Last updated · October 27, 2026
This Privacy Policy applies to information collected through our websites and platform services covering both the individual categories of information we collect as well as the aggregation of all or some of the individual categories of information. This policy does not govern the contractual relationship between ALAN and its commercial or enterprise clients, which is governed by the applicable Enterprise Agreement and any associated data processing agreement. It should be read together with our Terms of Service and any action related to Privacy that is not covered in this document is controlled by the Terms of Service. Different data practices may apply depending on the nature of your interaction (for example, a website visitor, a retail subscriber, or an authorized user of an enterprise deployment).
We may collect information:
The Services incorporate and analyze data from public, government, and third-party sources, which may include SEC EDGAR filings, OFAC and other sanctions lists, the Federal Register, congressional and government financial-disclosure records, corporate insider (Form 4) filings, institutional holdings (Form 13F) data, maritime (AIS) and aviation (ADS-B) signals, and similar feeds.
Some of this information references identifiable individuals, for example, corporate insiders, public officials, or fund managers. We process this information to provide intelligence, research, and analytics features, and it is generally drawn from publicly available sources or records made lawfully available by government entities. We use it for the purpose of operating the Services and not to build independent consumer-marketing profiles.
ALAN does not create or maintain independent consumer-marketing databases, and ALAN does not sell or license this data to third parties for their own marketing purposes. Where applicable law affords rights with respect to such information, we will honor those rights to the extent required (see Sections 17-18). Third-party and government sources are subject to their own terms, methodologies, and limitations, and we do not warrant their accuracy or completeness.
We may use collected information to:
Account emails. Besides product updates and newsletters, we send emails tied to your own account, such as a welcome series, a reminder before a trial ends or a plan renews (stating the date and any amount that will be charged), payment-failure notices, and messages about alerts you have set. Marketing email has an unsubscribe link, and you can change which emails you receive in your notification settings. Security and billing messages about your account are sent regardless.
We may use cookies and similar technologies to operate, secure, and measure our websites and Services, including to maintain sessions, recognize returning users, support functionality and security, and analyze usage and performance. Our analytics are first-party: we do not use a third-party analytics service, no advertising trackers, no cross-site cookies. Most web browsers allow you to control cookies through browser settings. If cookies are disabled, some parts of the websites or Services may not function properly. ALAN does not use cookies to build cross-site advertising profiles for third-party marketing. We respond to “Do Not Track” (DNT) signals as follows: because we do not track you across third-party websites over time and do not use cross-context behavioral advertising, our websites do not behave differently when a DNT signal is present, and we do not authorize any third party to collect personally identifiable information about your activities across different websites through the Services.
First-party attribution cookie. When you open one of our public pages we may set a cookie named alan_fp. It stores one thing, the path of the first public page you opened (for example /pricing), and lasts 30 days. We use it only to credit a later sign-up to the page that brought you in, so we can tell which public pages are worth keeping. It is not used for advertising, is not shared with anyone, and does not track you across other websites.
First-party measurement. We also record our own page views on our websites, without setting any cookie for that purpose (the separate alan_fp attribution cookie above is the only cookie involved in measuring public pages). For each view we store the page path with the query string removed, the referring website's domain, an approximate country, a device category, and a pseudonymous visitor identifier. That identifier is a one-way SHA-256 hash of your IP address and browser user-agent string combined with a secret value that we rotate on a fixed 30-day schedule. We do not store your IP address or your user-agent string in that record, and the hash cannot be reversed back into either of them. Because the secret rotates, the identifier changes every 30 days and the same visitor cannot be linked from one 30-day period to the next. We use it only to count how many distinct people visit and how many come back within a period, so that we can measure whether the product is useful. Before September 22, 2026 this identifier rotated every day, which meant no return visit could be counted at all; we extended the rotation to 30 days for that measurement and for no other purpose.
Product events. We also record a short list of named events that show how the product is used, for example that a pricing page was opened, an upgrade prompt was shown or clicked, checkout was started, holdings or a watchlist item were added, an alert was created, the daily brief was opened, a lesson was finished, or an email was sent to you. Each event stores the event name, the time, a few coarse labels (such as your plan or the screen it happened on), the session identifier described above, and the pseudonymous visitor identifier described above. If you are signed in, the event also stores your account identifier, so an event from a signed-in session carries your account identifier, the visitor identifier and the session identifier together. Events do not contain your email address or IP address. Requests from known crawlers and automated tools are not recorded, and events from our own staff and test accounts are flagged so that they can be left out of our figures. We use events to learn which parts of ALAN are useful and where people get stuck.
Email links. Links in our emails that point to ALAN carry a campaign tag made of the word “email,” the name of the email, and a random code for that send, so that we can tell which email led to a visit. The tag does not contain your email address. Unsubscribe and email-preference links carry no tag, and links to other websites are left unchanged.
We may disclose information:
We may also disclose aggregated or de-identified information that does not identify any individual. Third-party platforms and providers may maintain their own privacy policies governing their handling of information.
