Privacy Policy

1. Introduction

2. Information We Collect

2.1 Account information

When you register, you give a name, an email address and a password. Sign-up and sign-in are handled by Neon Auth, a managed authentication service operated by Neon, so your email and password live in Neon's managed database rather than in the tables AlignSynch owns, and AlignSynch never stores your password itself. The profile the app keeps is deliberately small: a public handle, a display name, an optional one-paragraph bio, and an optional country — and nothing else.

2.2 Onboarding questions

The sign-up form asks for a phone number and a date of birth. In the current build, only your name, email and password are transmitted anywhere: those two fields are not sent to any server and are not stored by us.

2.3 Assessment content

When an assessment is started, we store the two people's names, the invited person's email address (and the starter's, when they are signed in), the template used, and each person's answers — for every question, a score from 1 to 5 for how it feels now and a score from 1 to 5 for how they wish it to be, plus in Advanced Mode what each thinks the other answered and what they would guess. The Gap is calculated from these scores when a report is shown; it is never stored as its own value.

2.4 Usage data

AlignSynch does not integrate third-party analytics, advertising or tracking SDKs, and the application sends no telemetry about you to anyone. Our hosting provider, Vercel, serves the application and may keep standard web-server logs (such as IP address and browser type), as hosting providers do. The application's own logs record only operational events — for example, whether an email send was refused, as an HTTP status code — and never the content of a message, a link it contains, or a recipient's address.

2.5 Information from third parties

Neon Auth gives us your user id, your email address and the name you chose at sign-up, so the application can associate you with your profile and your assessments.

2.6 What we do not collect

The Service does not process payments, so we never collect payment card numbers, billing details or anything a payment provider would hold.

3. How We Use Your Information

To run the Service

Creating and claiming assessments, keeping each person's answers hidden until both have submitted, computing the Gap, and sending the two messages the Service sends: the invitation email, and the notice that answers are complete.

To support and protect the Service

Answering your requests, guarding against abuse, and protecting the security of the Service.

To meet legal obligations

Complying with applicable law, and defending our rights.

We do not send marketing email

The only messages the Service sends are the two transactional ones above, and only when a deployment has a mail provider configured. There is no newsletter, no product announcements list, and no advertising.

4. Data Storage and Security

4.1 Where your data lives

Assessments, invitations, profiles and answers are stored in a PostgreSQL database operated by Neon, in Neon's us-east-2 (AWS) region. Accounts, passwords and sessions live in Neon's managed authentication database. The application itself is hosted by Vercel.

4.2 What we do to protect it

The Service is served over HTTPS. Database connections are made over TLS. Invitation and access tokens are stored only as SHA-256 hashes — the raw tokens are never written to the database — and token comparisons are performed in constant time. Credentials such as database connection strings and mail-provider keys exist only on the server and are never sent to browsers.

4.3 What we do not claim

AlignSynch is a prototype. We have not completed a formal security audit, we do not hold a SOC 2 report or any comparable certification, and this draft makes no claim that we do. (A marketing page inherited from the template skin makes broader claims; this policy, not that page, is the accurate statement.)

4.4 If a breach happens

If a breach affects your personal information, we will notify you through the contact details we hold about you, as and to the extent required by applicable law.

5. Third-Party Services

Neon (PostgreSQL database and Neon Auth)

Stores assessment data, profiles, invitations and answers, and manages accounts and sessions. Receives the information described in Sections 2.1 and 2.3.

Vercel (hosting)

Hosts and serves the application, and may keep standard web-server logs as described in Section 2.4.

Resend (transactional email, when configured)

Sends the invitation email and the completion notice on deployments where a mail provider is configured. Receives the recipient's address and the message text.

6. How Information Is Shared

With the other person in your assessment

This is the point of the Service: once both people have submitted, your answers are shown to the other person and theirs to you. Before both have submitted, neither person can see the other's answers — this blindness is enforced in how the database is read, not just on screen.

With service providers

With the providers listed in Section 5, strictly as needed to provide the Service.

For legal compliance

When required by law, subpoena or court order.

During business transfers

In connection with a merger, acquisition or asset sale; your information would remain subject to this policy, and you will be notified.

7. Retention

Invitations

An invitation expires 7 days after it is created, after which its link stops working. The browser cookies that let each person answer expire within the same period.

Assessments and answers

Assessments and their answers are kept for as long as the Service operates. Once both people have submitted, the answers are frozen by design and cannot be edited; a person may resubmit their own answers only before the assessment is complete.

Deletion

There is no automated deletion in the current build. You may request deletion of your account and its data by writing to alignsynch@riolabs.ai; requests are handled manually and answered within a reasonable time.

8. Your Rights and Choices

Access, correction and deletion

You may ask us for a copy of the personal information we hold about you, ask for corrections, or ask that we delete it, by writing to alignsynch@riolabs.ai. Self-service tools in the current build are limited, so email is the supported channel.

California residents

You have the right to know what personal information is collected about you, the right to request deletion of it, and the right to opt out of its sale — and we do not sell personal information, so there is nothing to opt out of. We do not discriminate against anyone who exercises these rights.

EEA and UK residents

Where the GDPR or UK GDPR applies to you, you also have rights to restrict processing, to data portability, to withdraw consent, and to lodge a complaint with a supervisory authority. AlignSynch has not appointed a Data Protection Officer, and this draft designates no EU or UK representative.

9. Cookies

Sign-in session cookies

Managed by our authentication provider (Neon Auth), these keep you signed in.

Assessment cookies

When you start or claim an assessment, the application sets cookies named flow_party_<instance-id> and flow_invite_<instance-id> that identify you as one of the two people answering. They are httpOnly (scripts cannot read them), sent only over HTTPS in production, and expire within 7 days.

What we do not set

AlignSynch sets no third-party tracking or advertising cookies and loads no analytics pixels or scripts. You can manage or block cookies in your browser settings, though blocking the cookies above will stop assessment links from working.

10. International Data Transfers

11. Children's Privacy

12. Changes to This Policy

13. Contact

Template attribution