← alcove

This Privacy Policy explains how Aleo Labs Operations LLC ("we," "us," or "our") collects, uses, and protects information in connection with the website located at alcove.aleolabs.io (the "Website"). The Website provides information about, and lets you sign up for updates regarding, the Alcove Wallet application (the "App").

1. Information we collect

We have designed the Website to collect as little personal information as possible. Specifically:

• Analytics data (non-identifying). We use Cloudflare Web Analytics, which is privacy-first and does not use cookies, does not fingerprint visitors, and does not collect or store any personally identifying information or IP addresses for the purpose of tracking you across the web. See Section 2.
• Email address (only if you choose to subscribe). If you sign up for updates, we collect the email address you provide and the technical data necessary to record and confirm your consent (such as the date, time, and confirmation status of your opt-in). See Section 3.
• Server/security data. Our hosting and content-delivery provider may process limited technical information (such as IP address) transiently to deliver the Website, defend against attacks, and maintain security. This is not used to build advertising or tracking profiles.

We do not ask for, and the Website does not require, your name, wallet address, private keys, seed phrase, financial information, or government identifiers.

2. Cloudflare Web Analytics

We use Cloudflare Web Analytics to understand aggregate traffic to the Website — for example, how many people visit a page and which pages are popular. We have configured analytics to be privacy-preserving:

• It does not set client-side state, cookies, or localStorage for tracking.
• It does not fingerprint individual visitors or use any information to identify you.
• It does not collect or retain personal data or persistent identifiers, and it does not track you across other websites.
• Metrics are aggregated and cannot, on their own or in our hands, be used to identify an individual.

Because this analytics data is not personal data and involves no cross-site tracking, we treat it as not requiring consent under the GDPR/ePrivacy framework. If you have questions about this determination, contact us using the details below.

3. Email updates & double opt-in

If you choose to subscribe to updates about Alcove Wallet, we process your email through Mailchimp (operated by Intuit Inc.), acting as our processor.

We use a GDPR-compliant double opt-in process:

• You enter your email address and submit the sign-up form.
• We send a confirmation email to that address. You are not added to our list until you click the confirmation link.
• Only after you confirm do we begin sending you updates. We record the date, time, and confirmation of your consent as proof of opt-in.

You can withdraw consent at any time by clicking "unsubscribe" in any email or by contacting us. Withdrawing consent does not affect the lawfulness of processing before withdrawal. We do not sell your email address, and we do not use it for any purpose other than sending you the updates you signed up for.

4. How we use information

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not engage in behavioral advertising.

5. Legal bases for processing (GDPR)

• Consent (Art. 6(1)(a)): sending you email updates, based on your confirmed double opt-in.
• Legitimate interests (Art. 6(1)(f)): maintaining the security and integrity of the Website and understanding aggregate, non-identifying usage. We balance these interests against your rights and use privacy-preserving analytics to minimize impact.

6. How we share information

We share information only with service providers that help us operate the Website, and only as needed:

• Cloudflare, Inc. — hosting, content delivery, security, and privacy-preserving analytics.
• Intuit Inc. (Mailchimp) — email list management and delivery, if you subscribe.

We may also disclose information if required by law, to comply with legal process, to enforce our Terms of Service, or to protect the rights, property, or safety of our users or others. We do not sell your personal information.

7. International data transfers

We operate globally. Our service providers (including Cloudflare and Mailchimp) may process data in the United States and other countries. Where personal data is transferred out of the European Economic Area, the United Kingdom, or Switzerland, such transfers are made under appropriate safeguards, such as the European Commission's Standard Contractual Clauses and, where applicable, the providers' certifications under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions.

8. Data retention

We keep aggregate analytics only for as long as it is useful for the purposes described above. We keep your email address and consent records for as long as you remain subscribed and for a reasonable period afterward to evidence consent and to honor unsubscribe requests, after which we delete or anonymize the data unless a longer period is required by law.

9. Your rights

Depending on where you live, you may have rights over your personal data, including the right to access, correct, delete, or port your data; to object to or restrict processing; and to withdraw consent.

EEA/UK/Switzerland (GDPR): You may exercise the rights above and lodge a complaint with your local supervisory authority.

California (CCPA/CPRA): You may request access to and deletion of your personal information and are entitled to non-discrimination for exercising your rights. We do not "sell" or "share" personal information as those terms are defined under California law.

To exercise any right, contact us at the address in Section 13. We will respond within the timeframes required by applicable law. Because we collect so little data, in many cases we may not hold information that identifies you.

10. Children

The Website is not directed to children under 16 (or the minimum age of digital consent in your jurisdiction), and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

11. Security

We use reasonable technical and organizational measures — including encryption in transit (HTTPS) and reputable, security-focused providers — to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. Material changes will be made prominent where appropriate.

13. Contact us

Questions or requests regarding this Privacy Policy can be sent to:

Aleo Labs Operations LLC
Email: privacy@aleolabs.io