Privacy Policy

Aplodex operates aplodex.com, a technology and AI advisory website, and a private, access-gated workspace. This policy explains what data we collect, how we use it, who handles it, and the choices you have. The first sections cover the website. A later section covers health data from connected accounts such as WHOOP in the private workspace.

What the website collects

When you send us a message through the contact form, we receive your name, email address, company, the topic you pick, and your message. We also record the IP address and browser details (user agent) the message came from. We use Cloudflare Turnstile on the form to block automated abuse, and it checks the request with Cloudflare, including your IP address.

If you use the chat assistant on the site, we receive the messages you type. We store the conversation along with your IP address, browser details, and the page you were on. Your messages go to an AI model provider to write the replies: Anthropic by default, or OpenAI if we switch the setting. Your browser also keeps the conversation in session storage so it persists as you move between pages, and it is cleared when you close the tab.

If you ask us to follow up, we email ourselves a summary and the full chat. The email goes out through Google’s Gmail, and the same AI model provider that writes the replies also writes the summary.

When you book a meeting at aplodex.com/meet, we collect your name, email address, any notes you add, and the time you pick. We also record your IP address and browser details (user agent) with the booking. We email you a one-time code to confirm your address, and Cloudflare Turnstile checks the request. Once you enter the code, we create a Google Calendar event with a Google Meet link, and Google emails you the invite. The event lists your name, email address, and notes. Before the call we may look up your name, email domain, and firm. We use a web search and page-reading service (Firecrawl), a LinkedIn people search, and SEC filings. An AI model (Anthropic’s API) turns that and your notes into a short prep note for us. If your meeting is soon, we also send ourselves a notice with your name, email address, and that note, by email and by Telegram.

Sign-in uses your email address and a one-time code we email you. The code expires after 10 minutes. We store only a hashed version of the code, and a successful sign-in sets a session cookie in your browser. We do not store your password in readable form.

Standard server logs (IP address, browser type, timestamps) are generated when you load a page.

How we use it

We use website data to read and answer your messages, run the chat assistant, prepare for meetings you book, let approved people sign in, limit abuse, and keep the site secure. We do not sell your data and we do not use it for advertising.

Who handles your data

We rely on a small set of processors that handle data only on our instructions: Supabase (database hosting), Vercel (application hosting), Google (email delivery and Google Calendar), Cloudflare (bot protection), Firecrawl (web lookups for meeting prep), Telegram (our own booking notices), and an AI model provider, Anthropic by default or OpenAI if we switch the chat setting. We do not authorize these processors to use your data for their own purposes.

Storage and security

Data is stored in a managed Postgres database (Supabase) and encrypted in transit. Access to the private workspace is restricted to authenticated users.

Retention and your choices

We keep data only as long as it is needed for the purpose it was collected, unless the law requires us to keep it longer. You can ask us to tell you what we hold about you or to delete it, including contact messages and chat conversations, by emailing privacy@aplodex.com. You can stop using the chat assistant at any time.

Connected health data (private workspace)

This section applies only if you connect a third-party health account such as WHOOP in the private workspace. It does not apply to visitors to the public website.

We access only the data categories you authorize. For WHOOP this may include recovery (including heart-rate variability and resting heart rate), sleep (duration and timing), daily cycle and strain, workouts, and basic profile and body-measurement details. We request these through WHOOP’s OAuth flow, and you approve the exact scopes before any data is shared.

Health data is used solely to power a personal dashboard for the individual who connected the account: computing a daily readiness score, showing trends, and generating a short written summary of the day. We do not use your health data for advertising. We do not sell it, rent it, or share it with data brokers. We do not use it to build profiles for anyone other than you.

To generate the written daily summary, a limited set of derived metrics (for example, the readiness score and sleep hours) may be sent to Anthropic’s API. We do not send this data to any other third party.

Access tokens for connected services are encrypted before they are stored. The dashboard and its data are restricted to the authenticated owner of the account. The application reads from our own database rather than calling connected services on page load.

You can disconnect a connected service such as WHOOP at any time, which revokes our access going forward. You can also revoke Aplodex’s access directly from your WHOOP account settings. You may request deletion of the data we hold about you, including any imported health data, by emailing us. We delete data when it is no longer needed for the purpose it was collected, or on request, unless we are required to retain it by law.

Contact

Questions about this policy, or a request to access or delete your data, can go to privacy@aplodex.com. You can also reach us through the contact page.

We may update this policy as Aplodex changes. The “last updated” date at the top reflects the most recent revision.