Privacy in plain language.

Who handles your data

These are the companies that touch your data when you use Allgenda, and what each one is for. Each gets only what that job needs. The AI companies on this list work under API terms that don't let them train their models on what we send.

• Vercel. Hosts the site and runs our server code. Also counts visits without cookies (Web Analytics), measures page speed (Speed Insights), and screens some forms for bots.
• Supabase. Our database, sign-in, and file storage for recordings and photos.
• Upstash. Short-lived counters that enforce rate limits, and the encrypted relay used when you send an FFS photo from your phone.
• Google. Analytics, only if you allow it. The map, place details, Street View and place photos on venue pages and the add-a-place form. Gemini, which renders FFS previews.
• PostHog. Click and scroll heatmaps on our public pages about Allgenda, only if you allow analytics.
• MapTiler. Map images and place search on our map pages.
• OpenAI. Voice Lab's live coach, transcription, written feedback and session summaries. The first safety check on reviews, replies and photos. The backup renderer for FFS previews.
• Anthropic. A second safety check on every photo, and on any review or reply the first check wasn't sure about.
• Modal. Runs our own code that lines up and measures FFS previews.
• DigitalOcean. Hosts our own server for Voice Lab's acoustic analysis and for processing FFS contributions.
• Stripe. Card payments and memberships.
• Brevo. Sends our email and holds the marketing and waitlist contact lists.
• Apple, Google, or Discord. Only if you sign in with one of them. They share your name and email address with us.

Analytics

Vercel Web Analytics and Speed Insights count visits and measure page speed without cookies and without identifying you. We also use Google Analytics 4, but only if you allow it. On your first visit a banner asks, and until you choose Allow analytics, Google Analytics sends nothing and writes no cookies (Google's Consent Mode v2, set to “default denied”).

If you allow it, we record page views and a small set of product events (things like search, filtering, viewing a venue, getting directions, or filing a report) to learn which features actually help people find welcoming places. On our public pages about Allgenda (the home page, the product pages, pricing, about and the like), that also covers how far down a page you scroll and which links you click. Advertising signals always stay off, whatever you choose. If you're signed in, we send a one-way SHA-256 hash of your user ID so we can count return visits across devices. We never send your email, your name, or anything you typed into a form. Your choice is saved in your browser, and in your account if you're signed in. Change it anytime via Privacy choices in the footer.

Allowing analytics also turns on heatmaps from PostHog, on those public pages only. A heatmap records where on a page people click, where the pointer rests, and how far they scroll, along with the page's address, your screen size, and what browser and device you use. It never records your screen or anything you type, sets no cookies, and stores nothing on your device. To tell one visit from another, PostHog works out a one-way code from your IP address and browser. The code changes every day, and PostHog drops the IP address once it has made it. Heatmaps don't run on the free pitch meter, the map, venue pages, or anything in your dashboard.

Maps and location

Our map pages (the map, city pages, and Inclusive Spaces) are drawn with MapTiler. Your browser loads the map images and runs place searches straight from MapTiler, so MapTiler sees your IP address and what you search for.

Venue pages show Google's map and Google's place details. Your browser loads that map from Google directly, under the Google Privacy Policy. The add-a-place search, Street View images, and place photos go through our server instead, so Google gets what you searched for but sees our server, not you.

If you tap the locate button or ask for your nearest city, your browser shares your location with the page so it can center the map or pick a city. That happens in your browser. On Add a place, “Use my location” sends your location through our server to Google once, to list places nearby. We don't store your location either way.

Your account

You don't need an account to browse Allgenda or read listings. You do need one to post a review, reply, or photo, to report a problem or add a place, to claim a venue, to use Voice Lab or the FFS Results Lab, or to buy credits. You can sign up with an email and password, a one-time email link, or Apple, Google, or Discord.

Your profile can hold a display name, username, pronouns, a short bio, identity tags, and an avatar. All of them are optional. Other people see your display name on reviews and replies you post. There are no public profile pages yet; the visibility you pick under Settings › Privacy is saved and will apply when they arrive. Avatars are re-encoded on our server, which removes location and camera data.

We use account data to run these features and to keep the directory free of abuse. We never sell, rent, or swap it.

