Privacy Policy
Effective October 27, 2026 (first published October 23, 2026; this version adds passkeys, uploaded images and usage statistics). How Composite Code LLC (“we”, “us”), the operator of Substratal Apps, collects, uses, shares, and protects personal information, and the choices and rights you have.
- 1. Who we are and what this covers
- 2. What we collect
- 3. How we use it, and our legal bases
- 4. Who we share it with
- 5. How long we keep it
- 6. Your rights and choices
- 7. Security
- 8. International transfers
- 9. Children
- 10. Cookies
- 11. Changes
- 12. Contact
1. Who we are and what this covers
Composite Code LLC, a Washington limited liability company, is the controller of personal information processed to run Substratal: the platform API at api.substratalapps.com, the Substratal Hub apps (web at hub.substratalapps.com, macOS, Windows, Linux, iOS and Android), Substratal’s own applications, and this site.
When a developer’s own Application or an Organization uses Substratal to manage its users, that developer or Organization decides why and how its users’ data is used, and we process that data on its behalf as a processor under the Data Processing Addendum. That Application’s or Organization’s own privacy policy then applies too.
Contact: privacy@substratalapps.com.
2. What we collect
You give us:
| Category | Examples |
|---|---|
| Account | Email address, password (stored only as an Argon2id hash, never in readable form), display name, locale and time zone |
| Images | An avatar you upload, or an Application icon a developer uploads: the image file as uploaded, its type and dimensions. The file keeps any information your device embedded in it, such as when and where a photo was taken. Uploaded images are public (see section 4). You can instead give a link to an image hosted elsewhere. |
| Security | Two-factor (TOTP) secret, stored encrypted; recovery codes, stored hashed; and for each passkey you add: its public key and credential ID, a signature counter, the authenticator model identifier (AAGUID) your device reports, its supported transports and backup status, a name you choose, and when it was last used. Your fingerprint, face or device PIN never leaves your device; a passkey only lets your device prove it holds the private key, which we never receive. |
| Preferences and app data | Settings, per-application profiles and settings an application stores for you |
| Organizations | Organizations you create or join, your role in them, and invitations |
| Billing | Your plan and subscription status. Card details go directly to our payment processor (see Sub-processors); we store only its customer and subscription references, never card numbers. |
| Communications | Messages you send to our contact addresses |
Created when you use Substratal:
| Category | Examples |
|---|---|
| Sessions | When each session started and was last used, its IP address and user agent, how you signed in (password, authenticator app, passkey or recovery code), and when you last completed a two-step check |
| Devices | Push tokens and a name for each device you turn notifications on for |
| Notifications | Notifications sent to you, and whether they were delivered and read |
| Access | Which applications you can use, and your roles and permissions in them |
| Audit records | A record of security-relevant and administrative actions, such as sign-ins, changes to access, and who made them |
| Logs | Request and security logs (request ID, operation, status, IP address, user agent), kept to run and protect the Service |
| Usage statistics | Daily counts of requests, errors and response times per Application, API key and operation, built from the request logs. They contain no request contents and aren’t used to profile you. |
We don’t collect precise location (other than any your device embeds in an image you upload; see Images above), contacts, or advertising identifiers, and we don’t use third-party advertising or analytics trackers.
3. How we use it, and our legal bases
| Purpose | Legal basis (EEA/UK) |
|---|---|
| Create and run your account, sign you in, and provide the apps and features you use | Performance of our contract with you |
| Process subscription payments and keep billing records | Contract; legal obligation (tax and accounting) |
| Send transactional email: verification, password resets, invitations, and security notices such as a new sign-in | Contract; legitimate interest in account security |
| Send push notifications and keep your inbox, if you turn them on | Contract; consent for push, which you can turn off any time |
| Protect the Service: detect abuse, enforce rate limits, investigate security incidents, keep audit records | Legitimate interests in security and integrity; legal obligation |
| Troubleshoot and improve the Service | Legitimate interests |
| Comply with law and respond to lawful requests | Legal obligation |
We don’t sell personal information, don’t “share” it for cross-context behavioral advertising, and don’t use it to train AI models. We don’t make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. Who we share it with
- Service providers that host and run Substratal for us, under contracts that limit their use of the data: Amazon Web Services (hosting, database, email delivery through Amazon SES), our payment processor (payments), and Apple, Google, Mozilla and Microsoft push services (delivering notifications to your devices). See the current list on Sub-processors.
