Privacy Policy

Effective date: October 7, 2026

This policy covers two things run by Alterna Development Studio:

the studio website at alternadevstudio.com, and
Alterna Account, our sign-in service at login.alternadevstudio.com, which you use to sign in to apps we build, such as You-Thon.

It is written in plain English. If anything here is unclear, email us at info@alternadevstudio.com.

Who we are

Alterna Development Studio is a small software studio in San Antonio, Texas, United States. We are the controller of the personal information described in this policy.

Contact: info@alternadevstudio.com

The studio website (alternadevstudio.com)

The website is a static site. It has no accounts, no login, no comments, and no forms that send data anywhere.

We set no cookies and run no analytics. The pages load no third-party scripts, trackers, or embedded content. If we add analytics later, we will update this page first and describe exactly what runs.
Hosting logs. The site is served by GitHub Pages. GitHub logs the IP address of every visitor for security purposes, under the GitHub Privacy Statement. We do not receive or use those logs.
Email you send us. If you email info@alternadevstudio.com, we keep the message for as long as we need it to answer you and to keep a record of our correspondence.

The Contact page shows our email address. Its message form is a placeholder and does not send anything.

Alterna Account (login.alternadevstudio.com)

Alterna Account is a single sign-in for apps we build. We run it ourselves using the open-source identity software Zitadel, hosted on Fly.io in the United States. When you sign in to one of our apps, the app sends you to login.alternadevstudio.com, you sign in there, and the app receives a confirmation of who you are.

What we collect

When you create an account with an email address and password, we store:

your email address and whether it has been verified;
your first and last name, and the display name built from them;
a password hash. We never store or see your actual password;
your preferred language, if set.

When you sign in with Google, Apple, or Facebook, we ask the provider only for basic profile information: your name, your email address, and, where the provider offers it, your profile picture. We request no other permissions. The scopes we request are:

Google: openid, email, profile;
Apple: openid, name, email;
Facebook: public_profile, email.

From that, we store your name and email address to create and identify your account, together with the provider's identifier for you, so we can recognise you the next time you sign in with the same provider. If the provider also sends a link to your profile picture, we may store that link with your account and treat it like the rest of your profile information.

If you sign in with Apple and choose Hide My Email, we store the relay address Apple gives us instead of your real address, and that is the address we email.

If you sign in with Facebook, Facebook does not confirm your email address to us, so we ask you to enter your name and email address and we verify the email address ourselves.

Security and sign-in records. Like any sign-in service, Alterna Account records sign-in attempts, the sessions it creates, and the changes made to your account, with timestamps and the network address and browser information of the request. We use these to keep your account secure, to investigate abuse, and to diagnose problems. We do not use them for marketing or profiling.

Two-factor authentication. If you set up a second factor (an authenticator app or a security key), we store what is needed to check it. Two-factor authentication is optional.

How we use it

We use the information above only to:

create your Alterna Account and let you sign in to our apps;
tell the app you are signing in to who you are (see "Who we share it with");
send account emails: verification codes, password resets, and security notices;
keep the service secure and prevent abuse;
comply with the law.

We do not sell your personal information, and we do not use it for advertising.

Google user data

Alterna Account's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: we receive your name, email address, and profile picture from Google when you choose to sign in with Google; we use them only to create and identify your Alterna Account and to tell the app you are signing in to who you are; we store them in our own sign-in database; and we never sell them, use them for advertising, or share them with anyone except the processors and apps listed below.

We share personal information only with:

The app you sign in to. When you sign in to one of our apps, the app receives your user ID, your email address and whether it is verified, your name, and your username. Each app has its own privacy notice. You-Thon's is at https://app.you-thon.com/privacy.
Fly.io (Fly.io, Inc., United States), which hosts the sign-in service and its database. Fly.io privacy policy.
Migadu (Migadu-Mail GmbH, Switzerland), which delivers our account emails. Migadu privacy policy.
Google, Apple, or Facebook, if you choose to sign in with them. They see that you are signing in to Alterna Account, under their own privacy policies.

We may also disclose information if the law requires it, or to protect the rights, safety, or security of our users or our services.

We do not sell personal information and we do not share it with advertisers or data brokers.

Where it is stored

The sign-in service and its database run in Fly.io's Ashburn, Virginia (United States) region. Our email provider is in Switzerland. If you use Alterna Account from outside the United States, your information is transferred to and processed in the United States.

Retention and deletion

We keep your Alterna Account for as long as you have it.

To delete your account, email info@alternadevstudio.com from the email address on the account (or from the address you signed up with). We will confirm the request, delete the account within 30 days, and reply when it is done.

When we delete an Alterna Account:

the account is removed from the sign-in service, and the email address, name, password hash, two-factor settings, and Google/Apple/Facebook links stop being usable to sign in;
we tell the apps the account was used with; each app deletes its own copy under its own privacy notice (for You-Thon, see its notice);
our sign-in service keeps a security audit log of account events. A record that the account existed and was deleted, and the history of changes made to it, stays in that log. It cannot be used to sign in, and we use it only to keep the service secure and to meet legal obligations.

Deleting your Alterna Account does not revoke the permission you gave Google, Apple, or Facebook. You can do that in the provider's own settings (Google: Security > Third-party apps; Apple: Apple ID > Sign-In & Security > Sign in with Apple; Facebook: Settings > Apps and Websites).

Database backups are kept for a short period for disaster recovery (currently about 10 days) and are then overwritten. Deleted data may remain in a backup during that window.

Your choices and rights

See or correct your information. Email us and we will tell you what we hold about you or correct it.
Delete your account. See above.
Ask for a copy of your information. Email us and we will send what we hold about you.

Depending on where you live, you may have legal rights to access, correct, delete, or port your personal information, to object to or restrict its processing, and to complain to a data-protection authority. Email us to exercise them; we do not discriminate against you for doing so.

Children

Our website and Alterna Account are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, email us and we will delete it.

Security

Connections to the website and the sign-in service use HTTPS. Passwords are stored as salted hashes. Access to the sign-in service's infrastructure is limited to the studio's operators. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you as the law requires.

Changes to this policy

When we change this policy, we will update the effective date at the top. For changes that matter to how we handle your information, we will also note the change on this page.

Contact

Alterna Development Studio
San Antonio, Texas, United States
info@alternadevstudio.com