What we collect
When you use Substrate, we collect what you give it: the briefs you write, the ground rules and limits you set, the decisions you make, and the data your software generates as it runs. We collect the account context around them — your name, member identities, billing details, and your saved configuration.
We collect basic product usage data so we can keep the product calm — page paths, feature versions, browser type, and the shape of your interactions. We do not collect the contents of pages you visit outside Substrate.
What we use it for
We use your data to run the product: to build, operate, and improve the software you direct, to show you the evidence behind every proposal, to bill your account, and to reach you when a decision needs you or an incident touches your data.
We never sell your data. We do not use the contents of your software or business data to train shared models. We do not look at your data unless you ask us to, or unless we have to in order to keep the service running.
Where it lives
Your data is encrypted in transit and at rest. Each account's data is isolated at the storage layer. We retain it for the window your plan specifies and delete it on schedule — prior versions you can restore are kept for that purpose, not waiting in a backup tape forever.
We host on SOC 2 infrastructure in the regions you select. Member access is logged; engineering access requires a paired review and an audit trail — the same kind of record the product keeps for you.
Your rights
You can export, redact, or delete any data your account holds, and export the source code of the software built for you, at any time. Account owners can do this directly; member-level requests route through the account admin. Deleted accounts purge within 30 days.
If you operate in the European Economic Area, the United Kingdom, or California, you have additional rights — access, portability, restriction, objection. Write to privacy@alpine.im and we'll route it to a human within two business days.
Cookies & analytics
This site uses essential cookies for sign-in and a small set of privacy-respecting analytics cookies for traffic shape. The product uses session cookies only — no third-party advertising trackers, ever.
You can refuse non-essential cookies on your first visit and change your mind from the footer of any page.
Subprocessors
We rely on a short list of vetted infrastructure providers — cloud compute, transactional email, payments, and error tracking. Each is bound by a data processing agreement that mirrors the protections in this policy. The current list is available on request and updated before any addition takes effect.
Children
Substrate is built for people running products and businesses. We do not knowingly collect data from anyone under 18. If an account contains data that should not be there, write to privacy@alpine.im and we'll remove it.
Changes
We update this policy when we change how we handle data. Material changes get an in-product notice and an email to account owners before they take effect. Continued use after that date constitutes acceptance.
Contact
Privacy questions, deletion requests, and data export tickets: privacy@alpine.im.