Privacy Policy

1. Who we are

Adaptive Cogito LLC ("we", "us", "our") provides Agent Notifier as a mobile app, a web app and a command line tool. We are the controller of the personal data described in this policy: we decide why and how it is processed. This policy explains what we collect, why, who receives it, how long we keep it, and what you can do about it.

2. Data we collect

Data you give us:

• Account data: your email address and, if you choose to register with a password, your name and password. The password is never stored as such, only as a salted Argon2id hash. If you sign in with Apple or Google we receive your email address, your name (if you share it) and an identifier of that sign-in provider account.
• Sign-in codes: when you request an email one-time code, or a confirmation or password-reset code, we store the code with its expiry time until it is used or expires (the email sign-in code only as a hash, with an attempt count).
• Notifications and questions: the text your agent sends us through the CLI, the answer options of a question, and the answers you give (the selected options, any free text, the time, and whether the answer was given in the app or on the web).
• API tokens: a name you choose, a short non-secret prefix for identification, a salted Argon2id hash of the token, and when it was created, last used and revoked. The full token is shown to you once and is never stored in readable form.

Data created while you use the Service:

• Device registrations: when you allow notifications in the mobile app, your Expo push token, the platform (iOS or Android) and when the device was last seen. The token is removed when you sign out of that device or delete your account.
• Session data: when you sign in the server creates a session. It is valid for 30 days or until you sign out. The session token is kept on your device: in secure storage (Android Keystore / iOS Keychain) in the mobile app, and in the local storage of your browser in the web app.
• Technical logs: the servers and cloud services that run the Service may keep standard technical and security logs (for example request time and IP address) for a limited period.
• Information that stays on your device: your sign-in session, and in the CLI the API URL and API token in a configuration file readable only by your user. In the web app this is kept in the local storage of your browser. It is not sent to us. The web app does not use cookies.

What we do not collect: we do not use advertising, analytics or crash-reporting services, we do not track you across other apps or websites, and we do not access your location, contacts, photos or camera. We do not sell your personal data.

3. Device and browser permissions

• Notifications (mobile app): to alert you when your agent sends a notification or a question. Android 13 and later and iOS ask for your permission. You can refuse; the in-app inbox still works.

You can withdraw any permission at any time in the settings of your device. The related feature then stops working, the rest of the Service keeps working.

4. Why we use your data

• To create and secure your account, sign you in, and send you sign-in, confirmation and password-reset codes by email.
• To deliver your agent's notifications and questions to your devices, to record your answers and hand them back to your agent.
• To authenticate the CLI with your API tokens.
• To detect and prevent abuse, and to keep the Service secure and working.
• To answer your questions, to comply with legal obligations and to establish or defend legal claims.

Where the EU/UK GDPR or similar laws apply, our legal bases are: performing our contract with you (running your account and the features you use), our legitimate interests (security, abuse prevention and reliability), your consent (device permissions such as notifications) and legal obligations.

5. Who receives your data

We share data only with service providers that process it for us, and only as far as needed:

• Push delivery (Expo, with Apple APNs and Google FCM): to show a push notification we send the notification or question text (shortened) and your device push token to the Expo push service, which forwards it through Apple (iOS) or Google (Android) to your phone. These providers handle that data under their own terms and privacy policies. Because the text passes through them, do not make your agent send secrets.
• Sign-in providers (Apple, Google): if you use Sign in with Apple or Google we verify the identity token they issue, and receive the data described above.
• Cloud infrastructure (Amazon Web Services): runs the backend API and its database and sends our emails (Amazon SES). Your email address and the sign-in or reset code are passed to the email delivery service to send you that message.
• Hosting (Cloudflare): serves the web app and the developer website. It may process technical data such as IP addresses when you load those pages.

We may also disclose data if the law or a valid legal request requires it, to protect our rights and the safety of users, or to a successor if the business is transferred. We will keep this to what is necessary.

6. International transfers

Our API and database run on AWS in the us-east-2 (Ohio, United States) region. Push providers may process data in other countries. Where the law requires it, these transfers rely on safeguards such as adequacy decisions or standard contractual clauses.

7. How long we keep your data

• We keep your data for as long as your account exists.
• Sessions expire after 30 days or when you sign out. Sign-in and password-reset codes expire after a short time.
• Revoked API tokens stop working immediately.
• Technical logs are kept for a limited period and then deleted.

8. Deleting your account and data

Open Account in the mobile app or the web app, choose "Delete account", confirm your identity and confirm. This is immediate and cannot be undone. All your sessions and API tokens stop working at once. How to do it is also described at https://notifier.adaptivecogito.com/notifier/delete-account.

• We erase your user, your sessions and your registered devices.
• If you are the last user of the account, we also erase the account itself with its API tokens, notifications, questions, answer options and answers.

Copies in backups, if any are kept, and in technical logs are removed when they expire. If you cannot use the app or the web app, email support@adaptivecogito.com from your account email address and we will help you delete your data.

9. Security

We protect your data with measures such as: hashing of passwords, one-time codes and API tokens with Argon2id, encrypted connections (HTTPS) between the apps, the CLI and the server in production, storing your session token in the secure storage of your device (mobile app) or in your browser (web app), unguessable identifiers for questions, and access rules that limit each request to the data of the signed-in account. No system is completely secure, so we cannot guarantee absolute security. Keep your API tokens private.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• delete your data (see the previous section);
• restrict or object to certain processing, including processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent you have given, without affecting what was done before;
• complain to your local data protection authority.

To use a right that you cannot use inside the app, contact Adaptive Cogito LLC at support@adaptivecogito.com. We may need to confirm your identity first. We do not sell or share personal information for advertising, and we do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

11. Children

The Service is not intended for children under 16. We do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy when the Service or the law changes, for example if we add a new service provider or a new kind of data. The date at the top shows when it was last updated. If a change is material we will tell you in the app before it takes effect.

13. Contact

For any question about this policy or your data, contact Adaptive Cogito LLC at support@adaptivecogito.com.