Privacy Notice

1. Controller and scope

Kurt Donaldo Contreras Díaz, an individual located at Sur 136 núm. 116, Torre Sur, consultorio 49, Colonia Las Américas, Alcaldía Álvaro Obregón, C.P. 01120, Ciudad de México, México, is the controller. Alyrea is the product name, not a separate legal entity. Privacy/ARCO contact: [email protected]. Support: [email protected].

This notice covers the app, website, beta and Pro-interest lists, optional analytics and voluntarily submitted diagnostics. The free App Store release stores budgets on your device. Ori and remote sync are Pro features in development, available only in internal builds. The sections describing them apply only when those features are available and you choose to use them.

2. Data that normally stays on your device

In default local mode, income, expenses, concepts, budgets, categories, goals, funds, rules, payment methods, household names, history and preferences are stored on your device. The controller does not receive them while they remain local. System backups may retain app data under Apple or Google settings. Alyrea’s current SQLite configuration does not enable its own database encryption.

3. Data we can receive

Beta and Pro forms

Email, language, testing platform, Pro feature preferences, optional short answer, adult-eligibility confirmation and its timestamp, random session ID, limited funnel events and timestamps. We do not request a date of birth.

Opt-in analytics

Random installation/session IDs, platform/build, allowlisted event names and limited action sources—never amounts, concepts, names, balances, notes, Ori text or household content.

Voluntary diagnostics

Support ID, app/device metadata, issue area, sanitized errors/stacks, limited technical context and timestamps.

Optional remote mode

The server you configure receives the complete household state required to store and sync it, including financial and household data. Alyrea does not automatically host or control that server merely because you use the app.

Ori with an outside provider

The selected OpenAI, Gemini, Anthropic or compatible endpoint receives your question, recent conversation, system instructions and bounded local financial tool results needed to answer.

Optional public grounding

DuckDuckGo receives a sanitized public query; private household data is prohibited from that query by design.

4. Purposes and choices

Primary purposes are operating beta/Pro notifications, support, diagnostics you send, optional remote storage and the Ori provider you request. Secondary purposes are pseudonymous product and interest analytics. App analytics are off until you opt in and can be disabled in Settings. To opt out of beta/Pro messages or exercise privacy rights, contact the privacy address above.

5. Providers and international processing

Cloudflare hosts the Alyrea-operated site, forms, telemetry and diagnostics. A remote server configured by you is governed by its operator and your configuration; Alyrea does not automatically host it. Apple provides App Store and system integrations. A provider you configure for Ori receives the content described above. DuckDuckGo receives public grounding queries. Processing may occur outside Mexico. Alyrea does not sell data or share it with ad networks or data brokers.

Cloudflare describes its privacy practices at https://www.cloudflare.com/privacypolicy/ and its data-processing terms at https://www.cloudflare.com/cloudflare-customer-dpa/. We will update this notice before publicly enabling Pro features that add providers or change data flows.

6. Retention and deletion

Alyrea runs daily automated deletion tasks for the forms, website events and uploaded diagnostics it hosts. A valid request may cause earlier deletion.

• The local analytics queue keeps at most 200 events and removes events older than 30 days; disabling analytics clears it.
• Local diagnostics are capped at 500 events and 14 days and can be cleared in Settings.
• Local budget data remains until you delete app storage or uninstall, subject to system backups.
• Beta and Pro-interest form records are retained for up to 12 months after the latest signup submission or record update.
• Alyrea-operated website events and uploaded diagnostics are retained for up to 90 days.
• Workers Analytics Engine retains received product analytics for three months.
• Support and privacy correspondence is retained for up to 12 months after resolution, unless a legal obligation or dispute requires longer retention.
• A remote copy remains according to the server you configured; uninstalling Alyrea does not delete it. External providers apply their own retention rules.

7. Privacy rights

You may request access, correction, cancellation/deletion or objection, withdraw optional consent, or stop beta/Pro communications at [email protected]. Include your name, response channel, proof of identity/authority, the right requested, a clear description of the data and supporting documents. We will communicate a decision within 20 business days after receiving a complete request and, if approved, act within the following 15 business days. Each period may be extended once where legally justified. Exercising these rights is free except for legally permitted reproduction or delivery costs. Alyrea cannot retrieve data it never received because it exists only on your device.

8. Storage and automatic technologies

The site uses sessionStorage identifiers rather than advertising cookies. Cloudflare processes normal request metadata to deliver and protect the site. The app uses local storage, a local database and native secure storage for mirrored credentials. No advertising identifier or cross-app/site tracking was found.

9. Security

Alyrea uses reasonable safeguards including minimization, allowlists, diagnostic sanitization, request limits and native secure credential storage. No system is infallible, and we do not claim all storage is encrypted or impossible to access.

10. Changes and contact

The current notice will remain at https://alyrea.app/privacy/. Material changes will be announced on the site and, where appropriate, in the app before new processing begins. Privacy: [email protected]. Support: [email protected]. Effective date: 2026-09-11.

11. Simplified notice for web forms

Kurt Donaldo Contreras Díaz, at Sur 136 núm. 116, Torre Sur, consultorio 49, Colonia Las Américas, Alcaldía Álvaro Obregón, C.P. 01120, Ciudad de México, México, controls data submitted through Alyrea forms. We use email, language, testing platform, Pro feature preferences, an optional answer, adult-eligibility confirmation and its timestamp, a random session ID and limited flow events to manage beta invitations, verify eligibility, notify you about Pro and measure interest. We do not request a date of birth. Limit secondary uses or messages at [email protected]; read the full notice at https://alyrea.app/privacy/.