Privacy Policy

Last updated: October 2026

This policy explains what data ALSA stores, what it is used for, which third parties help process it, and what happens when you delete your account. We describe how ALSA actually works today.

1. Data We Store

Account: your name, email address, email verification status, and password (stored as a bcrypt hash, never as plain text). If you sign in with Google or Microsoft, we receive your name and email address from that provider, and we do not receive your provider password.
Your work content: projects, tasks, comments, team notes, weekly notes, milestones, project budgets, and automation settings you create in your workspace.
File attachments: stored with a third-party object storage service (Supabase Storage), not on the application server itself.
Integration tokens: if you connect Slack, GitHub, or Google Calendar, we store the access token issued by that service. Tokens are stored encrypted.
Activity: the last time you were active in the dashboard (used for online/away/offline status), plus change history and audit logs for security and team collaboration.
Technical data: your IP address is used temporarily to limit login attempts and abuse (rate limiting). Server logs kept by our hosting provider may record IP addresses and incoming requests.

2. How We Use Your Data

To run the core features of ALSA: project and task management, team collaboration, reports, automation, and notifications.
To send transactional emails: verification codes, password resets, workspace invitations, and notifications.
AI features (summaries, suggestions, autopilot) process the text you ask them to analyze. The AI Project Analyzer is off by default for every project; while it is off, the server does not send that project's data to the AI provider.
To run the integrations you enable, for example posting to a Slack channel through an automation rule.

3. Third Parties

These third parties process part of your data, and for what purpose:

AI model provider (Groq) — receives the text of tasks, comments, or attachment content that you ask to be summarized or analyzed with the AI features. For projects where the AI Project Analyzer is turned on, it also receives task names, deadlines, dependencies, assignees, attachment summaries, and activity history from those projects.
Supabase — stores the application database and file attachments.
Render — runs the application server.
Email delivery service (Resend, with Gmail SMTP as a fallback) — sends verification, password reset, invitation, and notification emails.
Slack, GitHub, and Google (Calendar) — only if you connect them yourself. Data is sent to those services according to the features you use.
Google and Microsoft sign-in — only if you choose to sign in with them. The login page loads Google's sign-in script, and Microsoft sign-in redirects you to Microsoft.
Sentry (error monitoring) — used only where enabled for the deployment. Request bodies, cookies, query strings, and user details are removed before an error report is sent.
Google Fonts — ALSA pages load fonts from Google, so your browser connects to Google servers when a page opens.

We do not sell user data to anyone for advertising.

4. International Data Transfers

ALSA is operated from Indonesia, and the providers listed above may process data on servers in other countries, which may be different from where you live. By using ALSA you understand that your data may be processed outside your country.

5. Sessions & Security

Login uses a JWT token that is valid for 7 days and is kept in your browser's session storage, so it is tied to the browser tab. Passwords are stored as bcrypt hashes, so we cannot read your original password. Integration tokens (Slack, GitHub, Google Calendar) are encrypted in the database. Data is separated between workspaces, and inside a workspace, members only see the projects they have been given access to.

No system is 100% secure. If you find a security issue, please tell us at the email in the Contact section.

6. Your Rights

Report export: you can download project reports from the app as CSV, Excel, or PDF. Members can only export projects they are allowed to see.
Full copy of your data: there is no automatic export button yet. Send a request to the email in the Contact section and we will handle it manually.
Disconnecting integrations: the disconnect button in Settings immediately deletes the stored token from our systems. You can also revoke ALSA's access from the settings of Slack, GitHub, or Google.
Deleting your account: see section 7.
Questions or corrections: contact us at the email in the Contact section.

Depending on where you live (for example under the GDPR in the EU/UK, or the CCPA in California), you may have additional rights, such as access, correction, deletion, and portability of your data. Send your request to the email below and we will respond as soon as we reasonably can.

7. Deleting Your Account: What Happens

You can delete your account yourself from the app. The result depends on your role:

Workspaces where you are the only member (you are the owner): the workspace is permanently deleted along with its contents: projects, tasks, comments, notes, budgets, automations, integrations (including their tokens), logs, and file attachments. Attachment deletion is best effort; if the storage provider fails to delete a file, it may remain.
Workspaces that still have other active members: you cannot delete your account until you transfer ownership to another member.
Other people's workspaces (you are only an admin or member): your membership and project access are removed. Content you wrote there stays for that team. References to your account in logs and history are cleared.
Account: your account data (name, email, password hash, verification and reset tokens) is deleted.

Deletion cannot be undone. Backups that our database provider creates automatically may persist for a while until they are overwritten by later backup cycles.

8. Contact

For privacy questions, requests for a copy of your data, or security reports, contact us at support.alsa@gmail.com.

Note: This document is written to honestly reflect how ALSA works today and to be readable by non-lawyers. It is not a substitute for professional legal advice. Before ALSA is used commercially with paying customers, especially customers in the EU, UK, or US, we recommend having this document reviewed by a lawyer familiar with data protection law in those regions.