Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Name

Anton Nazarchuk

Address

Welserstraße 3 87463 Dietmannsried Deutschland

E-mail

alterplatform@gmail.com

For any question about data protection or to exercise your rights, an e-mail to alterplatform@gmail.com is enough.

2. Overview

Alter Platform is a platform where people find collaborators, start projects and work on them together. To do this we process the data you provide yourself (account, profile, projects, messages) and the technical data that necessarily arises when running an online service.

• No advertising, no sale of data, no disclosure for advertising purposes.
• No analytics, tracking or advertising cookies, and no embedded third-party content that sends data to third parties when a page loads.
• Recommendations and compatibility scores are calculated using fixed rules; they do not trigger decisions with legal effect.
• AI features run only when you or a member of your project explicitly starts them (section 10).

3. Visiting the website, hosting and server logs

When you visit Alter Platform, our servers and our hosting provider process the connection data technically needed to deliver it: IP address, time, requested address, amount of data transferred, and browser and operating system details (user agent).

Hosting provider: Render Services, Inc. (USA), Frankfurt (EU). It processes the data on our behalf (Art. 28 GDPR).

Our application itself writes no access logs containing IP addresses. To protect against abuse it briefly counts requests per IP address in memory (at most one hour, then discarded). The server writes technical error messages to its error log at the hosting provider. How long the hosting provider keeps access logs: 7 days.

Purpose: delivering the website, stability and security (e.g. defending against attacks and password guessing). Legal basis: Art. 6(1)(b) GDPR insofar as this is needed to provide the service you use, otherwise Art. 6(1)(f) GDPR (legitimate interest in secure operation).

4. Account and sign-in

For an account we process: e-mail address, password (stored only as a bcrypt hash, never in plain text), chosen language, account role and status, time of registration, the version of the terms of use you accepted and when, and when you confirmed the minimum age.

Each sign-in creates a session (time, expiry, sign-out, sign-in method). We do not store IP addresses or device identifiers for it. A session expires after 7 days; signing out invalidates it immediately. We delete ended sessions after 30 days.

Purpose: providing your account and protecting it against unauthorised access. Legal basis: Art. 6(1)(b) GDPR (contract of use). We additionally keep the record of which version of the terms of use you accepted on the basis of Art. 6(1)(f) GDPR (proof of the conclusion of the contract).

Retention: until your account is deleted.

5. Sign-in with Google

Instead of a password you can sign in with your Google account. You are then redirected to Google, where Google's privacy policy applies; for users in the EEA this is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also transfer data to Google LLC in the USA.

We request only the permissions "openid", "email" and "profile" and receive: your Google account identifier, your e-mail address, whether Google has verified it, and your name (we suggest it in your questionnaire). We do not receive your Google password, your contacts or any other Google data.

During sign-in our server sets a short-lived security cookie ("alter_google_oauth", at most 10 minutes) so that nobody can forge the sign-in. Signing in with Google is optional.

Legal basis: Art. 6(1)(b) GDPR. Retention: the Google account identifier until your account is deleted.

6. Profile and questionnaire

In the questionnaire and your profile you state what others should know about you so that suitable people and projects can find each other. Depending on what you enter, this includes: name, profile photo, age, country and city, profession and occupation, work experience, education, languages, skills with level, interests, goals, desired roles, available hours and times, time zone (as a UTC offset, never an address), work formats, motivation, project experience, your own project idea, and texts such as "About me", "What I offer" and "What I'm looking for".

Some questionnaire answers are required (e.g. your name and whether you want to build a team or join one); without them we cannot show you meaningful recommendations. Everything else is optional.

Visibility: Your profile is public – it can also be opened at its address by visitors without an account. It shows your age, country and city if you provide them; you can hide country and city in the settings. Your e-mail address, sessions and settings are never public. Where you appear within other content (project teams, chats, friend lists, invitations) we show only your name, photo and professional details, not your age or where you live.

We store your profile photo ourselves. It is not loaded from third-party servers.

Please do not enter special categories of personal data (e.g. health, religious or political beliefs, sexual orientation). We do not ask for them and do not need them.

Legal basis: Art. 6(1)(b) GDPR – showing your profile is the core of the service you use. Retention: until you change the information or delete your account.

