Privacy policy

last updated 1 november 2026

The short version

Alalap stores the memories you make (voice, photo, caption, place) so they follow you across devices.
New memories are public by default. Each one has a privacy switch, and you can change the default in Settings.
No ads, no analytics trackers, no selling or renting your data.
Everything is stored in the EU (Ireland).
You can download all your data, or delete your account, from Settings in the app. Deletion takes effect at once.

1. Who we are

Alalap is a memory recorder app for iPhone. The controller of your personal data is CONFIRM: legal name and address of the operator. You can reach us about anything in this policy at privacy@getalalap.com.

2. What we collect, and why

Data	What it is	Why
Account details	Your phone number, or your email address, or an identifier from Sign in with Apple, Google or Facebook (including the email or name they choose to share). Your username, display name and profile photo.	To create your account, sign you in and show who you are to people you connect with.
Your memories	Each voice recording (up to 30 seconds), optional photo, caption, the time, the place name, and the coordinates when the location tag is on. Whether the memory is private or public.	To store, sync and play back your memories, and show them on your wall and map.
Social activity	Who you follow and who follows you, likes, people tagged in a memory, "I was here too" marks, blocks, and reports you send.	To run the social features and keep people safe.
Technical data	Your IP address and basic request details, kept briefly in our hosting provider's security and sign-in logs.	To keep the service secure and prevent abuse.

We don't ask for your contacts, and we don't collect advertising identifiers, device fingerprints or analytics about how you use the app.

Permissions on your phone

Alalap asks iOS for the microphone (to record), the camera (to take a photo), your photo library (if you pick a photo instead) and your location (to tag where a memory happened and show you on the map). Each is optional to a degree: you can say no, and the matching feature simply won't be available. You can change your mind any time in iOS Settings.

Photos and hidden location data

Photos often carry hidden details, including GPS coordinates. Alalap strips this metadata from photos before they are uploaded. A memory's location comes only from the place tag, and only when that is on.

3. Who can see your memories

You control this per memory. A public memory can be seen by other Alalap users, including its recording, photo, caption and place, and it can appear on the map. New memories are public by default; you can turn off "Share new memories by default" in Settings so they start private, or flip any memory to private at any time. A private memory is visible only to you and to people you tag in it. If you block someone, neither of you can see the other's memories.

4. Sharing outside Alalap

When you share a memory, your phone builds a small square video and hands it to the iOS share sheet. You decide where it goes. That file is made on your device and is not hosted by us, and we get no copy. After it leaves the app, it is governed by the privacy practices of whoever you send it to.

5. Who we share data with

We don't sell your data. We use a few providers to run Alalap, and they only handle data on our behalf:

Provider	What for	Where
Supabase	Database, file storage (recordings, photos), sign-in and sync	Ireland (EU)
Twilio	Sending the one-time code by SMS when you sign in with your phone number	May involve processing outside the EU
Apple Maps	Showing the map and place search inside the app. Apple receives the map area you view and the places you search for, under Apple's own privacy policy; we don't send it your memories.	Apple, per its own policy
Cloudflare	Hosting this website, the waiting list database, and sending the waiting list emails	Global network; processing may involve countries outside the EU
Apple, Google, Facebook	Only if you choose to sign in with them. They tell us who you are; we tell them nothing about your memories.	Per their own policies

Where data is processed outside the EU/EEA, we rely on safeguards such as the European Commission's standard contractual clauses. We may also disclose data if the law requires it.

6. The waiting list

If you join the waiting list on this website, we collect your email address (and the time you signed up) so we can send you one confirmation email, and one email on the day Alalap launches. We use a double opt-in: your address only counts once you tap the confirmation link. We don't use it for anything else and we don't share it.

Legal basis: your consent, which you can withdraw at any time.
Leaving the list: every email has a link to remove yourself, which deletes your address. You can also write to privacy@getalalap.com.
How long: addresses that are never confirmed are deleted after 30 days. Confirmed addresses are kept until we've sent the launch email, then deleted within 30 days (or sooner if you leave).
Spam protection: to limit abuse we briefly keep a one-way hash of the IP address of recent sign-ups (never the address itself), deleted after 24 hours.
Provider: the list and the emails run on Cloudflare (see the table above).

7. Legal bases (EU/UK users)

Contract: to give you the account and the memory features you asked for.
Consent: for microphone, camera and location access, which you grant through iOS and can withdraw there.
Legitimate interests: keeping the service secure, preventing abuse and handling reports.
Legal obligation: where the law requires us to keep or hand over information.

8. How long we keep things

Your account and memories: until you delete them. Deleting a memory or your account removes it from our systems at once.
Backups: deleted data can remain in encrypted database backups for up to 7 days, then it is gone.
Deletion notices: so your other devices can drop a deleted memory, we keep a small note (a memory ID, whether it was public, and the IDs of tagged people, never your identity) for 30 days.
Reports and blocks: a report you send is kept while we review it and as long as needed to enforce our Terms and protect others, then deleted. Reports about your content are deleted with your account unless we need them for a serious safety matter or the law requires us to keep them.
Data exports: a file you ask for is available for 24 hours, then deleted.
Sign-in logs: our hosting provider keeps authentication logs, which include IP addresses, for the retention period of our plan. When you delete your account we remove the log entries we can, but some provider-level logs are outside our control.

9. Your rights and choices

In the app, under Settings, you can:

Download my data: a zip with your profile, memories, likes, follows and your original recordings and photos.
Delete account: removes your account, memories, recordings, photos, profile picture, follows, likes and blocks.
Edit your name and photo, and change any memory's privacy.

If you're in the EU/EEA or UK you also have the right to access, correct, erase, restrict or object to our use of your data, to data portability, and to withdraw consent. Write to privacy@getalalap.com and we'll reply within one month. You can also complain to your local data protection authority.

10. Security

Data travels over encrypted connections, files are stored privately and only reachable with short-lived signed links, and access rules in the database stop one account from reading another's private memories. No system is perfectly secure, but we take care to keep what you record safe.

11. Children

Alalap isn't meant for children under CONFIRM: 16 (must match the Terms). We don't knowingly collect data from them. If you think a child has made an account, tell us and we'll delete it.

12. Changes to this policy

If we change this policy in a way that matters, we'll update the date above and tell you in the app before it takes effect.

13. Contact

Questions or requests: privacy@getalalap.com.