Privacy Policy
Aletheia is a truth-and-awareness companion (Lighthouse) and a humanitarian hub (Harbor). We collect the minimum needed to run those features, we tell you plainly what that is, and we don’t do anything with your data beyond what’s described here.
What we collect
- Account: your email address and sign-in credentials, handled by our authentication provider (Supabase Auth). Optional profile details you choose: a display name, @handle, bio, avatar color.
- Things you create: personal calendar events and tasks, journal reflections and mood check-ins (private to you by design — enforced with database row-level security), Harbor program drafts, posts, applications, and messages you send.
- Notifications: if you enable push alerts, the push subscription endpoint your browser issues (so we can deliver alerts). No alert content is ever sold or shared.
- Technical basics: standard server logs (for keeping the service running) and essential session cookies/storage for sign-in. We do not run third-party analytics, ad trackers, or advertising of any kind.
Google Calendar data (only if you connect it)
Connecting Google Calendar is optional. If you connect it, here is exactly what happens:
- What we access: your Google calendar list and calendar events, using the permissions you approve on Google’s consent screen (read-only, or read-and-write if you enable two-way sync).
- What we store: copies of events from the calendars you enable (so they display in Aletheia), and the OAuth tokens Google issues. Tokens are stored server-side in a database table that no client can read, and are never exposed to your browser or anyone else’s.
- What we do with it: display your events in your Aletheia calendar, and — only if you explicitly turn on two-way sync — write the changes you make back to your own Google Calendar. Nothing else. No advertising, no profiling, no training of AI models, no sale or transfer to third parties.
- Your controls: per-calendar toggles, a two-way opt-in that is off by default, and a Disconnect button that revokes our access with Google and deletes the synced copies from Aletheia.
- Limited Use: Aletheia’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Identity verification (Helping Hand only)
If you request aid through Helping Hand, a one-time liveness verification is performed by our verification provider (Didit). The biometric check happens on the provider’s systems — Aletheia never receives or stores your biometric data; we store only the verification verdict (passed / not passed) and a provider reference. Aid-related compliance checks (such as sanctions screening) are described in the Helping Hand flow itself before you proceed.
Where your data lives & how it’s protected
- Data is stored with Supabase (PostgreSQL), encrypted at rest and in transit, with row-level security on user data so you can only read what’s yours.
- Secrets and API keys live in server environment vaults — never in the app your browser downloads.
- Transactional email (such as security notices), if sent, comes from our own addresses and is never marketing.
What we never do
- No selling or renting your data. No advertising. No ad trackers.
- No reading your private journal, check-ins, or personal events for any purpose other than showing them to you.
- Emergency alerts are always free and carry no solicitation — that’s a founding rule, not a feature flag.
Deleting your data
You can delete your account from within the app at any time. Deletion is real: your account row and the personal data tied to it are removed (not hidden). Two honest exceptions: community content that others depend on (for example, posts in shared program boards) may be retained in anonymized form, and moderation audit records are kept as required for community safety. Disconnecting Google Calendar (without deleting your account) removes the synced copies and revokes our Google access.
Changes
If our data practices change, this page changes first, with a new effective date. Questions or requests: TheHost@aletheialighthouse.com.