7. Recommendations and compatibility (profiling)

Alter Platform suggests people to you and shows a compatibility score in percent. To do this we compare your profile with other profiles using fixed, documented rules: skills, goals, desired roles, availability, time zone, work formats, type of participation, interests, languages, and country and city (only if the person has not hidden where they live). For tasks in projects we suggest team members based on skills, role, availability and work format.

This is an evaluation of personal aspects and therefore profiling within the meaning of Art. 4(4) GDPR. It is not, however, a decision based solely on automated processing with legal or similarly significant effects within the meaning of Art. 22 GDPR: a suggestion does not change your rights, and people decide whom to contact and to whom a task is assigned. People you have blocked or who have blocked you are not suggested to you.

A high score indicates things you have in common; it is no promise that a collaboration will work out.

Legal basis: Art. 6(1)(b) GDPR.

8. Projects, ideas, teams and invitations

When you create a project or an idea, we process its details (e.g. name, description, required skills, location, planning details such as target audience, objective, budget or deadline). Projects, ideas and their roadmaps are publicly visible, as are the names of team members and – for tasks – to whom they are assigned.

Founders can invite members. We store who invited whom to which project and how the person answered. Whether people who are not your friends may invite you is up to you in the settings. We delete declined or withdrawn invitations 180 days after the answer.

Legal basis: Art. 6(1)(b) GDPR. Retention: until the project or idea is deleted; projects you founded are deleted together with your account.

9. Friends, messages, files and notifications

We store friend requests and friendships, blocks and your privacy settings.

We store the messages and files you send in chats on our servers so that you and the other person can read them; this includes read receipts and the times of edits and deletions. The "typing…" indicator is only passed on, not stored. Your chat partners see your online status and "last seen" unless you switch this off in the settings.

Message texts and files are additionally encrypted in the database and file storage (AES-256-GCM). This is not end-to-end encryption: the server can decrypt the content to show it to you.

We do not routinely look at message content. We access it only where this is necessary to handle a specific notice, to prevent abuse or because of a legal obligation.

Files in chats: we check the file type from its content and store files under random names. Only the participants of the chat can download them.

Deleting: A message you delete "for everyone" is emptied (only a note that it was deleted remains); its files are deleted. "Delete chat" removes the history for you only. When an account is deleted, we delete all of that account's chats completely – for the other person too.

We delete in-app notifications 180 days after they were created.

We currently do not send e-mail notifications.

Legal basis: Art. 6(1)(b) GDPR. Retention: messages and files until they are deleted or one of the accounts involved is deleted.

10. AI features

AI features are currently not enabled. No data is sent to AI providers. We will update this section before enabling them.

Which data is sent: For the roadmap, the project details entered by the founder. For the profile and team analysis we describe people only with placeholders (e.g. "M1", "C2") and professional details: skills with level, desired and current role, occupation, experience, project experience, available hours and times, time zone, work formats, type of participation. We do not send names, e-mail addresses, age, place of residence, profile texts or identifiers. Placeholders are mapped back to people only on our side. This data is pseudonymised, not anonymous.

Team analysis and candidates: The team analysis concerns the project's members and may also include pseudonymised details of other Alter Platform members who were pre-selected by fixed rules as possible candidates for open roles. The legal basis for this is Art. 6(1)(f) GDPR (the project team's legitimate interest in finding suitable collaborators). You can object at any time: under Settings → Privacy switch off "Include me in other projects' AI team analyses"; you will then no longer be pre-selected or sent.

Results: AI results are labelled as such. We store the roadmap and the latest team analysis with the project (visible to members; the roadmap is public); we do not store the profile analysis. AI results can be wrong or incomplete – check them before relying on them. The AI does not make decisions about people.

We log each AI request without content (provider, model, purpose, result status, number of tokens, duration) for cost control and troubleshooting and delete these entries after 365 days.

Legal basis for processing you start: Art. 6(1)(b) GDPR.

11. Notices and moderation

Anyone can report content they consider illegal or in breach of our rules – even without an account (notice form). We store the notice (type of violation, content concerned, explanation, and where given the name and e-mail address of the person reporting) and our decision. We pass the reporting person's name on to the person concerned only if this is exceptionally strictly necessary.

