Privacy Policy
what we keep, and why.

• Account: your name, email address and avatar from Google, GitHub or Apple, and that provider’s account ID (and your GitHub username if you use GitHub). No passwords.
• Alerts: the app name, title, body, topic, priority and answer buttons your agents send, your replies, who answered, and when each alert was sent, read, answered or timed out.
• Devices: device name (for example your phone’s make and model), platform, app version, push token and when it was last seen, so we can deliver alerts.
• Teams: the email addresses you invite to a workspace, their role and whether they have accepted.
• Settings: your quiet hours, sound and digest preferences.
• Billing (paid plans): handled by our payment processor; we keep only the last four card digits and billing country.

Everything between the apps, your agents and our servers travels over HTTPS. Alert titles, bodies and replies are encrypted at rest in our database with AES-256-GCM, so database copies and backups are unreadable without our key.

This is server-side encryption, not end-to-end encryption: our servers hold the key and decrypt alerts to deliver them, show them in the dashboard and pass your replies back to your agents. Push notifications include the alert’s title and body so your phone can show them.

API keys are stored only as hashes.

• to sign you in and deliver alerts to your devices,
• to show your alerts and team in the apps and dashboard,
• to enforce rate limits and stop abuse,
• to bill paid plans,
• to email you about your account, workspace invitations, security issues and changes to these policies.

We do not sell your data, show ads, or use your data to train AI models.

Members of a team workspace see that workspace’s alerts and each other’s replies, names and email addresses. Nothing in your personal workspace is visible to anyone else.

Otherwise, only the processors needed to run the service: our hosting provider, Google Firebase Cloud Messaging and Apple Push Notification service (which carry each notification’s title and body to your devices), our email provider, and our payment processor. We disclose data to authorities only when legally required, and we will tell you unless we are forbidden to.

Alerts are kept until you delete them, delete the workspace they belong to, or delete your account. A device is kept until you remove it or delete your account. When you delete your account, we delete it immediately along with your devices, the workspaces you own and every alert in them; copies in backups are erased within 30 days. We keep billing records only as long as tax law requires.

You can export your data from the dashboard’s Settings, delete individual alerts and devices in the apps, and delete your account from Settings in any app or the dashboard (steps at alertmcp.com/delete-account). Depending on where you live (for example under the GDPR or CCPA), you can also ask us to access, correct or restrict your data, or object to how we use it.

Email legal@alertmcp.com and we will reply within 30 days.