AltoFlow. We are committed to protecting your personal data and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and what rights you have in relation to it. If you have any questions, please contact us at [email protected].
02. Google API Data Usage
AltoFlow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
AltoFlow's use of Google Calendar data is limited to providing and improving the AltoFlow scheduling service. We do not use Google user data to serve advertisements, do not allow humans to read user data unless required for security or legal compliance, and do not use or transfer data for purposes unrelated to the service.
Read and write access to Google Calendar to create, update, and delete scheduling events on your behalf.
Solely to analyze your availability and schedule focus blocks, habits, and buffers. We do not use it for advertising or profiling.
Your Google data is never sold or shared with advertisers. It is never used to train AI models. Only if you turn on AI features, event titles and times are sent to our AI sub-processor (Groq) to answer that request.
03. Information We Collect
- Account data: Your name and email address from Google Sign-In.
- Calendar data: Event titles, times, and descriptions needed to schedule around your existing commitments.
- Slack data: Your Slack user ID and access token, used only to update your status and send you DMs.
- Usage preferences: Focus goals, working hours, and habit settings you configure in the app.
- Billing data: Payment details are processed directly by Stripe. We store only your Stripe customer ID.
- AI features (opt-in): Off by default. When you turn them on in Settings → AI, the titles and start/end times of the events and tasks a request needs (and task priority and due date) are sent to Groq to produce the answer. Event descriptions, locations, attendees and your contact details are never sent, and the data is not used to train AI models. The weekly recap text is stored with your account so it is not regenerated on every visit. Turn AI off at any time to stop it.
04. Data Security
All data is encrypted in transit (TLS) and at rest. OAuth tokens are stored securely in Firestore with strict access controls. We never store your Google or Slack passwords.
05. Data Retention & Deletion
Your data is retained for as long as your account is active. You can delete your account and all associated data at any time from Settings → Account → Delete Account, or by emailing [email protected]. All personal data, calendar events created by AltoFlow, and your settings are permanently deleted within 30 days.
06. Your Rights
Depending on your location, you may have rights under GDPR, CCPA, or similar laws, including:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Withdraw consent for data processing
- Export your data in a portable format
- Lodge a complaint with your supervisory authority
To exercise any of these rights, contact [email protected].
07. Sub-Processors
AltoFlow uses the following sub-processors to provide its services. Each has its own privacy policy and data processing terms.
Data storage (Firestore), authentication, and Google Calendar API integration.
Application hosting and serverless function execution.
Payment processing and subscription management.
Product analytics (sign-up and upgrade funnel). Receives a pseudonymous id, never your email or calendar data.
Transactional email delivery (authentication links and notifications).
AI features, only when you turn them on: receives event and task titles and times (never descriptions or attendees) to suggest plans, read quick-add phrases and write weekly recaps.
Scheduled job execution for background sync tasks.
08. Cookies
AltoFlow uses essential cookies only — specifically a session cookie (NextAuth) required to keep you signed in. We do not use tracking cookies or third-party advertising cookies.
09. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes via email or an in-app notice at least 7 days before the changes take effect.
Last updated November 2026 · AltoFlow