Privacy Policy
- Effective date
- April 29, 2026
- Last updated
- April 29, 2026
1. INTRODUCTION
This Privacy Policy explains how Alfred ("Alfred", "we", "us", or "our") collects, uses, retains, and shares information about you when you use the Alfred macOS application and related services (collectively, the "Service").
By using the Service, you agree to the collection and use of your information as described in this policy. If you do not agree with this policy, please do not use the Service.
We are committed to transparency. Alfred is a screen-aware AI assistant that observes your screen and listens to your voice in order to help you. To do this well, Alfred needs to collect specific kinds of data. We explain below exactly what we collect, why, how long we keep it, and what your rights are.
1.1 Beta status
The Service is currently provided as an open beta. This means:
(a) The Service is in active development. Features, behavior, retention policies, pricing, and these very terms may change while the beta continues. We will notify you of material changes in advance. (b) The Service is experimental. It may contain bugs, perform unreliably, or be temporarily unavailable. We do not provide service-level guarantees during beta. (c) Your participation provides us with feedback and data that helps us improve the Service. We treat your data with care, but the experimental nature of the beta means policies and practices may evolve.
By participating in the beta, you acknowledge and accept these conditions.
2. WHO WE ARE
Alfred is currently operated jointly by Anish Guntreddi, Markus Corredor, and Rayan Arya (collectively, the "Founders") as an unincorporated team doing business as "LearnWithAlfred" (the "Operator"). The Founders are in the process of evaluating whether and when to incorporate. When and if a legal entity is formed (such as a corporation or limited liability company) to operate the Service, the rights and obligations under this policy will be assigned to that entity, and you will be notified.
Until incorporation, references in this policy to "Alfred", "we", "us", or "our" refer to the Founders collectively, acting jointly through the LearnWithAlfred organization. After incorporation, those references will refer to the formed entity.
Contact:
Email: privacy@learnwithalfred.ai Website: https://learnwithalfred.ai
For privacy questions, complaints, or requests, please use the email address above. Privacy correspondence is routed to all three Founders so that any of us can respond. We commit to responding within 30 days of receipt.
3. INFORMATION WE COLLECT
Alfred collects three categories of information:
3.1 Account information
When you sign up, we collect: (a) Your full name (as you provide it during onboarding) (b) Your email address (used for account identification and login) (c) A password, which we store only as a cryptographic hash (PBKDF2-SHA256 with a unique random salt; we never see your plaintext password) (d) A device identifier (a randomly generated UUID stored locally on your Mac, used to associate sessions with your device) (e) An invite code, used during the closed beta period to gate access
We also store the timestamp of your account creation, your most recent login, and basic subscription status (trial, active, cancelled, expired).
3.2 Interaction data captured during sessions
When you actively engage Alfred (by pressing the keyboard shortcut, opening the chat panel, or otherwise interacting with the application), Alfred captures and transmits to our servers the following:
(a) Screenshots of your active display, taken at the moment of your interaction. These are images of whatever is visible on your screen when you ask Alfred for help.
(b) Accessibility tree data extracted from the macOS Accessibility API, which is a structured representation of the user interface visible on your screen at the moment of interaction. This includes button labels, window titles, menu items, and the literal text content of fields visible on screen (for example, the contents of an open document, the body of an email you are composing, or the text in a spreadsheet cell). This is documented privacy exposure and we want you to understand it clearly.
(c) Voice transcripts. When you speak to Alfred, the audio is transcribed locally on your Mac using on-device speech recognition. The audio recording itself never leaves your device. Only the resulting text is transmitted to our servers.
(d) AI responses generated by Alfred in reply to your interactions, including any pointing or action instructions Alfred provides.
(e) Session metadata, including timestamps, session identifiers, the name of the application that was active when you engaged Alfred, and a hashed identifier derived from your account ID and device ID.
