How Align handles your data

Who we are

Align (alignfigures.com) is a small team building a figure editor for scientists. “We” in this policy means Align. You can reach us at hello@alignfigures.com.

What we collect, and why

Your account

Your name, email address, and password (stored only as a one-way hash we can't reverse). If you sign in with Google, we receive your name, email, and profile picture from Google, plus the sign-in tokens Google issues. We also keep your settings, such as your preferred AI model and any standing instructions you give the AI. We use this to run your account and nothing else.

Your documents

A document you create lives in your browser and in the .align files you save. Our servers don't receive it in normal use. That changes only when you choose one of these:

• Sharing or cloud-saving a document. We store the document (code, text, layout, images) so collaborators and your other devices can open it. Data files you attach are encrypted in your browser before upload. We hold the key so that people you share with can open them, so this protects against someone with access to our file storage alone. It is not end-to-end encryption. Each document's data setting controls whether files are stored at all (see below). A deleted cloud document can be restored for 30 days; after that we permanently delete it.
• Using the AI, covered in the next section.
• Sending feedback. A feedback report can include a screenshot, a PDF of the document, its code, and its local history, and optionally its data files. You can untick any of these before sending. We use reports only to fix the problem you're reporting.

Each document's data setting

Every document has a setting for the data files inside it:

• This device only: data files never leave your computer. The AI sees column names and types, not values.
• Stored with the document: an encrypted copy is stored so the document works elsewhere. The AI still sees only column names and types.
• Stored and readable by the AI: the AI may also read rows from your data to answer questions. Those rows are sent to Anthropic.

The AI assistant

When you send the AI a message, we send Anthropic (the company behind Claude) what it needs to help:

• Your message and the conversation so far.
• The relevant parts of your document: code, text, and images of the figures.
• Data rows, only when the document's setting allows it.
• An internal account ID, not your name or email.

Under Anthropic's commercial terms, data sent through its API isn't used to train its models.

We keep a copy of your AI conversations and of the exact requests and responses exchanged with Anthropic. That's how your chat history works, how we bill AI usage, and how we find and fix the AI's mistakes. Members of the Align team can read these conversations to diagnose problems and improve the assistant. We sometimes use an AI model to help sort through them; that sends the conversation to Anthropic again, under the same terms. We currently keep conversations until you ask us to delete them.

Usage analytics

We record which features get used (for example “created a figure” or “opened the AI panel”) so we know what to improve. These events are stored in our own database, not sent to an analytics company. They never include what you type or the content of your documents, and we don't record your IP address or browser details with them. If you're signed out, they're tied to a random ID stored in your browser. If your browser sends Do Not Track or Global Privacy Control, we don't record them at all.

Payments

Payments are handled by Stripe. You enter your card details on Stripe's pages; they never touch our servers. We keep your plan, subscription status, and Stripe's customer reference, and Stripe receives your email so it can send receipts.

Email

We send email only when needed: verifying your address, resetting your password, and telling you someone shared a document with you. We don't send marketing email. When you sign up or join the waitlist, the Align team gets a notification with your name and email.

The RStudio and Jupyter plugins

The plugins talk to Align only to sign you in and to run the AI assistant (same rules as above). “Open in Align web” saves a file on your computer that includes your R session objects. That file isn't uploaded unless you later share the document or attach it to feedback.

Connected AI clients

If you connect another AI tool to Align (through our MCP server), that tool can read the documents you authorize it to, including their data files, and its provider's own privacy policy applies to what it receives. You can revoke access at any time from your account page.

People we contact about Align

If we've emailed you about Align, we keep a record of that conversation (your name, email, company, role, and our messages) in our internal outreach tool, together with publicly available professional details. We use it only to follow up with you. Ask and we'll delete it.

Who else handles your data

We use a small number of providers, each only for the job listed:

To run R and Python in your browser, your browser also downloads the runtimes and packages straight from public sources (webR, r-universe, jsDelivr, PyPI). Like any download, those servers see your IP address and which packages were fetched, but nothing from your documents.

We don't sell personal data, and we don't share it for advertising.

Cookies and browser storage

We use one sign-in cookie to keep you logged in (it lasts up to 30 days), plus your browser's local storage for your documents, settings, and the random analytics ID mentioned above. No advertising or cross-site tracking cookies.

How long we keep things

• Account data: while your account exists (see deletion below).
• AI conversations and request logs: until you ask us to delete them.
• Usage analytics events: kept for product history.
• Feedback reports: until you ask us to delete them.
• Deleted cloud documents: restorable for 30 days, then permanently deleted.

Deleting your account

You can delete your account from your account settings. We cancel your subscription, hand off or delete your cloud documents, and lock the account. For 30 days you can change your mind and restore it. We haven't yet automated permanently erasing everything after those 30 days. If you want that, email hello@alignfigures.com and we'll erase your account data, AI conversations, and feedback by hand.

Your choices and rights

Wherever you live, you can ask us for a copy of your data, to correct it, or to delete it. Just email hello@alignfigures.com and we'll respond within 30 days. Depending on where you live (for example the EU, UK, or California), you may have additional legal rights, including to object to processing or to complain to your local data-protection authority. We honor those rights.

Security

All traffic is encrypted (HTTPS). Passwords are hashed, API tokens are stored only as hashes, and data files in shared documents are encrypted before upload. Only the small Align team can reach production data. No system is perfectly secure; if something goes wrong that affects your data, we'll tell you.

Where your data is processed

Align and its providers are primarily based in the United States, so your data is processed there, wherever you use Align from.

Children

Align is for researchers and isn't directed at children under 16. We don't knowingly collect their data.

Changes

When our data practices change, we update this page and the date at the top. For significant changes, we'll also let account holders know by email.

← Back to Align