Core Privacy Promise
Altheru is designed as a private digital sanctuary. We do not store your documents in a central cloud database, we do not track your activity across apps, and we do not sell your personal data. Your documents are encrypted locally on your iPhone or iPad.
1. Introduction
Technefide Labs ("we", "us", "our") develops and operates Altheru ("the App"). This Privacy Policy explains how information is collected, used, processed, and protected when you use our mobile application and related services.
We believe sensitive personal documents—such as passports, national IDs, health lab panels, and contracts—belong strictly under your control. Our architecture enforces data minimization and on-device processing by default.
2. Architecture & Data Storage
2.1 On-Device Storage and Encryption
All scanned documents, imported PDFs, extracted metadata, custom notes, holder profiles, reminders, and relation links are stored in your device's local application sandbox.
Files are encrypted using AES-GCM cryptography with encryption keys secured on your iOS device. We do not operate a remote file storage service for your documents. If you delete the app without an unencrypted manual export or device backup, your data is permanently removed.
2.2 On-Device Processing
The following operations are performed entirely on your device without transmitting data over the internet:
- On-Device OCR: Text recognition performed via Apple's native Vision framework.
- Vault Search: Full-text keyword and filter searches executed locally.
- Similar Document Matching: On-device 128-dimensional vector embeddings and cosine similarity scoring.
- Relationship Engine: Chronological renewal sequencing, entity matching, and individual holder linking.
- Local Notifications: Expiry and follow-up alert scheduling using the iOS UserNotifications framework.
3. Optional Cloud Features & AI Processing
Altheru provides optional cloud-assisted AI features to enhance metadata extraction and enable natural language vault queries.
3.1 Transient AI Metadata Extraction
When you explicitly trigger an AI scan or re-extraction on a document:
- The document image or PDF is transmitted over an encrypted HTTPS connection to our backend processing API.
- Our AI model parses key metadata (e.g., document type, title, issue date, expiration date, holder name, extracted fields, lab metrics).
- The parsed metadata is returned to your device and saved into your local database.
- Zero File Retention: The uploaded document payload is held only in ephemeral memory for the duration of the API call and is never saved to disk or stored in a persistent database on our servers.
3.2 Vault Query (Natural Language Q&A)
When you use the "Ask" feature to query your vault:
- Your question and relevant text excerpts from your documents are transmitted to our AI inference API to generate a summarized, cited answer.
- Neither your question nor your document excerpts are stored persistently or used to train foundation models.
4. Account & Authentication Information
Altheru supports two tiers of user access:
| Account Type | Data Collected | Purpose |
|---|---|---|
| Guest User (Default) | Anonymous User ID (UUID) | Enforces monthly free-tier AI extraction limits and manages guest session tokens. No name or email is collected. |
| Registered User (Optional) | Email Address, User ID | Manages account authentication (via Supabase), cross-device license entitlements, and API quota management. |
5. Device Permissions Requested
Altheru requests only the minimum iOS permissions necessary to deliver core features:
- Camera (`NSCameraUsageDescription`): Used exclusively to scan paper documents in real time. We do not access the camera in the background.
- Photo Library (`NSPhotoLibraryUsageDescription`): Used only when you select photos or document scans to import into your vault.
- Notifications: Used to schedule local alerts for upcoming document expiration dates and follow-ups. No push notification tracking server is used.
6. Third-Party Services & Subprocessors
We work with trusted infrastructure providers who adhere to strict data protection standards:
- Supabase: For secure authentication and user identity management (when registered).
- Amazon Web Services (AWS): For transient Bedrock LLM inference and API gateway infrastructure. Payloads are processed under enterprise data privacy terms with zero model training on customer data.
- Apple Inc.: For app distribution, in-app purchases, and native operating system services.
7. Your Rights (GDPR & CCPA / CPRA)
Depending on your location, you may have the following rights regarding your personal data:
- Right of Access & Portability: You can export all your decrypted documents and metadata at any time using the built-in iOS Share Sheet.
- Right to Erasure (Deletion): You can delete any document from your local vault immediately. If you have an email account, you can delete your account and associated server records in the app settings or by contacting us.
- Right to Rectification: You can manually edit any metadata field, date, holder name, or relationship directly within the app.
- Right to Non-Discrimination: We do not discriminate against users who exercise their privacy rights.
8. Children's Privacy
Altheru does not knowingly collect personal information directly from children under the age of 13 (or under 16 in certain jurisdictions). Parents and legal guardians may store family documents (such as birth certificates or immunization records) under designated holder profiles for household management.
9. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect enhancements in our app or regulatory changes. When updates occur, the "Effective Date" at the top will be updated. We encourage you to review this page periodically.
10. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your data privacy, please contact us at:
Support & Inquiries
Email: contactus@convokraft.ai
Website: https://convokraft.ai/