Privacy Policy
Who is responsible
Devshire.app, the brand under which the founder, an individual, operates Allye (there is no registered company), is the controller of personal data processed through Allye under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018). No Data Protection Officer (encarregado) has been appointed because the operator is a small processing agent (ANPD Resolution CD/ANPD No. 2/2022). The channel for privacy matters is app@devshire.app.
Data we process
Account data (name, email, sign-in method, password handled by our authentication provider, security settings such as multi-factor authentication where you enable it); workspace content you create (projects, specs, tasks, documents, comments, memories, attachments, settings, AI provider keys you store, which are encrypted); usage and technical data (IP address, user agent, timestamps, audit and security logs, error logs); the waitlist email if you asked for access; and the consent record (document, version, time, IP, user agent).
Why and on what basis
To provide the Service you asked for and manage your account (performance of a contract, LGPD art. 7, V); to secure the Service, prevent abuse and keep logs (legitimate interest, art. 7, IX, and legal obligations, art. 7, II); to prove your acceptance of these documents and defend our rights (regular exercise of rights, art. 7, VI, and legal obligation); to send transactional email such as access links and notices (contract and legitimate interest); and, where we ask for it, on your consent (art. 7, I), which you can withdraw. We do not sell personal data and do not use your content to train our own models.
Who receives data (sub-processors)
We use: Supabase (database, authentication and file storage); Railway (application hosting); Cloudflare (hosting of the website and app, DNS, content delivery and network security); Resend (transactional email delivery); and AI providers: Google (Gemini API), which we use to run features such as search embeddings and summaries, and providers you configure with your own keys, which receive the content you submit to AI features. We share data only as needed to run the Service, with providers bound to protect it, and with authorities when the law requires.
Data location and international transfers
Our providers may store and process data outside Brazil, including in the United States (Supabase and Railway); other providers (Cloudflare, Resend, Google and the AI providers you configure) may also process data outside Brazil. Where data is transferred internationally we rely on the mechanisms allowed by LGPD art. 33, such as the standard contractual clauses in our providers' data processing terms.
Retention
We keep account and workspace data while your account exists, and, when your account is deleted (on your request or through Settings where available), personal data is deleted or anonymised. Waitlist emails are kept until you are given access or ask us to remove them. Consent records (document, version and time) are kept as evidence of your acceptance; the IP address and user agent kept in consent records are removed when the account is deleted. Operational logs and provider backups are kept only for the limited period set by each provider or by our log settings, and backups expire on their normal cycle. During the alpha, data may be reset.
Your rights
Under LGPD art. 18 you may ask to confirm that we process your data, access it, correct it, anonymise, block or delete unnecessary data, request portability, obtain information on sharing, withdraw consent and object to processing. How: write to app@devshire.app, or use Delete account and Export my data in Settings where available; we answer within 15 days. You may also complain to the Brazilian data protection authority (ANPD).
Security
We use encryption in transit, encryption of stored secrets, access controls, support for multi-factor authentication, rate limiting and logging. No system is perfectly secure; we will notify you and the authority of incidents as the law requires.
Minors
The Service is for people 18 or older; we do not knowingly collect data from minors.
Alpha notice
Because the Service is in alpha, features and data handling may change and data may be reset; we will update this policy and ask you to accept the new version.
Changes to this policy
Each version has a date. Material changes are announced and require you to accept the new version at your next sign-in.
Contact
app@devshire.app.