If we take a measure (e.g. removing a project, hiding an idea, suspending an account), we store the reasons and send them to the person concerned. Where there are indications of a criminal offence that threatens the life or safety of persons, we are obliged to inform the competent authorities (Art. 18 DSA).

Legal basis: Art. 6(1)(c) GDPR in conjunction with Articles 16–18 DSA, and Art. 6(1)(f) GDPR (protecting users and the platform). Retention: 12 months after the case is closed.

12. Cookies and browser storage

We store in your browser only what is strictly necessary for the service you requested (sign-in, language, questionnaire draft, security cookie during Google sign-in). Under § 25(2) no. 2 TDDDG this requires no consent. Details: Cookies and browser storage.

13. Recipients

Personal data is received only by:

• other users and visitors – to the extent of the visibility described in sections 6, 8 and 9;
• our processors: hosting Render Services, Inc. (USA), Frankfurt (EU); database Render Services, Inc. (USA), Render Postgres, Frankfurt (EU); backups Render Services, Inc. (USA), Frankfurt (EU); providers for e-mail delivery and AI only if these features are enabled (sections 9 and 10);
• Google as an independent controller if you use sign-in with Google;
• authorities and courts where we are legally obliged (e.g. Art. 18 DSA, orders under Articles 9 and 10 DSA).

We conclude contracts under Art. 28 GDPR with all processors.

Telegram group: We run a community group on the Telegram messenger (link on the website). Joining is voluntary and not required to use Alter Platform. Telegram is a separate service; its own privacy policy applies to the processing by Telegram, and Telegram may process data outside the EU. As administrators of the group we see your display name, where applicable your username and profile picture, and your messages in the group. We use this information only to look after the community (Art. 6(1)(f) GDPR) and do not transfer it to your Alter Platform account.

14. Transfers to third countries

Some providers may process data outside the EU and EEA, in particular in the USA. We transfer data only where there is an adequacy decision of the European Commission (for the USA: the recipient's certification under the EU-US Data Privacy Framework) or appropriate safeguards exist, in particular the EU standard contractual clauses (Art. 46(2)(c) GDPR).

In detail: Render Services, Inc. (USA): EU Standard Contractual Clauses, Art. 46(2)(c) GDPR (Render Data Processing Addendum)

You can obtain a copy of the safeguards by writing to alterplatform@gmail.com.

15. Retention at a glance

Statutory retention obligations remain unaffected.

16. Backups

We regularly back up the database and stored files so that data can be restored after a failure. Deleted data remains in the backups until the backup is overwritten (at most 7 days). We use backups only for restoration; if we restore one, we delete previously deleted data again.

17. Security

We protect data among other things through encrypted transmission (TLS), password hashing with bcrypt, sessions that can be revoked on the server, access checks on every request, limits on sign-in attempts and checks on uploaded files. No system is completely secure, so we cannot promise absolute security. In the event of a personal data breach we will inform the supervisory authority and – where there is a high risk – you, in accordance with Articles 33 and 34 GDPR.

18. Your rights

You have the right to:

• access your data (Art. 15 GDPR) – you can download a complete copy at any time under Settings → Account;
• rectification (Art. 16 GDPR) – you can change most details yourself in your profile;
• erasure (Art. 17 GDPR) – you can delete your account yourself under Settings → Account;
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR) – the export is machine-readable (JSON);
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR, see section 19);
• withdraw consent with effect for the future (Art. 7(3) GDPR), should we ask for your consent in future.

To do so, write to alterplatform@gmail.com. We will reply within one month (Art. 12(3) GDPR) and may ask you to confirm your identity, for example with a message from your account's e-mail address.

19. Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. For inclusion in other projects' AI team analyses, the switch in the settings is enough.

20. Complaint to a supervisory authority

You can lodge a complaint with any data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority competent for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Deutschland.

21. Obligation to provide data

You are under no statutory or contractual obligation to provide data to us. Without an e-mail address and password (or Google sign-in), acceptance of the terms of use and the required questionnaire answers, however, we cannot offer you an account or recommendations.

22. Minimum age

Alter Platform is intended for people aged 16 and over. When registering you confirm that you have reached this age. If we learn that an account belongs to a younger person, we delete it.

23. Changes

We adapt this privacy policy when our processing or the law changes. The current version with its date is always available here. We inform you in the app about significant changes.