Privacy Policy

Scope

This Privacy Policy applies to the Alloy Command website, including alloycommand.com, and the Alloy Command mobile application.

What Alloy Command collects

Alloy Command may collect account information you provide, authentication and session data, questions or prompts you submit, model responses and synthesis results, product settings and notification preferences, and limited technical and security data needed to operate and protect the service. If you volunteer for an Android closed test, Alloy Command may also collect the Google Play email and optional name you submit, tester check-ins, and testing feedback or bug reports. In the mobile app, optional features may also provide Alloy Command with dictated text produced from microphone input and attachment metadata such as a selected file name.

How information is used

Information is used to provide Alloy Command, authenticate users, generate and synthesize AI responses, maintain service reliability, prevent abuse, improve the product experience, and coordinate volunteer closed testing for the Android release when you choose to participate.

Mobile features and permissions

Microphone access is used only when you choose dictation or another voice feature. The current Android dictation flow converts speech to text and Alloy Command receives the resulting transcript as input; Alloy Command does not intentionally upload raw microphone audio to its backend as part of that dictation flow. Notification permissions, when enabled, are used to deliver product or task-related alerts. Attachment controls may expose limited file metadata to the app when you choose a file.

Campaign link tracking

Some links to Alloy Command carry campaign tags describing their source, medium, and campaign. Before you accept campaign tracking, these tags are held only in memory and are not saved or submitted with signup. If you accept, we save them in this browser's local storage. Saved tags expire after 30 days and are removed the next time you load the site after expiry. If you create an account with accepted tags, they are linked to your account to help us understand which outreach brings people to Alloy Command. Use Privacy choices above to decline or withdraw at any time. This clears saved browser tags and stops future campaign attribution in this browser. We remember your choice without changing your sign-in or other preferences. Withdrawal does not remove tags already linked to an account; contact support to request their removal. Account-linked tags are not subject to the browser's 30-day expiry. We use campaign tags only for marketing attribution.

Sale of personal information

Alloy Command does not sell your personal information.

Service providers

We use third-party services to operate Alloy Command. These include Floot for hosting, data storage, email delivery, and website usage analytics, and PayPal for payment processing. When usage analytics are allowed, Floot can receive pages visited, referring pages, browser information, language, an approximate country inferred from your time zone, and a random session identifier. We configure that identifier to stay in memory rather than browser storage, and remove old saved analytics session identifiers. Analytics still sends usage information; memory-only does not mean no information is sent. You can turn usage analytics off separately in Privacy choices above. We retain your analytics choice in browser storage and honor existing opt-outs. Essential authentication and preference storage is separate.

AI providers

Alloy does not add your account profile name, email address, or phone number to question-answer prompts. It sends your question and relevant conversation context, which may include earlier messages, saved answers, or attachments you provide. Personal details you include in that content may also be sent.

When you use AI features, we send your request and relevant context to the providers involved in producing the response. Depending on the feature, this may include prompts, saved conversation history, previous model responses, attachments, or text for voice output. Providers include OpenAI, Anthropic/Claude, Google/Gemini, and xAI/Grok, with Floot facilitating some requests and fal.ai processing video and voice requests. Their handling of submitted data is also governed by their applicable terms and privacy practices.

Retention and account deletion

In the Alloy Command Android app, deleting your account from Settings removes the account and associated Android app data linked to that account, including the profile, password record, active sessions, settings, credits, projects, Companion messages, synthesis history, and mobile media-job records. Some operational records on other Alloy Command services may not be linked to a specific user account and may remain after deletion when needed for service integrity, troubleshooting, security, fraud prevention, or legal obligations.

To prevent repeated welcome rewards, Alloy retains a hashed email claim and the total welcome credits awarded after account deletion. Common email aliases share this claim. Verification tokens expire after 30 minutes.

Security

Alloy Command uses reasonable technical and organizational measures intended to protect account and service data. No internet service can guarantee absolute security.

Your choices

You can adjust available privacy-related settings in Alloy Command. The mobile app includes a Privacy Policy link and an in-app Delete account control in Settings. Additional privacy requests can be handled through the support method made available with the service.

Changes

This policy may be updated as Alloy Command evolves. Material changes should be reflected by an updated effective date.