Privacy
Policy

We collect information in three ways:

A: Directly from You

• Account and profile information: your email address, display name, avatar where provided, and account session information used to operate the Service. Sign-in is provided through Supabase Auth.
• Workspace and collaboration information: workspace names, memberships, roles, invitations, and collaboration activity.
• Product content: Projects, Ideas, Tasks, feedback, reviews, comments, attachments, workflow status, and related context that you create or receive in Alloyqa.
• Repository and Task source information: connected repository names and settings, branches, commits, pull requests, diffs, reviews, and status information, plus public GitHub repository URLs, repository metadata, changed files, and persisted review diffs or patches for public-repository Tasks.
• Execution information: Cloud execution status, Task status, attempts, checks, command output or summaries, errors, changed-file information, pull-request details, and results used to show work history and support review.
• AI provider credentials: when you connect OpenAI, OpenRouter, Gemini, or Ollama Cloud, an encrypted API-key value and a last-four-character key hint used to show connection status. The full key is used only by authorized server-side services for provider validation and to make your selected provider request.
• Billing information: workspace plan and subscription status, cloud-hour usage records, historical Cloud balance and purchase records, and execution records. Paddle processes checkout and payment transactions.
• GitHub credentials: where GitHub access requires Alloyqa to retain a credential, the application stores it separately from normal product records.

B: Automatically

• Service and diagnostic data: feature use, Task and workflow activity, request timing, and error information used to operate and troubleshoot the Service.
• Session data: authentication session information managed by Supabase Auth.
• Analytics data: product usage events and app interaction data collected through PostHog and Firebase Analytics to understand how Alloyqa is used and improve the Service.

C: From Third-Party Integrations

When you connect GitHub, provide a public GitHub repository URL, or use the Alloyqa agent and Cloud execution, Alloyqa processes the information needed for that action:

• GitHub: for connected repositories, metadata, branches, commits, pull requests, diffs, comments, reviews, and status checks needed to return or merge changes according to workspace policy; for public-repository Tasks, the public URL, metadata, and source retrieved over public HTTPS.
• Alloyqa Cloud execution: Alloyqa's managed Cloud worker receives the Task instructions, feedback, and selected repository workspaces needed to perform Cloud execution. Google Cloud provides managed worker infrastructure. New Cloud Tasks can use the Task owner's connected OpenAI, OpenRouter, Gemini, or Ollama Cloud API key; historical Tasks may retain their original model-provider configuration.

We use the information we collect to:

• Explore connected repositories or public repository sources to understand codebase architecture, configuration, and patterns.
• Help you investigate reported issues and verify expected behaviour.
• Generate and modify code to implement requested changes and bug fixes.
• Run and record checks and execution results from work performed through the Alloyqa agent and Cloud execution.
• Create branches, commits, and pull requests in connected GitHub repositories.
• Run public-repository Tasks without GitHub App credentials and retain their changes as Alloyqa review artifacts rather than pushing or creating pull requests.
• Produce Task history, review context, and results for you and your workspace.
• Authenticate your identity and maintain your session securely.
• Monitor Service performance, diagnose errors, and prevent abuse.
• Communicate with you about your account or material changes to this policy.

Alloyqa keeps workspace, Task, review, repository, execution-result, and billing records in order to operate the Service and show workspace history. Task attachments, feedback screenshots, and supported execution evidence may be stored with the related product record.

Temporary Cloud workspaces and repository checkouts used for Alloyqa agent and Cloud execution are deleted after execution. Normal Task metadata, execution results, and review artifacts, including persisted public-repository diffs or patches, follow Alloyqa's existing retention practices. Alloyqa does not currently publish a fixed retention period for retained execution logs or evidence.

Workspace owners can delete a workspace through the product. For account or personal-data deletion requests, contact privacy@alloyqa.com.

