‹ Back

Privacy policy

This Alto installation is run by its operator: whoever gave you its address and runs the server. They have not stated their name here yet.

Alto is a personal AI agent: it reads what you give it, remembers it and acts when you ask. So the server does see your data, and this page says plainly what happens to it.

What is stored

  • Account: your email, number or other sign-in, your name and picture.
  • Conversations: messages, attachments, voice recordings if you send them.
  • Memory: facts and thoughts the agent draws from conversations, your profile, notes, tables, files, skills and schedules.
  • Keys and passwords you entered in the secure form: stored encrypted; the agent uses them by reference and never receives their value. Keys typed into a chat by accident are cut out before anything is stored.
  • Service records: sessions (device, last seen), a log of model and tool calls including tool parameters, spending, server logs.
  • Location: only if you allowed it in Settings, where you can also erase it.

Sensitive subjects (health, political views, religion and the like) are not remembered by default; you can change this in Settings.

Where it lives and who can read it

  • Each person's data is kept apart, in their own container on the operator's server. Other people do not see it unless you gave them access.
  • Chat content is not encrypted with a key only you hold: a server administrator is technically able to read it. Conversations with the agent are not end-to-end encrypted: the agent has to read to work.
  • Platform staff open your space to help only with a ticket you issue, for its duration, and this is logged.
  • Someone you chat with sees only the lines of your dialogue with them.
  • If you turn on “Help development” in Settings yourself, the platform's developers can read your conversations; each read is written to your journal, and turning it off revokes access at once.

Conversation analysis is switched on at this installation: a service reads web chats and may quote them in reports to the operator.

AI providers

The models do not run on the Alto server. To answer or to think in the background, Alto sends the provider your message, the attachments you gave, the relevant parts of memory and tool results. This often means a transfer outside your country.

  • Anthropic: the models that answer and think
  • OpenRouter: the models that answer and think; passes text on to the maker of the model in use (Anthropic, DeepSeek, ElevenLabs, Google, OpenAI)

If you connected your own provider key, requests run on it. What a provider does with data is governed by its own terms: Alto does not send it a separate instruction against retention or training. Alto itself does not train models on your data.

In the app, Alto asks for your consent before the first model call. You can revoke it in Settings, “Privacy and search”: from then on Alto sends nothing to AI providers, does not answer and does not think in the background until you agree again.

Other services

  • 127.0.0.1:8091: the text of searches the agent runs for you
  • Telegram: everything you write in Telegram, if you connected it: those are Telegram's servers
  • Google: signing in with Google and the Google data you gave access to yourself
  • Apple, Google, Mozilla: the title and text of a notification, if you turned them on; anything sensitive is replaced by a neutral “New message”
  • 2GIS: addresses and places, if you ask for a route or allowed location
  • Open-Meteo: approximate coordinates for a forecast, if you allowed location

When the agent opens a site, calls a service or a connected machine at your request, the request goes there. Writes and outbound actions pass through confirmations and a journal, which you configure under “Trust”.

The shared skill library

By default, skills the agent has learned go to a library shared between agents in a generalised form: what relates to you personally is removed first. You can turn this off or adjust it in Settings, “Shared library”.

Ads and tracking

Alto shows no ads, sells no data and contains no third-party analytics. Cookies serve sign-in, language and colour; the mobile app keeps its sign-in token in the device's secure storage, the desktop app for now in its own local storage.

How long it is kept

  • Conversations and memory stay until you delete them or the account; you can set a period for idle conversations in Settings.
  • A browser session lasts up to 30 days, an app session up to 365 days; you can end any of them in Settings, “Data and account”.
  • Account deletion takes effect 7 days after the request, and you can cancel until then. Conversations, memory, files and sign-ins are then erased. Only a service record of the identifier and time stays, so the erasure is applied again if the server is ever restored from an older copy.
  • Backups are encrypted and may be kept off the server. Deleted data leaves them as old copies are replaced; the operator sets the period.
  • What AI providers and other services keep on their side is governed by their terms.

Your rights

In Settings you can see what Alto keeps about you, correct or delete it, end sessions, turn off individual features, revoke consent and delete the account. For any other request about your data, including a copy of it, contact the operator.

You may have further rights under the law of your country.

Children

Alto is not intended for children. The operator of this installation sets the minimum age.

Changes

If this policy changes, the new text appears on this page. If the list of AI providers changes, the app asks you again.