ALAN Echo desktop app. Echo is designed so your voice data never leaves your device: dictation audio is captured from your microphone, transcribed locally by an on-device model, and the audio is discarded. We do not receive, store, or have any ability to access your audio, transcripts, or dictation content, and the app contains no analytics or telemetry.
What the app does transmit: (1) when you activate a license, the app sends your license key and a pseudonymous device identifier (a one-way SHA-256 hash derived from hardware identifiers, which we treat as personal data) to our activation service; we store the key, machine hash, activation time, IP address, and user-agent of that request to enforce the per-license activation limit and prevent fraud; (2) when you check for updates, the app requests version metadata from our service; (3) if you download an optional speech model or GPU pack, it is fetched from our service or from the model's hosting provider (Hugging Face), whose own privacy policy applies to that download.
What the app stores locally on your device: settings, transcripts you choose to keep, license/activation tokens, and signed trial state (in application data files and, on Windows, the Windows registry; on macOS, application support files). Uninstalling removes the application; local data can be removed per the instructions in our documentation.
Activation records are retained for the life of the license plus 3 years, then deleted or anonymized. To exercise privacy rights (access, deletion) over purchase or activation records, contact the address in Section 20, referencing your order email.
When you purchase ALAN Echo through our website, the website (not the application) collects your email address for license delivery and our payment processor, Stripe, processes your payment. We retain a record of issued license keys and purchase emails to provide key recovery, refunds, and abuse prevention. Those website practices are governed by the rest of this Privacy Policy.
ALAN Social Desk is an internal, staff-only tool we use to publish our own video content to social media accounts that ALAN owns and operates, currently our TikTok channel. It is not a feature of the Services, it is not offered to you, and it is not accessible to visitors, subscribers, or enterprise clients. We describe it here because it connects to TikTok's Content Posting API and Login Kit on our behalf.
What it accesses: when a member of our staff authorizes the tool, TikTok issues access and refresh tokens scoped to ALAN's own account. We request two permissions: user.info.basic, which reads that account's own profile information (its open ID, display name, username, and avatar image), and video.publish, which posts video to that account. Using those tokens the tool reads the posting options the account permits, and uploads video files together with the caption, visibility, interaction settings, and any commercial-content or paid-partnership disclosure our staff select.
What it does not do: the tool transmits no information about you, your account, your watchlists, your queries, or any other user data to any social media platform. It does not read, collect, or store information about the people who view, follow, or interact with our posts.
Storage and retention: the tokens are held in one place only, a signed, HTTP-only cookie in the authorizing staff member's browser. We operate no database or other store of them. They expire on TikTok's own schedule; a member of staff can disconnect the account from within the tool at any time, which discards them; and they can be revoked at any time from TikTok's own account settings, which immediately ends the tool's access. Video files are transmitted to TikTok and are not retained by the tool after publication.
Your own interactions with our social media accounts, such as following, viewing, commenting, or messaging, take place on that platform and are governed by the platform's own privacy policy rather than this one. For TikTok, see the TikTok Privacy Policy at https://www.tiktok.com/legal/privacy-policy.
We retain information for as long as reasonably necessary to provide the Services, maintain platform functionality, comply with legal and licensing obligations, resolve disputes, enforce our agreements, and protect system security. Retention periods may vary by the type of information and the context in which it was collected.
Raw product events (Section 7) are kept for 13 months and then deleted. When your account is deleted, the events tied to your account identifier are deleted with it. Events recorded while you were not signed in carry no account identifier, so they are not deleted when you delete your account; they are deleted when they reach 13 months. Because they share the visitor and session identifiers with events recorded while you were signed in, they can be linked to your account during the same 30-day visitor period, and we do not claim they are anonymous.
Free-trial history: to stop the same person from taking a free trial again and again, we keep a one-way keyed hash of your email address in a simplified form (lowercased, with any "+tag" removed, and for Gmail with dots removed). We record it when a free trial starts, and we keep it when an account that had a trial is deleted. We do not keep the address itself, and the hash is not linked to your name, your account identifier, or any other information about you. It cannot be turned back into your address, and it is only useful to someone who already knows the address and our secret key. We use it only to check whether an address has already had a free trial, and we keep it for as long as needed to prevent free-trial abuse.
Depending on your location, you may have rights under applicable privacy laws, which may include the right to:
To exercise these rights, contact us at alanglobalintelligence@proton.me. We may take reasonable steps to verify your identity before responding and will respond within the timeframes required by applicable law.
Residents of California and other states with comprehensive consumer-privacy laws may have additional rights, which may include the rights to know, access, correct, delete, and obtain a copy of their personal information, and to opt out of the "sale" or "sharing" of personal information and of certain profiling.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under applicable state law. To the extent we process any sensitive personal information, we use and disclose it only as permitted by applicable law and to provide the Services you request. Residents may exercise their rights using the contact information in Section 20, and you will not be discriminated against for exercising your rights. Where permitted, you may use an authorized agent to submit a request.