Reviews, photos, and reports

Reviews, replies, and photos are public and show your display name. Before a photo is stored, our server removes its location and camera data. Within a few minutes of posting, each one gets an automated safety check: OpenAI's moderation model reads everything, and Anthropic's Claude takes a second look at every photo and at any text the first check wasn't sure about. The content policy covers what happens after that.

A venue never sees who filed a report about it. When you report a problem with a venue, moderators can see which account sent it so they can follow up. When you report a review or reply, moderators see the reasons you gave, not who you are. We don't share reports with law enforcement unless a valid legal process compels us.

Voice Lab

Voice Lab is voice practice, so it works with sensitive data like your voice, and optionally a note about hormones. We treat both with extra care, and none of it is collected until you opt in. OpenAI handles the AI parts below. It doesn't train on this data and keeps it for up to 30 days only to check for abuse.

• Live coaching.When a coached session starts, your browser connects straight to OpenAI's realtime voice model, so your microphone audio goes to OpenAI while the session runs. Our server sets up the call and can end it, but the audio doesn't pass through us, and nothing is uploaded unless you tap Save clip. What you and the coach say is transcribed (by OpenAI Whisper) and kept as the session transcript for 90 days, then deleted. We ask for your consent before your first session.
• What the coach remembers.After each session, OpenAI writes a short summary (what you're working on, cues that helped, a plan for next time) that your next session starts from. It doesn't quote you and never includes hormone details. You can read it and erase it under What the coach remembers in Voice Lab settings.
• Recordings and voice checks. A recording you save goes into private storage only you can reach. We measure things like pitch and resonance on a server we run ourselves. For a voice check, OpenAI Whisper transcribes the recording, and OpenAI writes your feedback from that transcript and the measurements. Recordings, their transcripts, and their measurements delete themselves after 90 days.
• Check-ins and your practice record.Goals, wins you log, the optional check-ins every few weeks, your answers to “How does your voice feel?”, and the name of the microphone you practice with (so your trends don't mix setups) stay until you delete them.
• Hormone (HRT) context is optional.The field defaults to “Prefer not to say.” If you do share it, we use it only to personalize coaching, we send it to OpenAI only inside the coaching instructions for a live session, and we never log it, attach it to analytics, or sell it. You can erase it instantly with Clear my HRT info in Voice Lab settings.
• The free pitch meter on the try page runs entirely in your browser. It records nothing and uploads nothing.

You can delete any single recording yourself, or use Delete all my Voice Lab datain settings to permanently erase your recordings, transcripts, measurements, sessions, the coach's memory, goals, wins, check-ins, voice check-ins, microphone details, and any HRT note in one go. Your settings (goal direction, pitch range, coach style, and level) and the record of what you consented to stay until you delete your account. Withdrawing voice-recording consent stops future sessions and lets you remove past recordings on your terms.

FFS Results Lab

The FFS Results Lab learns from pre-op and post-op facial feminization surgery photos to show a range of plausible outcomes. It's open to anyone signed in with a verified email. A face is about as personal as data gets, so nothing here happens without an explicit opt-in, and nothing is ever public.

• Where the reference photos come from. Clinics and platforms that gave us written permission to use their published results, original photographs exported by partner clinics under an agreement, and members who choose to contribute their own. We never fetch a gallery without that agreement on file.
• If you contribute. You agree in two separate checkboxes: to research use (required) and to use in a paid version of the preview (optional, and you can switch it off later). Your photos go into private storage with location, device, and timestamp data removed. A small review team sees them through links that expire in minutes, and so do you. They are never shown publicly, never sold, never shared with clinics, and never used for anything except this project.
• Processing. To line photos up and check that a pre-op and a post-op photo show the same person, contributed photos are processed on a server we run ourselves. They are never sent to a third-party AI service.
• Withdrawing.Withdraw any time from your FFS Results Lab page. Your photos are deleted from our storage right away and left out of every future training set. A model that was already trained isn't retrained on the spot; we say so before you contribute.
• Trying the preview. The photo you pick is used for that one render and nothing else. Our own code, running on Modal, lines it up and measures the result in memory. The editing itself is done by Gemini 3 Pro Image. It is sent to Google's Gemini API to render. Under Google's paid API terms the photo is not used to train Google's models and is kept only for a limited time to check for abuse; we keep no copy. If Gemini 3 Pro Image fails or declines, the photo goes to OpenAI GPT Image 2.5 instead. It is sent to OpenAI's image API to render. Under OpenAI's API data policy the photo is not used to train OpenAI's models and is retained for up to 30 days for abuse monitoring; we keep no copy. Every result says which model made it. On our side the photo is never written to storage or a database, never added to the training set, never seen by our review team, and never shown to anyone else. We keep no copy, so there is nothing to delete afterwards and nothing to hand over if we were ever asked. If the model that renders the preview changes, this paragraph changes with it.
• Sending a photo from your phone. The preview can show you a QR code so you can take the photo on your phone instead. If you use it, your phone encrypts the photo before it leaves, using a key that is generated in the browser tab showing the code and never sent to us. The encrypted bundle passes through a relay we run, which is the one point where a copy briefly exists on our side, and it is deleted the moment your computer picks it up, or after five minutes if it never does. We never hold the key, so that copy is not one we can open.

