Privacy Policy

1. Who we are and what this policy covers

1.1 algn technologies, Whitchurch, RG28 7FA (“algn”, “we”, “us”), is the controller of the personal data described in this policy. Contact: hi@algn.io.

1.2 This policy covers:

• the algn website at algn.io, including the site assistant, the waitlist, the correction form and the issue report form;
• the algn app, including Sera (the voice counterpart), your memory vault, Us (the social platform), membership, credits, governance and research participation; and
• emails and other contact between you and us.

1.3 It does not cover other websites or services we link to. If you are in a US state with a consumer health data law, our Consumer Health Data Privacy Notice also applies to you.

2. How algn is built, and what that means for this policy

2.1 algn is designed so that the most personal data is processed on your own device and never reaches us. Your memory vault, conversation history, messaging private keys and backup file are created, stored and encrypted on your device with keys generated there. We do not receive, hold or have access to them.

2.2 We decide how the app works, so we explain that processing in this policy. But because it happens on your device and under your control, we cannot access, disclose, correct or delete that data for you. You can do all of those things yourself, directly in the app.

2.3 Where data does reach our servers, we keep it to what the service needs, we separate it from your identity wherever we can, and we delete it as soon as it has done its job. The technical design is described on the Privacy Architecture page.

3. What we process, activity by activity

3.1 Visiting the website. We use cookieless analytics. When you load a page, your browser sends us the page address, the website that referred you (the domain name only, never the full address), how far you scroll, whether you reach the deeper part of a page, and the text of any script error. To group the pages you view in one visit, the page holds a random identifier in memory. It is never written to your device, and it is gone when you reload the page or close the tab. We don’t use cookies, cross-site tracking or fingerprinting. Our servers also see your IP address when you connect. We hold it in memory for a few minutes to limit abuse and do not store it with analytics.

3.2 The site assistant. If you ask the site assistant a question, the text of your question is sent to Anthropic, through its Claude API, to generate an answer from our published content. We don’t attach any identifier to it. Identical questions may be answered from a short-lived cache on our servers that lasts up to five minutes. The site assistant is part of the website only. It is separate from the app, and it uses a different provider from the ones behind Sera. We use Anthropic on its commercial terms: Anthropic does not use your questions or its answers to train its models, but it does keep them for a limited period to detect misuse and meet legal obligations, so the site assistant is not covered by the zero data retention described in section 7.1. Please don’t include personal information in your questions.

3.3 The waitlist. If you join the waitlist, we collect your email address, your name, your reason for joining, and a record of when you gave consent. We use them only to invite you to the demo and contact you about it.

3.4 Corrections, contributions and issue reports. If you submit a correction or contribution on a page or paper, we collect your message, the page and section it relates to, any link you include and, if you choose to give it, your email address. You can also tell us about yourself: your name, role, institution, ORCID iD, relevant expertise and any competing interests. All of this is optional. It helps us weigh what you sent, and we may check it against your public ORCID record or your institution’s website. If you use “Report an issue”, we collect the kind of issue, your description, the page it relates to and, if you choose to give it, your email address. We use these only to review and act on what you sent, and to reply if you asked us to.

3.4.1 How we handle issue reports. Reports are sorted and answered partly by AI, and a person on our team can see every report and everything done with it.

• Sorting. An AI model reads the kind of issue, your description and the page, and sorts the report: what it’s about, how urgent it is, a short summary, and whether it looks like a fault in the app or the website. We use Anthropic, through its Claude API, on its commercial terms: Anthropic does not use what we send to train its models, but keeps it for a limited period to detect misuse and meet legal obligations, so this is not covered by the zero data retention described in section 7.1. Your email address is never sent to the AI model.
• Fixing faults. If a report is a genuine fault, we open a ticket in our own software issue tracker with the summary, the page and a reference number. The ticket never contains your email address or contact details.
• Progress updates. If your report becomes a ticket and you gave your email address, we may send you short updates as we work on it: when we start, when a fix is on the way and when it’s fixed. These messages are written in advance by our team, not by AI.
• Replies. If you gave your email address, we may reply by email. Some replies are written by an AI assistant from our published pages and help answers. Those replies say clearly, at the top, that they were written by AI. Every reply has a “Talk to a person” button, and you can also just reply to the email: either way, a person on our team picks it up.
• Always a person. Reports about bullying or harassment, complaints, legal matters or your data, and anything that suggests you may be in distress, are never answered by AI. They go straight to a person. If a report suggests you may be at risk and you gave your email address, we also send you crisis contacts straight away, in a message written in advance by our team, not by AI.
• Sending email. We send email from mail.algn.io through Resend, an email delivery service. Resend tells us whether an email was delivered or bounced. We don’t track whether you open our emails or click their links. Replies to us reach our team inbox at support@algn.io, which is held in Google Workspace.
• Keeping a record. Every step taken on a report, including the sorting, any ticket and the full text of any reply, is recorded with the report in our internal tools so that we can check what was done. Our system logs record only reference numbers, the kind of step and its outcome, never what you wrote or your email address.