- Applications you use. When you open an application, it receives an access token with your user ID, email, email-verification status, whether you have access, and your permissions in that application. An application’s developer can see the information you give that application.
- Anyone with an image’s link. Avatars and Application icons uploaded to Substratal are served publicly from
assets.substratalapps.comso every app can display them; anyone who has the link can view the image, including any information your device embedded in it, such as a photo’s location. Don’t upload an image you don’t want to be public, and remove location data from a photo before uploading it. - Your Organization. Its administrators can see your name, email, role, and membership, and manage your access to its applications.
- Legal and safety. When required by law, or to protect the rights, safety, or property of our users, the public, or Composite Code.
- Business transfers. If Composite Code is involved in a merger, acquisition, or sale of assets, subject to this policy.
5. How long we keep it
| Data | Kept |
|---|---|
| Account and profile | Until you delete your account. Deletion takes effect immediately and the account is permanently erased 7 days later (Account and Data Deletion). |
| Sessions | Until they end: 30 days after last use, 90 days at most |
| Passkeys | Until you remove them, support resets your two-step verification, or your account is erased |
| Uploaded images | Until you replace or remove the image, or your account (or the Application) is deleted. Replaced versions are deleted within 7 days, and uploads never completed within 1 day |
| Request and security logs | 1 year for the API’s logs; 30 days for other operational logs |
| Usage statistics | 13 months |
| Notifications | 90 days. Delivery details: 30 days. Inactive devices: deleted 30 days after they stop receiving notifications |
| Audit records | Full detail for one year. After that, and immediately when an account is erased, the personal details are removed and only the record that an action happened remains |
| Billing records | As long as tax and accounting law requires (generally 7 years), held by our payment processor and us |
| Stored copies of mail sent to our contact addresses | 30 days; the forwarded copy is kept as long as needed to handle your request |
| Test-mode accounts created by developers | 30 days at most |
6. Your rights and choices
Depending on where you live (including under the GDPR, UK GDPR, and California’s CCPA/CPRA), you may have the right to:
- access your personal information and receive a copy in a portable format: Hub › Account › Privacy › Export, or
GET /users/me/export; - correct it: edit your profile in the Hub, or ask us;
- delete it: Hub › Account › Privacy › Delete account, or see Account and Data Deletion;
- object to or restrict certain processing, and withdraw consent (for example, turn off push notifications) at any time;
- not be discriminated against for exercising these rights.
To exercise a right we don’t offer in the Hub, email privacy@substratalapps.com from your account’s address. We’ll verify your identity and respond within 30 days (45 days under the CCPA, extendable where the law allows). You may use an authorized agent; we’ll ask for proof of authorization. If your data is held for an Organization or a developer’s Application, we may refer your request to them and help them answer it.
You can also complain to your local data-protection authority. We’d appreciate the chance to address your concern first.
7. Security
We protect your information with encryption in transit (TLS) and at rest, hashed passwords (Argon2id), encrypted two-factor secrets, optional two-factor authentication for everyone including phishing-resistant passkeys, required two-factor authentication for staff from November 5, 2026, with a fresh check before sensitive administrative actions, signed short-lived access tokens, least-privilege access for our systems, and audit logging. No system is perfectly secure; if a breach affects your personal information, we’ll notify you and the relevant authorities as the law requires, including within 72 hours of becoming aware of it where the GDPR applies. Report vulnerabilities as described in Security and Vulnerability Disclosure.
8. International transfers
We’re based in the United States, and Substratal is hosted in the United States (AWS us-east-1). If you’re outside the US, your information is transferred to and processed in the US. Where the GDPR or UK GDPR applies, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism, with our service providers as well.
9. Children
Substratal isn’t directed to children under 13 (or the higher age required in your country), and we don’t knowingly collect their information. If you believe a child has given us personal information, contact privacy@substratalapps.com and we’ll delete it.
10. Cookies
The web Hub uses only strictly necessary cookies and local storage, to keep you signed in and remember display preferences. See the Cookie Notice.
11. Changes
We’ll post updates here with a new effective date, and for material changes notify account holders by email or in the Hub at least 30 days before they take effect.
12. Contact
Composite Code LLC · privacy@substratalapps.com