The Commons

The Commons, our community space, is open only to invited members while we test it. Posts and comments can be read by other members, and by anyone at all in rooms marked public. Commons posts are moderated by people, not by an automated check. Direct messages are encrypted before they're stored, with a key kept outside the database. Moderators can't browse them; a conversation is only opened for review if someone in it reports it.

Payments and donations

When you buy credits or a membership (Allgenda Dues), payment is processed by Stripe. Your card details go straight to Stripe and never touch our servers. Stripe's payment form also asks for your country and postal code. We keep a Stripe customer reference, your membership status, and a record of your credit balance, never your card number. For each purchase we also record that 5% was set aside for the nonprofit you picked at checkout, so we can report on it.

Email and marketing

We send two kinds of email. Account and purchase email (welcome notes, receipts, membership changes, payment problems, password resets) is sent because you have an account or made a purchase. It carries no marketing, and you can't unsubscribe from it while your account is open.

Marketing emailis occasional product news, new features, and announcements, sent only if you opt in. In the US the opt-in box may be pre-checked (you can clear it); in the EU, UK, and Canada it's unchecked and we only email you if you check it. Only Allgenda sends these. We never share or sell your address, and every marketing email has a one-click unsubscribe. You can manage this anytime under Settings › Email. If you join a waitlist for something that isn't open yet, we keep your email and which product you're waiting for, so we can tell you when it opens.

We use Brevo(Sendinblue GmbH) to deliver email and to hold the marketing and waitlist contact lists. We record when and how you gave consent (date, source, region, the browser you used, and the exact wording you agreed to) so we can honor and prove your choice. If you delete your account, we remove your contact from Brevo and keep only a minimal consent record for as long as the law requires, then delete it. We don't store your IP address for email consent.

Security records

To keep Allgenda from being abused, rate limits count requests by IP address or account. Those counters live in Upstash and expire on their own, within minutes to a day. For a short list of events (failed sign-ins, starting a checkout, sending feedback, and adding a place) we also log the time, the account, and the IP address, and keep those records while we need them to investigate abuse. Our server logs strip emails, phone numbers, and sign-in tokens before anything is written.

Calls to venues

We built a tool that phones venues with an automated, yes-or-no script to confirm a listing. It points at businesses, not people, and it's separate from Voice Lab. It's switched off right now, so no calls are being made. If we turn it on, each call opens by saying it's automated and may be recorded, never turns into a sales pitch, and keeps a short clip for about two weeks so a moderator can check call quality before it's deleted automatically. A call that reaches a do-not-call number is deleted immediately.

Age

Allgenda is for people 13 and older. If we learn that someone younger has made an account, we'll delete it. If you think that's happened, tell us through the contact form.

Your controls

• Analytics: allow, decline, or change your mind anytime via Privacy choices in the footer.
• Marketing email: one-click unsubscribe, or toggle it under Settings › Email.
• Voice Lab: clear your HRT note, erase what the coach remembers, delete individual recordings, or erase all your Voice Lab data from Voice Lab settings.
• FFS Results Lab: withdraw any contribution from your FFS Results Lab page. The photos are deleted immediately.
• Your whole account: choose Delete account under Settings › Account, which sends a request through the contact form. We handle deletions by hand so nothing is lost by accident, then remove your profile, submissions, Voice Lab data, and any FFS Results Lab contributions, photos included.

Questions about any of this? Email trust@allgenda.com.