Privacy Notice

This Privacy Notice explains how Alongside processes personal data when you visit the website, create an account, use the local application, share a chat with other people, or join waitlists.

1. Data controller

Alongside is the business name used by Giovanni Andrade, a sole trader in Ireland and the data controller. For privacy questions or requests, contact [email protected].

The supervisory authority responsible for data protection in Ireland is:

Data Protection Commission
6 Pembroke Row
Dublin 2, D02 X963
Ireland

Website: dataprotection.ie
Telephone: (01) 765 0100

2. Personal data we process

Depending on how you interact with Alongside, we may process:

• Your email address when you create an account.
• Your email when you join waitlists.
• Your name, profile information, authentication identifiers, account status, and security events provided through Clerk.
• Technical and security information such as IP address, request timestamps, browser or device information, and information used to detect abuse or protect the website.
• Information you send to us when you contact us.

The local application stores messages and content locally within the user's preferred folder and a local SQLite instance. Alongside does not claim ownership of that content and does not provide server-side message storage under the current free product tier.

When you share a chat, or join a chat shared by another user, the chat is transmitted through Alongside's relay to make it available to its participants. The contents of a shared chat, including messages, files, agent responses, and prior history, are encrypted on the originating participant's device before transmission. Only authorised participants can decrypt and access that content. Alongside is not capable of accessing the contents of a local or shared chat.

To route a shared chat, the relay processes:

• The Alongside account identifiers of the chat participants, their roles, and a public encryption key associated with each participant's device.
• Requests to join a chat, including the requesting account identifier and an encrypted exchange used to verify the join code. The join code itself is not transmitted to Alongside.
• Metadata associated with each message or event, including the sender, timestamp, event type, and size.
• A per-account count of recent join attempts for the purpose of preventing unauthorised attempts to determine a join code.
• Encrypted message and file payloads, including a temporary buffer of recent activity used to support reconnection following an interrupted connection and to deliver encrypted files to the intended participants.

3. Purposes and legal bases

We process personal data for the following purposes:

Purpose	Data	Legal basis
Operate and protect the website and service	Request and security information	Legitimate interests in operating and securing the service
Create and secure an Alongside account	Account and authentication information	Necessary to take steps at your request and provide the service
Authenticate users and maintain account security	Account identifiers and security events	Necessary to provide the service and legitimate interests in security
Transmit shared chats between participants and verify requests to join	Account identifiers, roles, device public keys, join requests, event timestamps, and event sizes	Necessary to provide the requested service and legitimate interests in preventing abuse
Respond to privacy, support, or other enquiries	Contact details and message contents	Legitimate interests in responding to requests and, where applicable, steps taken at your request
Comply with legal obligations and establish or defend legal claims	Relevant information	Legal obligation or legitimate interests
Send updates on waitlist	Waitlist email address	Consent

4. Waitlists

If you join a waitlist, we use your email address only to send updates about the relevant product or feature and its availability. Joining a waitlist does not guarantee access, availability, or a particular launch date. We will not add you to unrelated marketing lists without obtaining your separate consent.

The waitlist uses a double opt-in process. You must confirm your email address before you are added. You may withdraw your consent at any time by using the unsubscribe link in an email or by contacting [email protected]. Withdrawal of consent does not affect processing carried out before the withdrawal.

5. Service providers and recipients

We may disclose personal data to service providers that process it on our behalf, including:

• Clerk, for authentication and account services.
• The hosting and infrastructure providers used to operate the website and supporting services.
• Cloudflare, for DNS, traffic protection, Turnstile abuse prevention, and operation of the relay that transmits shared chats through Cloudflare Workers and Durable Objects.
• Alongside's self-hosted Listmonk service and configured email-delivery provider, for operating waitlists and sending confirmation and waitlist emails.
• Professional advisers, public authorities, courts, or other recipients where disclosure is required by law or necessary to protect rights and security.

We do not sell personal data.

6. International transfers

Some service providers may process personal data outside the European Economic Area. Where this occurs, Alongside will rely on an adequacy decision or appropriate safeguards required by applicable data-protection law, such as standard contractual clauses or another lawful transfer mechanism.

The relevant provider terms and transfer information may change when the service configuration changes. Alongside will update this Notice when a change materially affects personal data processing.

7. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected:

• Account data is retained while the account is active and for a reasonable period after closure where necessary for security, legal, or dispute-resolution purposes.
• Waitlist data is retained until the relevant waitlist purpose ends or you withdraw consent. We may retain the minimum information necessary to record an unsubscribe request and ensure that we do not contact you again.
• Support and privacy enquiries are retained for as long as necessary to respond to the request and maintain appropriate records.
• Security and technical logs are retained for the period reasonably necessary to protect the service, investigate abuse, and comply with legal obligations.
• For a shared chat, the relay retains the participant list, participant roles, device keys, encrypted join code, and requests to join. This information is deleted when no participant has opened the chat for 30 days. A request to join expires after 7 days. Join-attempt counts are retained for 15 minutes.
• Encrypted content transmitted through the relay is retained only temporarily. Recent activity is deleted 10 minutes after all participants have left the chat. An encrypted file is deleted after all intended recipients have received it or, at the latest, 24 hours after transmission. The relay does not retain a copy of the conversation or its files. To notify a sender of unsuccessful file delivery, the relay retains the names of the intended recipients who did not receive the file for 7 days, but does not retain the file itself.

We periodically review retained data and delete or anonymise it when it is no longer required.

8. Your rights

Subject to applicable law, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Receive personal data you provided in a portable format where the right applies.
• Withdraw consent where processing is based on consent.

To exercise a right, contact [email protected]. We may request information needed to verify your identity. We will respond within the period required by applicable law.

You also have the right to lodge a complaint with the Irish Data Protection Commission using the contact details above.

9. Automated decision making

Alongside does not make decisions producing legal or similarly significant effects based solely on automated processing or profiling.

Security controls such as rate limiting, bot detection, and authentication checks may automatically reject or delay requests to protect the service.

10. Security

Alongside applies reasonable technical and organisational measures appropriate to the risks of processing personal data. These measures include access controls, secret management, encryption in transit, end-to-end encryption of shared chats, service-provider controls, abuse prevention, and data minimisation.

No method of transmission or storage is completely secure.

11. Changes to this Notice

We may update this Notice when Alongside's products, service providers, or processing activities change. The effective date at the top of this page indicates when the Notice was last updated. Material changes will be communicated through an appropriate website, product, account, or email channel.

12. Contact

For privacy questions or requests, contact [email protected].