3.3 Information we do not collect
For clarity, Alfred does not collect: (a) Audio recordings (transcription is fully on-device; audio bytes never leave your Mac) (b) Screenshots taken outside an active interaction with Alfred (c) Content from screens or applications when Alfred is not actively engaged (d) Keystrokes, mouse movements, or input outside what is naturally visible on your active display when you ask for help (e) Files from your filesystem that are not visible on your active display (f) Browser history, cookies, or web tracking data (g) Information about other applications you have installed (h) Network activity, location, or movement data
4. HOW WE USE YOUR INFORMATION
We use the information we collect for two purposes: providing the Service in real time, and improving the Service over time.
4.1 Real-time service delivery (primary use)
We use your interaction data (screenshots, accessibility tree, voice transcripts) to generate Alfred's responses in real time. Specifically: (a) We transmit the captured data to artificial intelligence inference providers (currently Anthropic, with OpenAI as a fallback) to generate Alfred's response to your query. (b) We use your account information to authenticate your session and enforce trial or subscription limits. (c) We use session metadata to maintain conversation continuity across multiple turns within a single session.
Without this real-time use, Alfred cannot see your screen or hear your voice, and the application would not function.
4.2 AI model training and improvement (secondary use)
We retain a record of your interactions on our servers and use that record to train and improve our artificial intelligence and machine learning models. Specifically:
(a) We retain captured interaction data (screenshots, accessibility tree, transcripts, AI responses) on our servers, encrypted at rest, for use as training data.
(b) We use this training data to fine-tune existing open-source large language models (such as Llama, Mistral, or Qwen) into Alfred-specific models that better understand on-screen contexts, common task patterns, and the four user profiles Alfred supports (K-12, College, Senior, Professional).
(c) We use this training data to develop proprietary AI models that we will own and operate. Over time, these proprietary models may replace or supplement the third-party AI providers (such as Anthropic Claude) that currently power Alfred. This is a foundational element of our long-term product strategy.
(d) We may use anonymized and aggregated insights from this data for product research, performance benchmarking, internal analytics, and academic publication, provided no individual user is identifiable from the resulting outputs.
(e) We do not sell your data to third parties. We do not use your data to advertise to you. We do not share your individual interactions with anyone other than the AI inference providers needed to generate Alfred's responses (described in section 5).
If you do not consent to your interaction data being used for AI model training, you may opt out as described in section 8 (Your Rights).
4.3 Service operation and security
We also use your information for routine service operations, including: (a) Authenticating your sessions and preventing unauthorized access (b) Detecting and preventing abuse, fraud, or security threats (c) Providing customer support when you contact us (d) Sending transactional emails (welcome emails, password reset emails, security alerts) (e) Complying with legal obligations
5. THIRD PARTIES WHO RECEIVE OR PROCESS YOUR DATA
We work with the following third-party service providers. We are responsible for the data we send them; their handling of that data is governed by their own terms.
5.1 AI inference providers
(a) Anthropic, PBC. We send your interaction data (screenshots, accessibility tree, transcripts) to Anthropic's Claude API to generate Alfred's responses. Per Anthropic's API terms, Anthropic does not train its models on data submitted via the API by default.
(b) OpenAI, L.L.C. We send a smaller subset of interactions to OpenAI's API as a fallback for select operations. Per OpenAI's API terms, OpenAI does not train its models on data submitted via the API by default.
5.2 Infrastructure providers
(a) Cloudflare, Inc. We use Cloudflare Workers to operate Alfred's backend, Cloudflare R2 for encrypted training-data storage, and Cloudflare Durable Objects and KV for session state. Cloudflare processes your data on our behalf as a data processor under our Data Processing Agreement.
(b) Google LLC (Firebase). We use Google Firebase Firestore for account data storage. Google processes this data on our behalf as a data processor.
5.3 Email providers
(a) Resend, Inc. We use Resend to send transactional emails (welcome emails, password reset emails). Resend processes your email address only for the purpose of delivering messages we send.
5.4 Analytics and observability
(a) PostHog Inc. We use PostHog for product analytics. We send only event-level data (for example, "user opened the application") and never the content of your interactions.
