Privacy policy

What this covers

This policy describes the Aleja app, this website, and the service behind them. We don't sell ads, and we don't sell what you say. The terms of service are the other half of the agreement.

Your account

An account has the username, display name, avatar, bio and status you set. Your password is stretched on your device. What we store is wrapped with keys we never see. A recovery key, which you keep, is what opens that vault if you forget the password.

If you give us an email, on the account or on a support ticket, we use it to reply and to notice when one person is running several accounts. The app also sends a random device id, stored as a keyed hash, for that same check. IP addresses are kept only as keyed hashes. A shared network is not treated as one person.

Messages, files and calls

Direct messages, group chats, files and calls are end-to-end encrypted. The server stores ciphertext. We can't read the message, and we can't search it for you. Search runs on your device, in an encrypted local database.

File bytes are stored with Cloudflare R2, still sealed. Call media is relayed as ciphertext. Keys for a call rotate when someone joins or leaves.

On the desktop app, the session, the vault key and the encryption state sit in the operating system's credential store.

What we can still see

We can see nest names, membership, roles, and the profile you publish. We can see the routing a delivery needs, including which account sent a sealed payload and which conversation it belongs to. We can't read the payload.

Friend suggestions use a private comparison, so two people learn who they share and nothing else. Blocks are stored as opaque tokens, not as a list of pairs we can read.

Reports

A report you file in the app is sealed to the keys of the people meant to review it. Sending a report does not give Aleja a readable copy of the message.

Pictures on profiles and nests

Avatars and nest icons are stored so other people can see them, which means they are not end-to-end encrypted. Those pictures are scanned before they are stored, including for sexual content, violence, hate symbols and self-harm. Images we can actually see are also matched against known abuse hashes. A match can close an account. Sealed message attachments are ciphertext, so that scan does not apply to them.

Gemini

Gemini can join a chat or a call if you have Goose. She has to read the conversation to answer, so those chats are not end-to-end encrypted. The prompts go to Google. Don't send her anything you wouldn't send a service.

Accounts you connect

If you connect Spotify, Steam, GitHub, Reddit, Twitch, YouTube, X, Facebook, Battle.net or Riot, we show what you chose to show on your profile. Rich presence can also come from a game on your machine, from Spotify, or from a program speaking a local presence protocol. That stays as presence you publish, not as a copy of the other service's private data.

Artwork Aleja draws for the shop and the garage is made by Black Forest Labs.

Support and sign-up checks

A support ticket stores the name you give, the email, the category, and the message, so we can reply. Mail goes out through Resend. Sign-up, risky sign-ins, and the ticket form use Cloudflare Turnstile, which receives a check that you are a person.

How long things stay

Free accounts keep uploads for 180 days, up to 5 GB. A Goose membership keeps them for as long as the membership lasts, up to 100 GB. Device records we haven't seen in a year are dropped. You can ask us to close an account at support@aleja.app. Closing an account does not unseal other people's copies of messages you already sent them.

Asking us

Write to support@aleja.app or use the support page to ask what we hold about your account, or to ask us to close it. We can't produce the contents of a sealed chat, because we don't have them.