Privacy policy

Updated 26 October 2026

Draft awaiting legal review. This text accurately describes how Allay works today, but it is not legal advice.

In short

• The Vault never reaches us. What you write in the Vault stays on your device, encrypted. We cannot read it, recover it or hand it to anyone.
• The Garden is anonymous and temporary. Posts expire and are permanently deleted; we never ask for your name, email or phone number.
• No ads, no profiling, no data selling, no analytics tools.

Data controller

Draft Apps — email: privacy@draftapps.it.

What data we process and why

Vault (on your device)

Texts, answers to the guided questions, review dates and outcomes are stored only in your browser (IndexedDB), encrypted with AES-256-GCM. The key stays on the device; if you set a code, the key is in turn protected by that code. We never receive this data.

If you use the QR code transfer, the content is encrypted on your device with a random key that exists only inside the QR code: it passes through our servers in unreadable form for at most 10 minutes and is deleted as soon as the other device receives it. The backup file is encrypted with the password you choose and never passes through our servers.

Anonymous device identity

On first use your device generates a random code, stored locally and in a technical cookie (allay_author). It lets Allay recognise your posts and replies without an account. On the server we only keep a cryptographic fingerprint (HMAC) of this code, never the code itself.

Garden

When you publish a post or a reply we store: the text, area, language, date, expiry, the fingerprint of your anonymous identity and a cryptographic fingerprint of your IP address (not the IP itself). Fingerprints are used to limit abuse and spam, handle reports and apply temporary blocks.

• Posts expire after the period you choose (at most 14 days) and are permanently deleted along with their replies, “me too” reactions and reports.
• You can delete your posts and replies at any time.
• Published content is visible to anyone visiting the Garden, but it is not indexed by search engines and is never used for communication, marketing or model training.

By publishing in the Garden you choose to make what you write public, anonymously: please don’t include anything that could identify you or other people. An automatic filter blocks emails, phone numbers and links.

Messages to the team

If you write to the team, we keep the text of the messages, the language, the dates and your anonymous identity fingerprint so we can reply. Conversations are deleted 90 days after the last message. You may include health information only if you wish to: by sending the message you consent to it being processed to answer your request.

Content that needs attention

If text published in the Garden or sent to the team contains signs of a possible risk to your safety, it is highlighted in the moderation console. The team may receive a notification that does not contain the text. In the Vault this check happens only on your device and is used solely to show you where to find help.

Reminders

If you turn on a notification, we store the technical push address provided by your browser, the reminder time and the link to the note (without any content). This data is deleted 7 days after sending. Notifications pass, encrypted, through your browser’s push service (e.g. Google, Apple, Mozilla).

Cookies

We only use technical cookies that are necessary for the service:

• allay_author — anonymous device identity (2 years);
• allay_lang — chosen language (1 year);
• allay_admin — staff only, console session.

We use no profiling cookies and no analytics tools, so there is no cookie banner.

Legal bases

• Performance of the service you request (Art. 6(1)(b) GDPR) for the Garden, messages and reminders.
• Legitimate interest (Art. 6(1)(f)) in keeping the service safe and preventing abuse through cryptographic fingerprints.
• For any health-related data: data you manifestly make public in the Garden (Art. 9(2)(e)) and explicit consent for messages to the team (Art. 9(2)(a)).

Where the data lives

The service is hosted on servers in the European Union. We do not transfer data outside the EU, except for the encrypted notification messages handled by browsers’ push services.

Your rights

You have the right to access, rectify, erase, restrict and object, and to lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali). Since we don’t collect identifying data, the quickest way to exercise them is through the app (deleting posts, replies and the Vault). For anything else write to privacy@draftapps.it.

Minimum age

Allay is intended for people aged 18 and over.

Changes

If we change this policy we will update the date above. Significant changes will be announced in the app.