(b) Functional Software, Inc. (Sentry). We use Sentry for error monitoring. Sentry receives error stack traces and a hashed user identifier when something breaks. Sentry never receives screenshot, accessibility, transcript, or response content. We have explicitly configured the Sentry SDK to send no IP addresses and no request headers.
5.5 Legal disclosures
We may disclose your information when required by law, court order, or government request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others. We will challenge overbroad legal requests where appropriate.
6. WHERE WE STORE YOUR DATA
Your data is processed in the United States. By using Alfred, you consent to the transfer of your data to the United States and its processing under United States law.
If you are located in the European Union, the United Kingdom, or any other jurisdiction with stricter data protection laws than the United States, please be aware that your data will be transferred outside that jurisdiction. We rely on Standard Contractual Clauses with our subprocessors and have implemented technical safeguards (encryption at rest and in transit) to protect your data.
7. HOW LONG WE KEEP YOUR DATA
7.1 Account data
We retain your account data (name, email, hashed password, subscription status) for as long as your account is active. If you close your account or request deletion, we delete this data within 30 days of receipt of your request.
7.2 Redacted interaction data
We retain a redacted version of your interaction data (with sensitive accessibility-tree content scrubbed) indefinitely for AI model training purposes, unless and until you request deletion under section 8.
7.3 Full-fidelity interaction data
We retain the full original captured data (including pre-redaction accessibility tree content) for 90 days, encrypted at rest with AES-256-GCM. After 90 days, the encrypted records are automatically deleted via Cloudflare R2 lifecycle rules, unless they have already been incorporated into a training data batch.
7.4 Logs and operational data
We retain server logs, error reports, and operational metrics for up to 90 days for debugging and security purposes. These logs do not contain the content of your interactions; they contain only timestamps, hashed user identifiers, request URLs, and HTTP status codes.
8. YOUR RIGHTS AND HOW TO EXERCISE THEM
You have the following rights with respect to the personal information we hold about you:
8.1 Right to know
You may request a description of the personal information we hold about you, the categories of sources, the purposes for processing, and the third parties with whom we share it.
8.2 Right of access and portability
You may request a copy of the personal information we hold about you in a structured, commonly used, machine-readable format (we provide JSON).
8.3 Right to deletion
You may request deletion of all personal information associated with your account. We will fulfill verified deletion requests within 30 days. Deletion is permanent and cannot be undone. Note: AI models trained in part on your data prior to your deletion request will not be retroactively retrained, but the underlying training-data records associated with your account will be deleted.
8.4 Right to opt out of training-data use
You may opt out of having your interaction data used for AI model training while continuing to use Alfred. To opt out, contact privacy@learnwithalfred.ai with your account email and a clear request. We will disable training-data collection on your account within 7 days. Note: opt-out is forward-looking; previously collected and encrypted data may remain in our systems until it expires per our retention schedule (section 7) or until you also request deletion.
8.5 Right to correct
If any of your account information is incorrect, you may correct it through the application's settings or by contacting us.
8.6 Right to withdraw consent
You may withdraw your consent to processing at any time. We will stop processing your data going forward except where another legal basis applies (such as fraud prevention or legal obligations).
8.7 Right to lodge a complaint
If you are located in the European Union or the United Kingdom, you have the right to lodge a complaint with your local data protection authority.
8.8 How to exercise your rights
For all rights described above, contact privacy@learnwithalfred.ai. We may need to verify your identity before fulfilling certain requests, particularly deletion. We will not retaliate against you for exercising your rights.
9. CHILDREN'S PRIVACY
Alfred is intended for use by people aged 13 and older for the College, Senior, and Professional profiles. The K-12 profile is intended for users aged 8 and older with parental knowledge or consent.
For users under 13, we comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13 without verifiable parental consent. Parents who believe their child has provided personal information without their consent may contact privacy@learnwithalfred.ai to request deletion.
10. SECURITY
We protect your data with industry-standard security practices:
10.1 Encryption in transit
All communication between the Alfred application and our servers uses TLS encryption.
