Privacy

1. What we store

   Your vault, your chat history (kept indefinitely — your conversations are yours: kept until you delete them, included in your export), and derived facts from your connections. Never a copy of your email — mail is read-through: background sync reads new mail, extracts derived facts (a bill due, a flight, an order) into the vault and heads-up layer, and discards the message content. No mailbox copy, no search index. On-demand questions about mail use Gmail's own search live.

2. LLM processing, said plainly

   To do its job, Alcove sends your content to AI providers for processing. Our agreements prohibit them from training on your data or retaining it beyond processing. Current provider: Anthropic.

3. Human access

   No human reads your content in the normal course of business. Staff access only (a) with your explicit permission on a support issue you raised, or (b) where the law compels it — and every access is logged.

4. Why not end-to-end encryption

   Data is encrypted in transit and at rest, but an assistant that files and answers for you has to read your content — E2E is incompatible with what Alcove is. What we do instead: no-training LLM terms, consent-gated access, forget, export.

5. Deletion

   Self-serve delete-account button in Account; export offered one last time in the flow. Immediate: account closed, content unreachable, LLM retrieval gone. Complete purge from all systems including backups within 30 days, then a deletion-confirmation email — the receipt is the verifiability story. Honored for anyone regardless of region.

6. Export as a right

   One-click, self-serve, complete markdown zip, available to every account in every state.

7. Forget

   User-initiated hard delete — genuinely gone, from the vault and from the assistant's retrieval.

8. Cancel ≠ delete

   Paid access runs to period end, then the account goes dormant — vault readable, export available, assistant off. Dormant data retained 12 months, then purged, with warning emails and a final export offer first. Resubscribing anytime before purge restores everything.

9. Disconnect

   Disconnecting Gmail or Calendar stops all reading immediately; there is no mail cache to delete. Derived facts already filed are vault content — they stay, covered by forget and export like everything else.

10. Launch-only promises

    This page promises nothing that isn't true today. As independent evidence exists — like the Google CASA security assessment Gmail access requires — it appears here as verifiable evidence, not as a promise. SOC 2, audits, and local-first stay unmentioned until real.

Google user data

Alcove’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Sign-in requests only your name and email; Calendar and Gmail access are separate, optional connections you grant — and can disconnect — explicitly.

Questions, or a promise you think we’ve broken? Write to the address on your invite. Back to Alcove.