3.4.2 Credit for corrections. If a correction or contribution changes a page, we can credit you on that page’s public review ledger, the way journals acknowledge people who point out errors. We only do this if you tick the credit box, which needs your name and email address. We email you before your credit goes up. The credit shows your name and, if you gave them, your institution and ORCID iD, and it appears in the page’s structured data, so search engines and other sites can read and copy it. It never shows your email, your message, your role, your expertise or your competing interests. You can withdraw your consent at any time by emailing hi@algn.io, and we’ll remove your name from the page. We can’t recall copies others have already made.

3.5 Your account. When you join algn we collect your email address or other sign-in identifier, your declared date of birth (to confirm you are 18 or over), your settings and consents, and the public part of your passkey. Your passkey’s private part and any biometric data stay on your device. We never receive them.

3.6 Talking to Sera. When you speak or type to Sera:

• your voice is streamed to speech servers and turned into words in real time, and Sera’s reply is streamed back as synthesised speech. Your voice is not recorded or stored, by us or by any server it passes through;
• your words, the recent turns of the conversation and the part of your memory needed for that reply are sent from your device to our servers over an encrypted connection;
• our servers remove anything that identifies your account, device or IP address and send the request on as algn, in the same stream as every other member’s requests; and
• the request is held only while it is being answered. It is not stored and it is not logged.

3.7 Memory. Background processes draw out what’s worth remembering from a conversation. New memories are sent back to your device and written into your vault. We keep no copy.

3.8 Safety check. A safety check runs as part of each conversation so that Sera can respond with care when a conversation turns hard. It runs under the same rules as 3.6. No person reviews it and we keep no record of it.

3.9 Tone and energy (optional). If you switch it on, Sera notices the pace, energy and tone of your voice, measured against your own normal. Audio is analysed in memory a few seconds at a time and never written to disk. Readings last for the session only. What we keep is a small set of aggregate numbers describing your normal: no audio and no labels. They are encrypted and you can delete them. We never create a voiceprint of you or anyone else.

3.10 Membership, credits and participation. We keep your membership level, your credit balance and transactions, and your participation points. Participation is counted from activity signals totalled day by day: that you had conversations, posted, commented or took part. What you said is never used, and never leaves your device to be scored.

3.11 Buying credits. If you buy credits, our payment provider collects your payment details. We receive a record of the purchase (amount, date, a payment reference and the country for tax) but never your full card number.

3.12 Us. When you use Us:

• Profile. Your profile in Us, including any name and photo you choose to add. You are masked by default and your name and photo are only shown to someone when you both choose to unmask.
• Posts and images. Anything you post, comment or react to, and images you upload. These are visible to other members in the spaces where you post them.
• Matching. Before anything leaves your device, sensitive topics are removed, you approve the exact keywords, and what’s left is reduced to keywords and turned into numbers (an embedding) on your device. Those numbers are transformed with a secret key before they are stored. We receive only the salted numbers, a topic category and a tone score, with no words and no name. They are deleted straight after each matching run.
• Messages and voice notes. Messages and voice notes between members, one to one and in cells, are end-to-end encrypted. We hold them as ciphertext only long enough to deliver them, and we cannot read them.
• Cells. For each cell, we keep which members belong to it and when they joined or left, so that messages reach the right people.
• Reports and blocks. If you report or block someone, we keep a record of the report, what you chose to include with it, and what we did about it. If you attach an end-to-end encrypted message or voice note to a report, your device sends us a readable copy of that item only, so that our moderation team can review it. The member you report is never told who reported them.

3.13 Governance. If you comment on, vote on or submit proposals, we keep your contributions and votes, linked to your account and membership level.

