Alpacto › Privacy policy
Privacy policy: your data stays under your control
Alpacto keeps only what it needs to run the agreements you make in the app. This page describes what the product actually does, not what a template says.
Who operates Alpacto
Alpacto is operated by IGOR SOLDATOV, an individual based in Argentina. Contact: support@alpacto.com.
What Alpacto is
Alpacto is an app for agreements between people who know each other: tasks, routines, challenges and friendly bets. It is not a social network, so there is no public feed, no people search and no open profiles.
Someone can add you only through a personal link or a code you gave them yourself, and every addition is confirmed by the other side.
The details of a pact are visible only to the two people in it.
What data we use
Password registration needs an email address. A new Google account needs a verified email; Apple can create an account without an email address. We keep only a protected hash of the password, never the password itself.
You can add a display name and an avatar if you want. Your time zone is used for deadlines and streaks.
Every account has an eight-character contact code, so that a person you gave it to can add you. You can change the code at any time.
You can also sign in with Google or Apple. They tell us the permanent ID of your account with them and, when supplied, your email address with its verification status. Apple may not supply an email address. On your first sign-in they also send your name; it becomes your display name, and you can change it.
We never see your Google or Apple password and get no access to your mail, contacts or files. We store the account ID, the name of the service and your email as of the day you linked it.
If your account already had a password and you had confirmed your email address with us, through a reset link or a code we sent, the first sign-in with Google or Apple keeps that password, and your other devices stay signed in.
If the address was never confirmed, that first sign-in removes the password and signs out every other device. Google or Apple has just confirmed that the address is yours, so we make sure nobody else can still get in with an old password.
We tell you on screen which of the two happened, and by email when the password was removed. You can set a new password later in the app settings or with “Forgot password”.
For Sign in with Apple we also store an Apple token, encrypted. We keep it only to revoke the link with Apple when you delete your account or unlink the sign-in. When you delete the account, it is removed from the sign-in identity, but a sealed copy remains in a cleanup job until revocation succeeds. Failure retains retryable work; after seven days operator intervention is required, not a guarantee of completed revocation.
The service stores the contacts, pacts, completion marks, rewards, coin balances and obligations you create, the chat messages you send in a pact, and the photos you attach: an avatar, a reward picture or a photo that proves a task is done. Photos are kept on our own server, not with a third-party storage service.
To keep sessions safe, we store a short device label such as “iPhone” and a one-way fingerprint of the IP address, not the address itself and not the full user agent. A session lasts up to 30 days, and its record is deleted 90 days after it expires or you sign out.
We keep an activity log: what happened (sign-up, sign-in, a pact created, a setting changed), when, from which platform and app version. If you came through someone’s invitation link, the log also records who invited you.
The log holds only the technical shape of an action: its kind, time, object type and object ID. Pact names, descriptions, people’s names and messages are not in it. The log helps us understand how the app is used and send reminders that make sense.
A log entry stays linked to you for no more than 90 days. After that the link to your account is removed automatically and permanently.
The entry keeps only the kind of action, the date, the platform and app version, and whether the person came through a link, a code or directly. It has no reference to you, to the object, to your installation or to the exact time.
If you report content in the app, we store the report: what it was about (a person, a pact, a message or a photo), the reason you picked, your comment if you left one, and a copy of the content as it was at that moment — the text of the message, the name and description of the pact, or the link to the photo. We keep the copy because content can be edited or deleted afterwards.
A report does not carry your email address and is not emailed anywhere. The person you reported is not told about it: no notification, no trace in the app.
App analytics
Our analytics is our own: events go only to our server. It runs on our fork of the open-source Rybbit, hosted by the same provider as the app itself. Analytics events are not sent to third-party analytics services or ad networks.
Crash reports are a separate matter and are described below.
The app sends events about things the server cannot see by itself. These are: the app was opened; the app failed to start (only the kind of error, not its text); which screens were opened (the screen template, without links or invite codes); onboarding steps; your answer to the notification prompt.
The app also reports whether you were offered a home screen widget and whether you added it.
Invitations add their own events: the screen was opened, a way to share was picked, a link was opened, a code was entered. The code itself is not sent.
A failed request to the server sends only the kind of error and the address template, without the request data. The server also sends the actions from the activity log described above, with the same technical details and no content.
