Privacy Policy

1. Who we are

Alpha Grit ("we", "us", "the platform") is a private community platform. We act as the data controller for personal data you provide when registering and using the service. For LGPD purposes, our DPO contact is privacy@alphagrit.community.

2. What we collect

• Account data — email, display name, password (hashed by Supabase Auth, never stored in plain text).
• Profile data — XP, streak, level, badges, subscription status. Used for gamification and member features.
• Content you create — comments, task completions, AI summary requests.
• Usage analytics — anonymous page-view counts and performance metrics (via Vercel Analytics). No cross-site tracking, no IP storage.
• Operational logs — rate-limit counters and API request logs for abuse prevention. Retained 30 days.

3. What we do not collect

• We do not use third-party advertising trackers.
• We do not sell, rent, or trade your personal data.
• We do not require government ID, phone number, or address.
• We do not store payment card numbers — Stripe handles all payments under PCI-DSS compliance.

4. Legal bases (LGPD / GDPR)

• Contract performance — providing the service you signed up for (Art. 7, V of LGPD; Art. 6(1)(b) GDPR).
• Legitimate interest — security, abuse prevention, service improvement (Art. 7, IX LGPD; Art. 6(1)(f) GDPR).
• Consent — for optional features like marketing emails (revocable at any time).
• Legal obligation — when required to retain data by Brazilian or applicable law.

5. Your rights

Under LGPD (Art. 18) and GDPR you can:

• Confirm whether we process your data.
• Access a copy of your data.
• Correct incomplete, inaccurate, or outdated data.
• Request deletion (right to be forgotten), except where retention is required by law.
• Withdraw consent for optional processing.
• Port your data to another service (machine-readable format).
• Lodge a complaint with the ANPD (Brazil) or your local supervisory authority.

Request any of these by emailing privacy@alphagrit.community. We respond within 15 business days.

6. Data retention

Active account data is retained while your account exists. After account deletion, we retain anonymized aggregate metrics indefinitely (e.g., total community XP) but delete identifying data within 30 days, except for records we must keep for legal compliance (tax, dispute resolution).

7. Sub-processors

• Supabase (database, auth, storage) — hosted in São Paulo, Brazil.
• Vercel (hosting + analytics) — global edge network.
• OpenAI (AI summary generation, content rewriting) — content sent without your account identifiers.
• NewsAPI (third-party news source ingestion) — no user data is shared.
• Stripe (payments) — processes subscriptions under their own privacy terms.
• Resend (transactional email) — your email address is shared to deliver platform messages.

8. International transfers

Some sub-processors store data outside Brazil. We rely on Standard Contractual Clauses or the LGPD's adequacy/legitimate-purpose provisions (Art. 33). By using the service, you acknowledge this transfer.

9. Security

Data is encrypted in transit (TLS 1.3) and at rest. Row-Level Security policies in our database mean even a compromised account can only see its own data. We monitor for abuse and rate-limit sensitive endpoints. No system is 100% secure — we'll notify affected users within 72 hours of confirming a material breach.

10. Cookies

We use a single session cookie (Supabase auth) and a local-storage preference for the cookie banner. We do not use cross-site tracking cookies. Vercel Analytics is cookieless.

11. Children

The platform is for adults (18+). We do not knowingly collect data from minors. If you believe a minor registered, contact us and we'll delete the account.

12. Changes to this policy

We may update this policy as the platform evolves. Material changes will be announced in-app and via email at least 15 days before they take effect.

13. Contact

Data protection: privacy@alphagrit.community
General: command@alphagrit.community