Aleph — Privacy Policy
Effective date: 2026-11-03 Version: 1.0
This policy explains what Northlane Studio ("Northlane Studio", "we") does with personal data when you use Aleph and the Northlane Studio account from it.
We are the data controller for that data. Contact: [email protected].
The short version
- Your files never leave your computer. Aleph indexes the names, folders, types, sizes and dates of the files in the folders you choose, and keeps that index on your computer. We cannot see it.
- The app works without an account. Without signing in, Aleph only checks for updates and — unless you turn them off — sends anonymous usage stats and error reports.
- We do not sell your data, we do not run ads, we do not track you across the web, and we do not train any model on your files.
- Error reports and usage stats are anonymous and each has its own switch in Settings → Help.
1. What we collect, and why
1.1 If you never sign in
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Update check: app version, OS, architecture, IP address | To tell you a new version exists and serve the right installer | Legitimate interest (delivering a working, secure product) | IP in server logs, 30 days |
| Anonymous usage stats (on by default; Settings → Help → Anonymous usage stats turns them off): a random install ID created by the app, the app version, platform and language, once a day | To know how many people use Aleph | Legitimate interest | Daily activity 400 days; the install record until it has not been seen for 400 days |
| Error reports (on by default; Settings → Help → Send error reports turns them off): the error message and where in the app it happened, with paths containing your user name and any email addresses removed, plus the app version and OS | To find and fix bugs | Legitimate interest (keeping the app working) | Until the bug is fixed, and at most 12 months after it was last seen |
Everything else — the folders you chose, the file index, your search history and your settings — stays on your computer, in Aleph's data folder.
1.2 If you sign in
Aleph uses your Northlane Studio account, the same one as the other Northlane Studio apps. The account data (email, display name, username, picture, hashed password, two-step verification, sessions) is described in the account section of the Solaris Privacy Policy at https://northlanestudio.dev/legal/privacy.html and is handled the same way. Specific to Aleph:
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| A session for Aleph: a hashed token, device name, OS, app version, IP address, first and last use | Keep you signed in; let you close Aleph's session on its own | Contract + legitimate interest (security) | Until you sign out, or 180 days idle |
| Your appearance choice (theme and colours), with the device name that last changed it | Keep the same look across the Northlane Studio apps | Contract | While the account exists |
| Problem reports you send with Report a problem: what you write, the email to answer you, and the app version and OS | Fix the problem and answer you | Contract + legitimate interest | 3 years |
If Solaris is signed in on the same computer, Aleph reads that local sign-in to start its own session without asking for your password again. Nothing is sent other than the request for that new session.
2. Who else sees it
We use a small number of processors, each bound by a contract to use the data only to give us the service:
| Who | What for | Where |
|---|---|---|
| DigitalOcean, LLC | Runs the server and the database | New York, United States |
| Brevo (Sendinblue SAS) | Sends account emails and answers to your reports | the European Union (France) |
| Cloudflare, Inc. | Serves and protects the website and the update downloads | Global edge network |
Apart from those, we disclose personal data only when the law makes us, or to defend a legal claim. We never sell it and we never rent it.
3. Data leaving your country
Our servers are in New York, United States. If you are in the European Economic Area, the United Kingdom or Switzerland, that is an international transfer, and we rely on the European Commission Standard Contractual Clauses with each provider. A copy is available on request at [email protected].
4. How we protect it
HTTPS everywhere; passwords hashed with scrypt and a per-user salt; session tokens stored hashed; optional two-step verification; rate-limited sign-in. No system is perfectly secure. If a breach affects your data and creates a real risk to you, we will notify you and the competent authority within the deadlines the law sets (72 hours to the authority under the GDPR).
5. Your rights
Wherever you live, you can ask us to access, correct, delete or export the data we hold about you, to restrict or object to a particular use, and to withdraw consent where consent is what we relied on. You can also export your account data from the app.
Write to [email protected]. We answer within 30 days, free of charge. We may ask you to prove you are the account holder.
- Mexico: you can also complain to the competent data protection authority.
- European Union / EEA / UK: you can complain to your national data protection authority.
- California: we do not sell or share personal information as those terms are defined by the CCPA/CPRA.
6. Children
Aleph is not for children under 16. We do not knowingly collect their data. If you believe a child gave us data, write to [email protected] and we will delete it.
7. Automated decisions
We make none, and we do not profile you.
8. Changes
We will post any new version at https://northlanestudio.dev/legal/aleph/privacy.html with a new date. For a material change we will tell you in the app or by email at least 30 days before it applies.
9. Contact
Northlane Studio
Privacy: [email protected] We are not required to appoint a Data Protection Officer; privacy questions go to the address above.