Every event carries the environment (live or test), the app version and build, the platform (iOS, Android or web), the system version, language and region, the screen size, and an installation ID — a random number the app creates on first launch. It is not an advertising identifier and is not linked to other apps. Events from our own team and test accounts are marked as internal, so that they do not count in the statistics.
Your account appears in analytics under a pseudonym: instead of your account ID the server sends a cryptographic fingerprint of it, made with a separate secret key, from which the account cannot be recovered. Your name, email address, contact code, pact names and descriptions, rewards, contact labels and messages are never put into events; the list of allowed event fields is fixed in the app code. The analytics receiver uses the IP address of a request to infer its country, region, city and approximate coordinates. This is an IP-based area, not the GPS position of your phone. Our mobile analytics sites have raw IP storage disabled; the inferred area is kept with the analytics event and its pseudonymous identifier.
Where an install came from. To understand which channels bring people, the server records a click on our link: the source and campaign label, the platform and the time, without the IP address or user agent. It also records how the install found its source: a Google Play link, a pasted invitation, an Apple ads token or “found it in the store”.
If you came through an invitation, it records who invited you. On iPhone you paste the invitation link yourself with the “Paste” button, and a contact code is pasted the same way: the app reads the clipboard only when you press it.
If you installed the app from an Apple ad, the server sends Apple the attribution token to learn which campaign it was. The answer is the campaign, not who you are.
We use analytics to see where people get stuck — at which onboarding step they leave, which screens break, whether invitations arrive — and to fix it. There is no tracking across other companies’ apps and websites, so the app does not show the system “Allow tracking” prompt.
Events are kept on our analytics server under the pseudonym. When you delete your account, they are anonymized: the pseudonym is removed and the events stay only as counts that cannot be linked to you. The link between you and the source of your install, and between you and the person who invited you, is erased when your account is deleted.
Crash reports
If the app crashes, a crash report goes to Firebase Crashlytics, a Google service. The report says where in the code the crash happened and describes the device: the phone model, the system and app versions, the system language and region, free memory and storage, the time, and a random installation ID created by Crashlytics itself. We use the report only to find and fix the bug.
The report does not contain your name, email address, account ID, or the contents of your pacts, rewards and messages: the app does not pass any of that to Crashlytics, so a report is not linked to your account. Crashlytics also tells Google when the app starts a session, so that crashes can be counted against the number of sessions. Google keeps crash reports for 90 days.
Notifications and Live Activities
To deliver notifications, the server stores the push token of your device. On iPhone notifications, lock screen cards (Live Activities) and widget updates go through Apple Push Notification service; on Android notifications go through Google’s Firebase Cloud Messaging. Firebase also uses a Firebase Installation ID to address notification delivery to an app installation. This identifier and the push token are distinct from your Alpacto account ID.
A notification carries its text — for example, the name of the person and what happened in your pact — and a card on the lock screen shows the pact name and the other person’s name. Apple and Google deliver this text to your device. You can turn notifications and the lock screen details off in the app settings.
Purchases and subscriptions
Payments go through the App Store or Google Play. We never see your card or payment details. To know which plan you have, we store the plan, its period and end date, whether it was cancelled, the store transaction ID, the product and the store’s notifications about the purchase.
On iPhone the app passes your account ID to Apple with the purchase, so that the purchase is credited to the right account. On Android the server checks the purchase with Google Play. If you share a “Together” plan, we store who is in your circle, the invitations and the seats.
What we do not collect
We do not use GPS or collect your precise device location, address book, calendar, microphone, browsing history or advertising identifiers. The app asks for the camera and the photo library only when you attach a photo, and for Face ID only if you turn on the app lock; the Face ID check stays on your phone.
The app has no third-party ads, no third-party analytics and no cross-service tracking: the only analytics is our own, described above. The third-party components in the app are Firebase Crashlytics for crash reports, Firebase Cloud Messaging for notifications on Android, Google Sign-In for signing in with Google, and the App Store and Google Play purchase systems. Each is described above.
We do not sell personal data and do not pass it to ad networks.
What your contact sees
Your contact sees your display name, avatar, the pacts you share, rewards, completion marks, the balance and the obligations between you. Your email address is never shown to another user.
The local label you give a contact belongs only to you and is not shared with anyone.
Until you agree, the person who sent a request by code sees nothing: not your name, not your avatar, not even whether the code exists. The server answers the same way for someone else’s code, a code that does not exist and a code typed with a mistake.