3.14 Research (optional). If you opt in to research, we process the data described in the research consent you agree to at the time. Nobody is included without opting in, and you can leave at any time.

3.15 Contacting us. If you email us, we keep your email and our reply.

3.16 Paid contribution. If you take on paid work at Steward level, we process the information needed to contract with and pay you, under a separate agreement and notice.

4. Why we use your data, and our legal bases

4.1 Under UK and EU data protection law we must have a legal basis for each use of your personal data. Ours are:

4.2 Where we rely on legitimate interests, we have weighed them against your rights and kept the processing to what is necessary. You can object at any time (section 11).

4.3 We never use your data for advertising, and we never sell it.

5. Sensitive information

5.1 Conversations with Sera often touch on health, relationships, sexuality, beliefs and other special categories of personal data. We process this information only to answer you and to write memories back to your device, and only with your explicit consent, which we ask for when you join. You can withdraw it at any time by closing your account. We can’t provide Sera without it.

5.2 Matching never uses sensitive topics. Suicide and self-harm, health, eating, addiction, sexual life, sexual orientation and gender identity, abuse and trauma, pregnancy and fertility, money, legal matters, immigration, politics, other people’s private details and anything specific about children are removed on your device and can never be matched on. Faith can be matched only if you explicitly opt in. Grief can be matched.

5.3 Tone and energy does not identify you from your voice and creates no voiceprint. We treat it as sensitive processing and ask for your explicit consent before it starts.

6. Profiling and automated processing

6.1 Some parts of algn involve automated processing:

• Matching suggests members you might want to meet, based on salted numbers derived from approved keywords.
• Pattern reasoning helps Sera notice patterns across your conversations. Its results live in your vault on your device.
• The safety check adjusts how Sera responds when a conversation turns hard.
• Participation scoring sets your membership level from activity signals.
• Issue report sorting decides whether a report gets a reply written by AI, goes to a person, or becomes a ticket to fix a fault (section 3.4.1).

6.2 None of these makes a decision that has a legal effect on you or a similarly significant effect. A match is only a suggestion: nothing about you reaches another person unless you choose to send it, and they choose whether to accept. If you think your membership level is wrong, you can ask for a person to review it at hi@algn.io. If you’d rather a person answered your report than AI, use the “Talk to a person” button in any reply, reply to the email, or write to support@algn.io.

7. Who we share data with

7.1 Service providers. We use carefully chosen providers to run algn. They act only on our instructions, under written contracts:

• AI model servers that run open-weight language models, for the app;
• Anthropic (the Claude API), for the site assistant and for sorting and answering issue reports, on the website only;
• Resend, for sending emails about issue reports, and Google Workspace, for our team inbox;
• speech servers for transcription and voice synthesis;
• cloud hosting, database and sign-in infrastructure;
• a payment provider;
• email and waitlist tools; and
• website hosting and analytics.

Every provider that handles your words or your voice in the app works under zero data retention: they keep nothing, don’t train on your data and don’t allow human review of it. They receive your requests from algn, never from your device, and nothing that identifies your account. The site assistant and issue report sorting on the website work differently, as sections 3.2 and 3.4.1 explain: Anthropic doesn’t use site assistant questions or issue reports to train its models, but it keeps what it receives for a limited period to detect misuse.

7.2 Other members. Other members see only what you choose to share: your posts, the messages and voice notes you send one to one or in a cell, and your name and photo if you both unmask. Members must not share what you send them outside algn without your consent (see the Community Standards), but we can’t technically stop someone copying what’s on their own screen, so share with care.

7.3 Legal requests. We disclose data to authorities only when the law requires it and after checking that the request is valid. Because of how algn is built, the most we can disclose is the data we hold on our servers (section 3). We cannot disclose your memory, your conversations or your voice, because we never had them.

7.4 Changes to our business. If algn technologies is restructured, merged or its assets transferred, your data may move to the new owner, bound by this policy. We will tell you in advance.

7.5 Never for sale. We don’t sell personal data, share it for cross-context behavioural advertising, or let anyone use it to profile you for marketing.

8. International transfers

8.1 Some of our providers process data outside the UK and the European Economic Area, including in the United States. When they do, we protect the transfer with an adequacy decision (such as the UK-US Data Bridge or the EU-US Data Privacy Framework), the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, together with any extra safeguards needed. Resend, which sends our emails about issue reports, stores the data it handles in the United States. You can ask us for details at hi@algn.io.

