Privacy Policy
Last updated October 10, 2026
This Privacy Policy explains how Alkahest — the hosted service at alkahest.app, its API and its remote MCP connector (the "Service") — collects and uses personal data.
1. Who is responsible
The controller of your personal data is ioxyz (representative: Joonhee Cho). Privacy contact: cr8rcho@gmail.com — our postal address is under Contact at the end of this policy.
2. What we collect
- Account data — your email address, display name and avatar; if you sign in with GitHub, your GitHub username and profile picture. Passwords are stored only as secure hashes by our authentication provider.
- Workspace content — the maps, issues, notes, tasks, comments and settings you and your team create, including maps published from the Alkahest CLI. The CLI uploads the derived map, not your source files.
- Security data — API tokens (stored hashed), sign-in sessions, two-step verification settings and recovery codes.
- Notification data — webhook URLs you configure and, if you enable push notifications, your browser's push subscription.
- Billing data — when you buy Pro, Paddle collects your payment details. We receive your name, email, country, tax ID if provided, and subscription status — never your full card number.
- Technical data — IP address, browser and device information, and request logs that our hosting providers record when you use the Service.
3. Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the Service: accounts, workspaces, sharing, sync, notifications | Performance of our contract with you |
| Billing and subscription management | Performance of contract; legal obligations (tax, accounting) |
| Security, abuse prevention and debugging | Our legitimate interest in keeping the Service safe and working |
| Service emails: invitations, password resets, security and billing notices | Performance of contract |
We do not sell your personal data, and we do not use it for advertising.
4. Who we share it with
We share personal data only with providers that help us run the Service, under agreements that protect it:
- Supabase — database, authentication and file storage
- Vercel — web hosting
- Paddle — payments, as Merchant of Record (Paddle is an independent controller for the payment data it collects)
- Resend — transactional email delivery
- GitHub — only if you choose to sign in with GitHub
- Browser push services (e.g. Apple, Google, Mozilla) — only if you enable push notifications
Data also goes where you send it: the people you share a workspace or map with, Slack or Discord webhooks you configure, and AI assistants you connect through the MCP connector. We may also disclose data when required by law.
5. International transfers
Our providers may process data in countries other than yours, including the United States. Where data protection law requires it, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.
6. How long we keep it
We keep account data and workspace content while your account is active. When you delete content or your account, it is removed from the live Service, and backups expire within 30 days. Billing records are kept as long as tax and accounting law requires. Technical logs are kept for a limited period, typically under 90 days.
7. Your rights
Depending on where you live, you can access, correct, delete or export your personal data, object to or restrict certain processing, and withdraw consent at any time. You can edit or delete most data directly in the Service. To delete your account, or for anything else, email cr8rcho@gmail.com — we respond within one month. You also have the right to complain to your local data protection authority.
8. Security
We protect personal data with encryption in transit, access controls and row-level security in the database, and hashed credentials and tokens. No system is perfectly secure, and we will notify you and the relevant authorities of a personal data breach where the law requires it.
9. Cookies
We use only cookies and local storage needed to run the Service: sign-in session cookies (including those that keep multiple signed-in accounts on one browser) and local preferences such as your theme. We do not use advertising or third-party tracking cookies. Paddle's checkout sets its own cookies when you make a purchase.
10. Children
The Service is not intended for children under 16, and we do not knowingly collect their personal data.
11. Changes
We will post changes to this policy here and update the date above. For material changes we will notify you by email or in the Service.
12. Contact
ioxyz, 49 Junganggongwon-ro 39beon-gil, Bundang-gu, Seongnam-si, Gyeonggi-do 13588, Republic of Korea — cr8rcho@gmail.com