You see the sender’s name and avatar and decide for yourself. The sender is not told about a refusal. A changed code stops working for good and is never given to anyone else.
Storage and recipients
Data is kept for as long as your account exists, on servers run by our hosting providers. Traffic to the app’s server and to the analytics server passes through Cloudflare, which protects them from attacks and sees the IP address of each request.
Emails are delivered through Resend.
Account emails are password reset, a code to confirm an email address you add to your account, and a notice that your password was set, changed or removed. We also send account deletion confirmation, a notice that your subscription or your place in a Together plan is ending, and a notice to an address that someone tried to add to a second account.
If you agreed at sign-up, Resend also delivers tips and news about the app.
The sending domain is protected with SPF, DKIM and DMARC.
Crash reports, without your name, email or account ID, are processed by Google (Firebase Crashlytics). Notifications are delivered by Apple and Google, as described above.
The analytics server is our own and runs with the same hosting provider; it is not a third-party service.
Customer messages. To send reminders, tips and news that fit what you do in the app, the server copies part of your account to our own messaging system, run by the same hosting provider. It gets your email address, display name, language, time zone, plan, push tokens, the answers you gave about tips and marketing messages, the pacts and contacts you have with their roles, and the activity log events described above.
It sends emails through Resend, notifications through Apple and Google, and messages to the inbox in the app. Tips and marketing come only if you agreed to them, and you can turn them off in the app settings.
We also keep a record of each message we sent you (channel, template, language and delivery status) for up to 400 days. We group people into segments to choose who gets which message, and in some campaigns we deliberately leave a small group out to measure whether the message helps. If you unsubscribe, we keep only a one-way fingerprint (hash) of your email address so that we do not write to you again.
Events in the messaging system are kept for up to 400 days. When you delete your account, erasure of your email address, name, devices and other personal fields is queued for our messaging system. The application source does not prove immediate completion in that system or at delivery providers.
We disclose data to public authorities only under a binding legal request in the applicable jurisdiction.
Deletion and your rights
You can correct your profile, freeze your account or delete it permanently. To get a copy of your data, write to support. Deletion erases your email address, password, name, avatar, contact code, sessions, devices, your notifications and your Google or Apple sign-in.
What you shared with another person does not vanish from their side: pacts, completion marks, rewards, balances, obligations and chat messages between the two of you stay with them. Your profile name is removed, but the contact label they created and name snapshots in earlier notifications may remain until those records are cleared. When both people in a contact have deleted their accounts, everything between them is erased.
The deleted account retains its internal ID, status and dates, terms acceptance, locale and former email-verification timestamp. Tips and marketing consent history stays linked to that record; its retention period has not been separately established. This is not a guarantee that all remaining records are unlinkable to the former account.
The installation ID is stored on the device. Signing out or deleting the account clears the analytics account association but does not change that ID in the inspected client; uninstall reset behavior is not separately verified.
Store transaction IDs are erased with the account. The record of your plan (which plan and its dates) stays with the deleted account, without your name or email. If you had a seat in someone’s Together plan, the seat is freed and only the date you left is kept.
A request through the web deletion form is confirmed by email and carried out within 30 days at most. In the app, deletion is self-service: the server removes personal profile fields and sessions after confirmation. File deletion and Apple token revocation are separate retryable cleanup jobs. An unfinished job requires operator intervention after seven days; that is not proof of completed deletion. External copies and backups require separate verification.
App analytics events are anonymized in the same way when you delete your account: the pseudonym is removed from them, and the record of where your install came from and who invited you is erased.
Activity log entries are not deleted when an account is deleted. They are anonymized: the link between the entry and you is removed permanently. The entry keeps no reference to you, to the object, to the person who invited you or to the exact time.
Only the kind of action, the date, the platform, the app version and the way the person came remain. This is the same method and the same result as when the retention period runs out. Personal data is deleted; anonymous statistics remain.
A report and its copy of the content are kept for 90 days — the same period as log entries — and then deleted. Deleting an account removes the report sooner, and this works both ways: if the person who sent the report leaves, their words go with them; if the person it was about leaves, the copy of their messages and everything written about them goes too.
Age and contact
Alpacto is for people aged 13 and over. We do not create accounts for children under 13 and do not knowingly collect their data.
Questions about your data: support@alpacto.com. Material changes to this policy will be published here and announced in the app. See also the terms of use and the support page.