9. How long we keep data

9.1 When you close your account, we delete the data we hold about you within 30 days. Copies in encrypted backups are overwritten within a further 35 days. We keep purchase records for as long as tax law requires, and we may keep a record needed to defend a legal claim or to stop a banned person rejoining.

10. Security

10.1 We protect data with layered technical and organisational measures, including encryption on your device (AES-256-GCM), encrypted connections, end-to-end encryption between members, passkey sign-in, strict access controls, and the removal of identifiers before any request leaves our servers. The design is set out on the Privacy Architecture page and the code that holds your vault, manages its keys and deletes your data is published as an open repository.

10.2 If a personal data breach is likely to put your rights at risk, we will tell you and the regulator without undue delay, and within the time the law requires.

11. Your rights

11.1 Under UK and EU data protection law you have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it;
• port it: receive it in a machine-readable format or have it sent to someone else;
• object to processing based on our legitimate interests;
• withdraw consent at any time, without affecting what we did before; and
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (algn makes no such decisions).

11.2 How to use them. Many of these you can do yourself in the app: see, edit and delete memories; export your backup; untick keywords, pause matching and delete matching data; switch off tone and energy; and close your account. For anything else, email hi@algn.io. We will answer within one month. If a request is complex we may extend that by up to two further months and will tell you why. We may need to confirm it’s you, and we will only ask for what we need to do that.

11.3 What we can’t provide. We can’t give you a copy of, correct or delete data we don’t hold, such as your memory vault or your conversations. You already hold them, and you can export or delete them yourself.

11.4 Complaints. If you’re unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or, in the EU, the data protection authority where you live or work.

12. Regional information

12.1 United States. Whether or not a particular state law applies to us, we give everyone in the US the rights it describes.

• Categories collected in the last 12 months: identifiers (email, account ID); commercial information (credits and purchases); internet activity (cookieless page analytics); audio (streamed, never recorded); inferences held on your device (not collected by us); sensitive personal information (account log-in, and conversation content processed only to answer you).
• Sources, purposes and recipients: as set out in sections 3, 4 and 7.
• No sale or sharing. We don’t sell personal information or share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We honour Global Privacy Control signals.
• Sensitive personal information is used only to provide the service you asked for, as those laws allow.
• Your rights: to know, access, correct and delete, and not to be treated differently for using them. An authorised agent may make a request for you with your signed permission. If we refuse a request, you can appeal by replying to our decision, and we will respond within 60 days. If we refuse your appeal, you can contact your state Attorney General.
• Consumer health data: see our Consumer Health Data Privacy Notice.

12.2 Canada. We handle personal information in line with PIPEDA and, for residents of Quebec, Law 25. Your data may be processed outside Canada by the providers in section 7, under contracts that protect it. Our privacy contact is reachable at hi@algn.io. You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

12.3 Australia. We handle personal information in line with the Australian Privacy Principles. Some providers process data overseas, including in the United States, and we take reasonable steps to make sure they handle it consistently with the Principles. You can ask to access or correct your information, and complain to us and then to the Office of the Australian Information Commissioner (oaic.gov.au).

13. Adults only

13.1 algn is for people aged 18 and over. We check age when you join and block anyone under 18. If we learn that someone under 18 has an account, we close it and delete their data.

14. Cookies and storage on your device

14.1 The website sets no cookies and stores nothing on your device for analytics. It keeps a few small items in your browser that the site needs to work the way you’d expect:

• your choice to have the ambient sound on or off, in local storage, until you change it or clear your browser’s site data; and
• for the current tab only, in session storage, which is cleared when you close the tab: a note that the opening animation has already played, and an answer from the site assistant while it takes you to the page it points to.

None of these identify you, and none are sent to us. If you’d rather not be counted in the website’s analytics at all, turn on Global Privacy Control or your browser’s “Do Not Track” setting and the website will not send analytics events.

14.2 The app stores your encrypted vault, keys and settings in your browser’s storage on your device. This is strictly necessary for the app to work and never leaves your device.

15. Changes to this policy

15.1 We will update this policy when the way we handle data changes. We will tell you about significant changes in the app or by email before they take effect. Earlier versions are available on request.

16. Contact

16.1 algn technologies, Whitchurch, RG28 7FA. The quickest way to reach us is Report an issue. You can also email hi@algn.io.