10.2 Encryption at rest
Your full-fidelity interaction data is encrypted at rest with AES-256-GCM using application-layer encryption. The encryption keys are managed separately from the API credentials used to access AI providers and are versioned to support periodic rotation.
10.3 Authentication
Account passwords are hashed using PBKDF2-SHA256 with a unique random salt per password. We never see or store your plaintext password.
10.4 Access controls
Access to user data is limited to engineering staff who have a legitimate need, and is logged. Access to training data uses pseudonymized user identifiers (cryptographic hashes), not direct email-to-data mappings.
10.5 No method is perfectly secure
While we work to protect your information, no electronic transmission or storage method is 100 percent secure. We cannot guarantee absolute security. If we become aware of a security incident affecting your data, we will notify you in accordance with applicable law.
11. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. When we make material changes (for example, changes to how we use your data for AI training, or new categories of third parties with whom we share data), we will: (a) Update the "Last updated" date at the top of this document (b) Notify you by email at the address associated with your account (c) Display a notice in the Alfred application (d) Where required by law, obtain renewed consent before applying the changes to your data
Material changes will not apply retroactively to data collected before the change unless we obtain renewed consent.
12. CALIFORNIA RESIDENTS (CCPA AND CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
12.1 Categories of personal information collected
We have collected the following categories of personal information from California residents within the past 12 months: (a) Identifiers (name, email address, account ID, device ID, IP address) (b) Internet or other electronic network activity (interaction data: screenshots, accessibility tree, transcripts) (c) Audio, electronic, visual, or similar information (transcribed voice text) (d) Inferences drawn from any of the above (user profile classification, mastery level for tutoring)
12.2 Sources, purposes, and disclosures
The sources, purposes, and disclosures for each category are described in sections 3, 4, and 5 of this policy.
12.3 Sale and sharing
We do not sell your personal information for monetary consideration. We do not share your personal information for cross-context behavioral advertising. We do "share" personal information with our subprocessors (described in section 5) for the purposes of operating the Service, which may meet the broad CCPA definition of "sharing" depending on interpretation; this Privacy Policy serves as our notice of that sharing.
12.4 Your CCPA rights
You have the right to request: information about the categories of personal information we have collected; deletion of your personal information; correction of inaccurate personal information; and to opt out of the sale or sharing of personal information. You may exercise these rights as described in section 8.
12.5 Authorized agents
You may designate an authorized agent to make CCPA requests on your behalf, subject to verification of the agent's authorization and your identity.
13. EUROPEAN UNION RESIDENTS (GDPR)
If you are located in the European Union, the European Economic Area, or the United Kingdom:
13.1 Data controller
The data controller for your personal information is the LearnWithAlfred Founders team (Anish Guntreddi, Markus Corredor, and Rayan Arya, operating jointly as an unincorporated team during pre-incorporation; see section 2), reachable at privacy@learnwithalfred.ai. Upon incorporation, the data controller will become the formed legal entity.
13.2 Lawful basis for processing
We rely on the following lawful bases under GDPR Article 6: (a) Performance of a contract (Article 6(1)(b)): processing your interaction data is necessary to provide the Service you have signed up for. (b) Legitimate interests (Article 6(1)(f)): processing your interaction data for AI model training is in our legitimate interest in improving the Service. We have weighed this interest against your privacy rights and provide an opt-out (section 8.4). (c) Consent (Article 6(1)(a)): for any processing not covered by the above bases, we will obtain your explicit consent.
13.3 International transfers
Your data is transferred to the United States. We rely on Standard Contractual Clauses with our subprocessors for these transfers. You may request a copy of the relevant Standard Contractual Clauses by contacting privacy@learnwithalfred.ai.
13.4 Right to lodge a complaint
You have the right to lodge a complaint with your local data protection authority. A list of EU data protection authorities is available at edpb.europa.eu.
14. CONTACT US
If you have questions or concerns about this Privacy Policy or about how we handle your information, please contact us at:
Email: privacy@learnwithalfred.ai Website: https://learnwithalfred.ai
We will respond to all reasonable inquiries within 30 days.
END OF PRIVACY POLICY