privacy
Privacy
Last updated: 30 September 2026 · plain-language v1
The short version: the open-source CLI runs entirely on your machine: raw conversations and embeddings never leave it. Alluvia Cloud is opt-in and syncs onlydistilled notes, never your raw history. We never sell your data and never use it to train any model.
Two products, two data stories
The Alluvia CLI (open source, local-first). Everything happens on your machine. Raw conversations and the embeddings computed from them stay in a local database and never leave. The only network calls are the distillation/labelling requests you configure, and those go toyour LLM provider under your API key, secret-scrubbed first. The CLI sends us no telemetry.
Alluvia Cloud (opt-in, hosted). If you choose to connect Cloud, we sync thedistilled notes (themes, connections, decisions, verified answers) so your team can share recall, not your raw conversation history. This data is stored securely and scoped to your team / organization. Only members of your team can see it.
What we store for Cloud
- Account: your email, name, and team membership (authentication is handled by WorkOS).
- Team memory: the distilled notes you sync, plus the decisions and verified answers your team creates.
- Waitlist: if you join the early-access list, the email and details you provide (team size, tools, role, and an optional note), used only to contact you about early access.
Who we share it with
We don't sell your data. We use a small set of sub-processors to run the service: WorkOS(authentication), our cloud hosting and database providers, and the LLM provider you choose (accessed under your own key). Your chosen LLM provider's terms apply to the requests you send it.
What we never do
We never sell your data, never use it to train a shared model, and never expose your team's memory to anyone outside your team.
Analytics
The marketing site uses PostHog for page views and interactions such as playing the demo, copying an installation command, or opening the guide. These interaction events contain fixed action labels, not your clipboard contents, code, or test results. PostHog also provides session replays with all form inputs masked. We skip PostHog collection when your browser sends Do-Not-Track or Global Privacy Control. Vercel Speed Insights measures page performance. The CLI sends us no telemetry; website activity does not tell us whether you installed Alluvia or ran a successful check.
Your choices
You can access, export, or delete your data at any time; emailhello@alluvia.dev and we'll take care of it. Deleting your team removes its synced memory.
Changes & contact
This is a plain-language v1 written for an early-access product; we'll formalize it before general availability, and we'll note material changes here. Questions: hello@alluvia.dev.