Privacy Policy

What we collect — and what we deliberately don’t

We start with what we don’t collect, because it’s the more important half.

• We never receive your calendar event titles, descriptions, or attendee names.
• We never receive the plaintext phone numbers, email addresses, or names of the people in your contacts.
• We never see, store, or carry the messages you send. Aldis does not deliver messages (see “Aldis routes; it doesn’t deliver”).
• We don’t collect or track your real-time location.

What we do collect is deliberately narrow:

• Account basics — the email address you use to sign in.
• Hashed identifiers for the people you’ve added — scrambled, irreversible stand-ins that let Aldis route presence without knowing who anyone actually is (see “How Shutter works”).
• Availability aggregates computed on your device from a calendar you choose to connect — free/busy windows, a co-presence inference, and event counts only (see “Your calendar stays on your device”).
• Age-gate fields — your year of birth (a single number) and the date you confirmed it (see “Age verification”).
• Privacy-preserving analytics — only if you allow them, and never before (see “Analytics”).

How Shutter works

Shutter is the part of Aldis that runs on your device. Before any contact information leaves your phone, Shutter turns each phone number, email address, and name into a stable, salted hash — a fixed, scrambled identifier that cannot be reversed back into the original detail. Aldis’s routing intelligence operates entirely on these hashes. It never sees the plaintext phone number, email, or name behind them. The same person always produces the same hash, so routing stays consistent, but the underlying identity never reaches our servers.

Your calendar stays on your device

If you connect a calendar, Aldis never receives your event titles, descriptions, or attendee names. Those are read and normalized on your device into a few plain values:

• Availability windows — when you are free or busy, with no detail about why.
• A co-presence inference — a signal about whether you’re likely with someone you’ve already added, derived from hashed attendees, never names.
• Event counts — roughly how busy a stretch of time is.

Only those aggregates ever leave your device. The content of your calendar never does.

Health data on iPhone

If you allow it, the Aldis iPhone app reads two kinds of data from Apple Health: your workouts and your sleep analysis. It asks for read access only and never writes anything to Apple Health. The Aldis website does not use Health data.

Aldis uses this data for one purpose: to tell whether you are working out or asleep right now, as one of the signals it shows you about how available you are. That check runs on your iPhone. The app looks only at your most recent workout and your most recent sleep entry and reduces each one to a simple yes or no. The result is shown only to you, in the app. It does not change the status other people see; that changes only when you set it yourself.

• Your Health data, and the yes or no results the app works out from it, are not sent to Aldis servers.
• Health data is not shared with third parties, not used for advertising or marketing, and never sold.
• The app keeps a small log on your iPhone of which signals were active and when. It holds only yes or no values and times, no Health readings, and the app does not send it to Aldis.

You can change or remove this access at any time. On your iPhone, open Settings, go to Privacy & Security, then Health, then Aldis, and turn off the categories you no longer want to share. You can also do this in the Health app: tap your profile picture, then Apps, then Aldis. Aldis keeps working without Health access; it simply stops using those two signals.

Aldis routes; it doesn’t deliver

Aldis is a router, not a messenger. It never carries the body of a message, never holds a key that could unlock one, and never operates a relay or inbox. When you decide to reach out, you compose the message yourself and hand it to one of your own apps — iMessage, WhatsApp, Signal, SMS, or email — through the share sheet or a link. Because delivery happens entirely inside your existing apps, Aldis never sees who you contacted, when, or what you said.

Analytics

If you allow it, Aldis uses Google Analytics 4 (GA4) behind Google Consent Mode v2, which defaults to denied. It runs with a cookieless, consent-aware default, and no names, contact data, or relationship information are ever sent to it.

• No analytics request is sent before you grant consent. Nothing fires in the background first.
• Only the `analytics_storage` category is ever turned on. The advertising categories (`ad_storage`, `ad_user_data`, `ad_personalization`) stay denied at all times.
• IP anonymization is on, and query strings are stripped from the recorded page path, so no email address, account ID, or hashed-contact identifier is ever sent to GA4.
• The consent banner offers Accept and Reject with equal prominence — declining is exactly as easy as accepting — and declining analytics never reduces what Aldis does for you.

Age verification

We store only your year of birth (a single integer) and the date you confirmed it. We never store your full date of birth.

You tell us your country from a list, and we apply that country’s own minimum age for digital consent. We do not infer your location from your IP address.

• United States: 13 and over (COPPA).
• European Union: each member state’s own minimum, which is between 13 and 16.
• If your country is unknown, unlisted, or you’d rather not say, we fail safe to a minimum age of 16.

People under the applicable minimum can’t use Aldis. The form simply asks for your year of birth, with nothing pre-filled and no leading “are you over 13?” prompt. Because we keep only the year, your age is known to us only to within a year — that is a deliberate, disclosed trade-off in favor of collecting less.

Your rights — including deletion

Depending on where you live — for example, the EU/EEA under the GDPR, or California under the CCPA/CPRA — you have rights over your personal data, including the right to:

• access a copy of what we hold,
• correct information that’s inaccurate,
• delete your data, and
• withdraw consent you previously gave.

To exercise any of these, contact us at privacy@aldis.app. We aim to respond within the timeframes the law requires (under the GDPR, generally within one month; under the CCPA/CPRA, we acknowledge within 10 business days and respond within 45 days).

Retention & security

We keep your account data and the hashed identifiers for the people you’ve added for as long as your account is open, and we delete them when you close your account, except where we’re legally required to retain something. Contact identifiers are stored only as salted hashes; plaintext personal information never reaches our routing layer at all. Data is encrypted in transit and at rest. [Specific security certifications / posture — to be confirmed with counsel.]

A few structural protections are worth stating plainly:

• Your circles are yours alone. They are never combined with anyone else’s data, and Aldis does not share data between users to “improve” routing. Any future change to this would be a separate, clearly-consented choice.
• Closeness is private and asymmetric. The people you add never see which layer you’ve placed them in, and no layer is ever shown more than the layer above it.
• Your status is seen only inside Aldis, never through a link. Someone sees it only when they are signed in to Aldis and connected with you, and only at the detail your closeness to them allows. When you move someone, they see the new view the next time they open it. The only links Aldis shares are a single-use invitation and a link that opens the app; neither shows anything without signing in.

Changes & contact

We may update this policy as Aldis evolves. Each version carries a version string and an effective date, and when a change is material, we’ll ask you to re-acknowledge it before you continue. This is version v2-2026-09-23.

Questions, requests, or privacy concerns: privacy@aldis.app. Aldis is operated by Axle Radar LLC, a Delaware limited liability company.