allsortWho we are
Allsort (“Allsort”, “we”, “us”) is operated by Allsort. We are the controller of the personal information described in this policy. You can reach us about anything in it at hello@allsort.app.
This policy covers the Allsort Android app, any Allsort web app we host, the Allsort API that powers them, and this website.
What we collect
Information you give us
| What | Details |
|---|---|
| Account details | Your email address and a password. Passwords are stored by our authentication provider only in hashed form; we never see or store them in plain text. |
| Google sign-in | If you choose “Continue with Google”, Google shares your name, email address and a Google account identifier with us (and may include a profile picture link). We use your name to greet you in the app. We do not get access to your Google password, contacts, Drive or anything else in your Google account. |
| Your library | For each save: the link, title, category, creator name (if you add one), cover image link, whether it’s a favorite, and when it was saved. Plus any comments you write on a save, with their dates, and the names of categories you create. |
| Messages to us | If you email us, we keep your message and email address so we can reply. |
Information collected automatically
- Sign-in and session data. When you sign in, our authentication provider records the session, including timestamps, and issues tokens that keep you signed in.
- Server logs. Like nearly every online service, our hosting and database providers automatically log technical details of requests to our servers, such as IP address, time, the address requested, response status, and browser or device type. We use these to keep the service running, secure and abuse-free.
- Usage limits. To prevent abuse of link previews, our API briefly counts preview requests per account in memory. These counts are not stored long term.
What we don’t collect
- No advertising identifiers, ad networks or third-party analytics SDKs.
- No tracking cookies. This website doesn’t set cookies at all.
- No contacts, location, photos, microphone or camera access.
- No copies of the videos, images or posts you save. Allsort stores the link and the preview details described above, not the media itself.
- No access to your Instagram, TikTok, YouTube, Pinterest or other accounts. Sharing a link to Allsort shares only that link and its title.
How we use your information
- To provide Allsort: creating and securing your account, storing and syncing your library across your devices, and showing it back to you.
- To fetch link previews: finding a title and cover image for links you save (see the next section).
- To communicate with you: sending account emails such as confirmation and sign-in links, replying to your messages, and telling you about important changes to Allsort or these policies.
- To keep Allsort safe: preventing abuse, fraud and attacks, enforcing usage limits, and fixing problems.
- To meet legal obligations and to establish or defend legal claims.
Category suggestions are made by simple keyword rules that run inside the app on the title, link and note you type. Nothing you save is sent to an AI or machine-learning service. We don’t use your library for advertising, and we don’t build profiles of you.
Link previews and cover images
When you save a link, or ask for a preview, the Allsort API visits that public web page to read the title and preview image it publishes for everyone (its “Open Graph” or similar metadata). For YouTube links, we use the video’s public thumbnail.
- These requests come from our server, not your device, and never include your cookies, logins or Allsort credentials. The website sees a request from Allsort, not from you.
- We only request public web addresses, and we don’t try to get around privacy settings, logins or blocks. Private posts simply won’t have a preview.
- Recent preview results are kept briefly in server memory to avoid repeat requests, then discarded.
Good to know: to show a cover image, your device loads it directly from where it is hosted (for example, the source site or its image server). As with any image on the web, that host can see your IP address and basic device information when the image loads. If you prefer, you can remove a save’s cover image or use your own.
Legal bases
If you are in the European Economic Area, the United Kingdom or another place with similar laws, we rely on these legal bases:
- Contract: to provide the service you signed up for, including your account, library, sync and previews.
- Legitimate interests: to keep Allsort secure, prevent abuse, and improve reliability, in ways that don’t override your rights.
- Consent: where we ask for it, such as when you choose Google sign-in. You can withdraw consent at any time.
- Legal obligation: where the law requires us to keep or disclose information.
Who we share it with
We do not sell or rent your personal information, and we do not share it for targeted advertising. We share it only with:
- Service providers that run Allsort on our behalf under contracts that limit their use of your data: Supabase (account authentication, database and account emails) and Vercel (hosting for the Allsort API and website).
- Google, only if you choose to sign in with Google. Google’s handling of your data is covered by Google’s own privacy policy.
- Authorities or others when required by law, or when necessary to protect the rights, safety or property of our users, the public or Allsort.
- A successor if Allsort is involved in a merger, acquisition or sale of assets. We’ll tell you before your information becomes subject to a different privacy policy.
International transfers
Our providers may process information in countries other than yours, including the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms.
How long we keep it
- Your account and library are kept while your account exists.
- Deleted saves and comments are removed from our live database straight away. Deleting a save also deletes its comments.
- Deleted accounts: when you ask us to delete your account, we delete your account and your entire library. Copies may remain in our providers’ encrypted backups for a limited period until those backups expire.
- Server logs are kept for limited periods set by our hosting and database providers.
- Emails with us are kept as long as needed to handle your request, and afterwards only as long as reasonably necessary.
How we protect it
- Connections to Allsort are encrypted in transit.
- Every save and comment is tied to your account, and our database enforces row-level security, so only your signed-in account can read or change them. This is enforced by the database itself, not just the app.
- Our API acts with your own signed-in session rather than a master key, and rejects requests without a valid session.
- Passwords are hashed, and Google sign-in uses the PKCE flow in your system browser.
No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.
Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and get a copy of it.
- Correct information that’s inaccurate.
- Delete your information. You can delete any save or comment in the app at any time. To delete your whole account, email us from the address you signed up with.
- Export your library in a portable format.
- Object to or restrict certain processing, and withdraw consent where we rely on it.
- Complain to your local data protection authority.
To use any of these rights, email hello@allsort.app. We may need to confirm it’s really you before acting, and we’ll respond within the time the law requires (usually one month). We won’t treat you differently for using your rights.
US state privacy rights: residents of California and other US states with privacy laws have similar rights to know, delete and correct their information. We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under those laws.
On your device
The Allsort app keeps a copy of your library and your session on your device so it opens quickly and keeps you signed in. Empty categories you create are also stored on that device until you add a save to them. Signing out stops the app from loading your library on that device; uninstalling the app or clearing its data removes the local copy entirely.
On Android, Allsort appears in your share sheet. It receives only what you choose to share with it, usually a link and a title.
Children
Allsort is not directed to children. You must be at least 13 to use it, or older where the law requires (for example, 16 in some EEA countries without parental consent). We don’t knowingly collect information from children under those ages. If you believe a child has given us information, contact us and we’ll delete it.
Changes to this policy
We may update this policy as Allsort changes. We’ll post the new version here and update the date at the top. If a change is significant, we’ll give you notice in the app or by email before it takes effect.
Contact us
Questions, requests or concerns about your privacy? Email hello@allsort.app. We read every message.