The Service integrates with and relies on the following third-party providers:

• Supabase: database, authentication, and file storage used by the Service.
• Netlify: public application and serverless API hosting.
• GitHub: public-repository URL verification and source retrieval, plus repository, version-control, and pull-request operations for connected repositories.
• Google Cloud: managed worker infrastructure for Alloyqa Cloud execution.
• OpenAI, OpenRouter, Gemini, and Ollama Cloud: AI processing for Cloud Tasks when the Task owner selects and connects that provider.
• Paddle: Alloyqa Cloud subscription billing, historical Cloud balance purchases, and payment processing.
• PostHog: product analytics, sampled website/session replay on selected public pages for anonymous visitors, and authenticated-session replay. Replay is configured to mask form inputs and sensitive credential-like content.
• Firebase Analytics: product analytics used to understand feature usage and app interactions.
• LiveKit: real-time audio/video infrastructure used for Calls in Alloyqa.
• Resend: transactional email, including workspace invitations.

Each provider processes information under its own terms and privacy notice. The information sent depends on the feature, GitHub connection, or Cloud execution you use.

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• With GitHub, at your direction, to verify and retrieve a public repository source, or to read selected connected-repository information and create branches, commits, pull requests, reviews, and other authorized repository actions.
• With Supabase, Netlify, Paddle, PostHog, Firebase Analytics, Resend, and other providers that operate the Service, as needed for the service they provide.
• With LiveKit as needed to provide real-time Calls.
• With Google Cloud as needed to operate managed worker infrastructure and historical execution paths.
• With OpenAI, OpenRouter, Gemini, or Ollama Cloud when the Task owner selects that provider. The provider receives the model request needed for the Task, which can include Task instructions and relevant code or repository context. The worker and coding agent do not receive the stored provider key; Alloyqa's secure gateway decrypts it to authenticate the provider request.
• With service providers who help us operate the platform, under confidentiality obligations.
• If required by law, regulation, or valid legal process, or to protect the rights and safety of Alloyqa and its users.
• In connection with a merger, acquisition, or sale of assets: we will notify you before your data is transferred.

Connected-repository Tasks use GitHub App installation credentials and request access only for their selected repositories before GitHub work is performed. Public-repository Tasks do not use GitHub App credentials or GitHub write credentials; they cannot push changes or create pull requests.

OpenAI, OpenRouter, Gemini, and Ollama Cloud keys are stored per user, encrypted before application storage, and are not shared with workspace members. After saving, Settings receives connection status and a last-four-character hint rather than the full key.

Where Alloyqa stores another integration secret, the application encrypts it before application storage.

You can disconnect GitHub from Alloyqa. You may also revoke access through GitHub's own settings.

The web app uses Supabase Auth session handling to keep you signed in.

The web app also uses browser cookies and local storage for workspace selection, cached workspace and Task data, preferences, and other client-side state.

We use PostHog product analytics, conservatively sampled website/session replay on selected public marketing pages for anonymous visitors, and authenticated-session replay to understand how Alloyqa is used. Anonymous visitors are not identified until they authenticate. Signup, sign-in, and authentication callback pages are excluded from replay; form inputs, emails entered into forms, passwords, tokens, GitHub credentials, code, environment variables, network request and response bodies, network headers, console logs, canvas content, and credential-like text are excluded or masked.

Depending on your jurisdiction and applicable law, you may have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Deletion: request that we delete your account and associated data.
• Portability: request your saved data in a machine-readable format.
• Objection: object to certain processing activities.

These rights may vary depending on your location and applicable law. To make a privacy request, contact us at privacy@alloyqa.com.

The Service is not designed for use by children under 16. If you believe a child has provided personal information through the Service, contact us at privacy@alloyqa.com.

For a current description of Alloyqa's implemented controls for Cloud execution, credentials, GitHub access, and logging, see Security at Alloyqa.

No internet service can guarantee complete security. If you suspect unauthorized GitHub access, disconnect GitHub in Alloyqa and revoke access through GitHub's own settings. If you suspect a provider key is exposed, remove it from Alloyqa Settings and revoke it with that provider.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a revised effective date. Your continued use of the Service after changes are posted constitutes acceptance. For significant changes, we will make reasonable efforts to notify you by email.

For privacy questions or requests, contact us at privacy@alloyqa.com.