Privacy policy for Aliveline

Updated: 6 October 2026. This policy covers Aliveline and its account recovery and deletion features. Optional recovery is available only when enabled for your app version. The company website has a separate privacy policy.

1. Controller and contact

Polytherium OG
Wienerbergstraße 11/12a, Vienna Twin Towers
1100 Vienna, Austria
office@polytherium.com
Phone: +43 699 112 799 33

Further company details are in our legal notice.

2. Data we process

• Account and device access: a randomly generated account identifier and, for protected accounts, device credentials whose digests are stored on the server. The app keeps its credentials in protected device storage.
• Check-ins: display name, personal alert message, selected interval, last check-in, next deadline and enabled or paused notification status.
• Contacts and recipients: recipient email addresses you enter and connections to Aliveline accounts accepted through invitations.
• Technical data: push registration, device platform, app version, language or region, and IP address and technical device information where required to resolve an invitation or operate and protect the API.
• Optional recovery: verified recovery email address, time-limited verification challenges and device sessions. Verification codes are stored on the server as keyed digests.
• Delivery and security: scheduled alerts, temporary copies of recipient and message information for retries, delivery state, attempt counts, limited abuse-prevention records and minimal hashed deletion receipts.

Aliveline currently includes no advertising, location monitoring or app usage analytics of its own. Push notifications require the technical processing of the Firebase service described below. Random account identifiers do not guarantee complete anonymity.

3. Purposes and legal bases

We process information required for accounts, check-ins, invitations, alerts and requested recovery to provide the app functions you use (Article 6(1)(b) GDPR). Abuse prevention, access security and preventing deleted accounts from being recreated serve our legitimate interests in secure operation and protecting affected individuals (Article 6(1)(f) GDPR).

You can change notification permission in your device settings. Where separate consent is the basis for processing, you can withdraw it for the future. Pausing check-ins or disabling push permission does not delete your account.

4. Sharing with contacts and service providers

Accepted Aliveline contacts can see the check-in status and display name used by this feature. Recipients you choose receive relevant missed-check-in alerts; your personal message is included in email. Add people who expect these alerts and avoid unnecessary confidential information in the message.

Our backend is hosted by IONOS. Emails use our configured SMTP service. Push notifications use Google's Firebase Cloud Messaging and, on Apple devices, Apple's push service. See Firebase privacy and security information for its technical processing. Delivering messages can involve service providers or recipients outside the European Economic Area. Contact us for information about the provider agreements and transfer safeguards applicable to a particular processing operation.

App stores process downloads and any earlier purchase transactions under their own privacy policies. No new subscriptions or in-app purchases are configured in this version.

5. Retention and backups

Settings, recipients and contacts needed for an existing account remain until changed, removed or the account is deleted. Verification codes expire after ten minutes; expired challenges are regularly removed after an additional 24-hour cleanup period. Prepared device sessions last 24 hours and active sessions last 90 days. Session records are regularly cleaned after expiry plus 30 days. Expired abuse-prevention counters are regularly removed.

Stored message payloads for completed, skipped or cancelled alerts are cleared after 30 days through regular cleanup. Minimal delivery identifiers can remain to prevent duplicate delivery. Pending or failed deliveries can remain until completion, cancellation or necessary investigation.

Database backups and isolated testing or restore copies managed by us follow a rolling 30-day retention period. Access is restricted and these copies do not serve routine app traffic. Before a restoration is made accessible, known account deletions must be reconciled against the current deletion ledger. Restored data is not automatically returned to live service.

Minimal hashed account-deletion identifiers and digests of deletion proofs are retained without a fixed expiry while needed to prevent old installations recreating a deleted account and to complete interrupted deletion requests securely. These records contain no plaintext email address, personal message or plaintext device credential.

6. Delete your account and data

In a supported app version, choose Settings → Delete account and confirm. Account data, contacts, settings, recipients, invitations and recovery credentials are removed from the active service and associated queued alerts are cancelled. Emails and push messages already submitted to delivery providers cannot be recalled. Older backups can retain copies until scheduled expiry; the minimal deletion ledger is retained as described above.

If you cannot use the app, request deletion through our deletion page or office@polytherium.com. Automatic email verification requires a recovery address linked earlier and enabled recovery functionality. Otherwise support reviews the request. A display name alone is not ownership evidence. Do not email verification codes or device credentials.

7. Your rights

Subject to the applicable conditions, you have rights to access, correct, erase, restrict processing of and obtain portable copies of your personal data. You can object to processing based on legitimate interests for reasons relating to your situation and withdraw consent for the future. Contact office@polytherium.com; reasonable identity verification may be needed to prevent unauthorized access.

You may complain to a competent supervisory authority. In Austria this is the Austrian Data Protection Authority.

8. Changes

We update this policy and its date when features or processing change. Material new processing will be disclosed appropriately before introduction.