Privacy Policy

Effective date: September 29, 2026

Last updated: September 29, 2026

BarnTrucking LLC (doing business as “Alpeya”, “we”, “us”, or “our”) operates the website available at https://alpeya.com (the “Service” or “Website”).

This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit or use the Service. It is written to reflect our actual technical architecture as of the effective date and to address requirements under applicable laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA and its 2026 regulations, and other U.S. state comprehensive privacy laws in effect in 2026.

By using the Service you acknowledge the practices described in this Policy. If you do not agree, please do not use the Service.

1. Who We Are / Controller

Controller
BarnTrucking LLC
Doing business as: Alpeya
7901 Dungan RD, Philadelphia, PA 19111, United States

Contact for privacy matters
Email: [email protected] (or contact form)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, BarnTrucking LLC is the data controller for the processing described in this Policy.

2. Scope

This Policy applies to information collected through the Website and related first-party services. It does not apply to third-party websites, services, or applications that may be linked from the Website (including content delivery networks, model hosts, and advertising partners), which have their own privacy practices.

3. Information We Collect

3.1 Information you provide directly

Feedback

When you submit feedback via the Website you may provide a message (up to 2,000 characters), an optional contact detail (up to 256 characters), and the page URL. We store the message, contact detail (if provided), page URL, a one-way hashed version of your IP address, and a timestamp. We do not require an account.

3.2 Information collected automatically

When you visit the Website our servers and infrastructure may process the following:

Category	What is processed	How / where stored	Retention (approx.)
Visit / request data	HTTP method, path (truncated), status code, hashed IP (HMAC-SHA256 of the IP using a server secret, truncated), user-agent string (truncated), timestamp	Application database (hashed IP only) and infrastructure logs	Application visits: 30 days (auto-purged). Infrastructure logs: provider-dependent
Tool usage counters	Tool identifier only (e.g. which tool was used)	Aggregated counters in application database; no per-user history	Indefinite (aggregate statistics)
Feedback records	As described in 3.1	Application database	As needed for support and abuse prevention; subject to deletion requests
Language preference	Preferred language	First-party cookie (lang)	1 year
Admin authentication	Session data (admin users only)	First-party session cookie	Session duration
Theme / consent preferences	Theme choice, cookie preference flags	First-party consent cookie (analytics_consent) and browser localStorage (not sent to our servers except the cookie)	Cookie: 1 year. Local storage: until cleared by you
Model / WASM caches	Downloaded models and engines (e.g. Demucs, OCR language data, upscaler weights)	Browser Cache API / IndexedDB	Until cleared by you or the browser

What we deliberately do not collect or store on our servers

• File contents (images, audio, video, PDFs, etc.)
• Filenames
• EXIF or other embedded metadata from your files
• Generated outputs or intermediate processing results
• Precise geolocation
• Biometric identifiers derived from your media
• Account credentials for ordinary users (there is no public registration)

Raw IP addresses appear only in infrastructure logs (nginx, Cloudflare, hosting provider) and are never written to the application database in clear form. Application-side processing uses a short, non-reversible hash of the IP.

3.3 Information processed by third parties (browser-direct)

Certain libraries, models, fonts, and services are loaded directly by your browser from third-party origins. Those parties receive standard network metadata (IP address, user-agent, referrer, etc.) necessary to deliver the resource. They do not receive your media files.

Examples include (non-exhaustive, subject to change):

• Content delivery / library hosts: cdn.jsdelivr.net, storage.googleapis.com, huggingface.co, tesseract.projectnaptha.com, fonts.googleapis.com, onnxruntime-web related hosts, TensorFlow.js / MediaPipe related hosts.
• Analytics: analytics.alpeya.com (self-hosted Umami instance; cookieless).
• Security / CDN: Cloudflare.
• Advertising (on release): Google AdSense and Google’s advertising partners.

We do not control the privacy practices of these third parties. Please review their respective privacy policies.

4. How We Use Information

We use the information described above for the following purposes:

• To operate, maintain, and improve the Website and tools.
• To record aggregated, anonymous usage statistics (which tools are used) so we can prioritise development.
• To receive and respond to feedback and to detect abuse or rate-limit submissions.
• To remember your language preference and (via local storage and a consent cookie) theme and consent preferences.
• To protect the security and integrity of the Service (rate limiting, bot detection, admin access controls).
• To comply with legal obligations and to enforce our terms.
• After AdSense is enabled: to display advertisements (including, where permitted, personalised advertising) and to measure ad performance, in accordance with Google’s terms and applicable consent requirements.

We do not sell personal information. We do not use the limited data we collect for cross-context behavioural advertising beyond what Google AdSense may do under its own policies and any consent you provide.

5. Legal Bases for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Legitimate interests (Art. 6(1)(f)): operating and securing the Website,aggregated analytics, abuse prevention, and basic functional preferences.We have balanced these interests against your rights and freedoms; theprocessing is limited, largely anonymised or hashed, and necessary for apublic tool service.
• Consent (Art. 6(1)(a)): non-essential cookies and similar technologies, and personalised advertising via Google AdSense, where required. You may withdraw consent at any time via the cookie / consent controls on the Website or browser settings.
• Performance of a contract / steps prior to contract (Art. 6(1)(b)): where feedback contact details are provided so we can reply.
• Legal obligation (Art. 6(1)(c)): where we must retain or disclose information to comply with law.

6. Cookies and Similar Technologies

6.1 First-party cookies we set

Name / type	Purpose	Duration	Essential?
lang	Stores language preference	1 year	Functional (yes for localisation)
analytics_consent	Stores your analytics choice (accepted or declined); read server-side so visits are recorded only after you accept	1 year	Functional (consent choice)
Admin session cookie	Authenticates administrative users only	Session	Strictly necessary for admin area

We do not set tracking or analytics cookies ourselves. Consent and preference flags are additionally mirrored in localStorage (cookie_consent, cookie_preferences) so the banner state survives on your device. See the full list in the Cookie Policy.

6.2 Local storage, Cache API, IndexedDB

Used solely on your device for:

• Theme preference
• Cookie / consent preference flags
• Versioning and caching of WASM engines and ML models (so tools work offline or load faster)

These items never leave your browser unless you explicitly clear them or the browser policy removes them (the analytics_consent cookie excepted, which is sent to our servers to enforce your choice).

6.3 Third-party cookies and similar technologies

• Cloudflare may set security-related cookies or use similar technologies as part of its protection services.
• Google AdSense (enabled on release) and its partners may set advertising cookies and use similar technologies (including for frequency capping, fraud prevention, and, where consented, personalisation).
• Other CDNs and library hosts generally do not set persistent cookies for ordinary resource delivery, but may receive network metadata.

6.4 Managing cookies and similar technologies

You can control cookies through your browser settings. For advertising preferences you may also visit:

• Google Ads Settings: https://adssettings.google.com
• Your Online Choices / NAI / DAA opt-out pages (as applicable in your region)
• Global Privacy Control (GPC): when your browser sends Sec-GPC: 1 and you have not made an explicit choice on this site, optional analytics stay off. Your explicit accept or decline in our banner or toggle takes precedence over the GPC default. We honour GPC and other universal opt-out signals where required by applicable U.S. state law.

In the EEA, UK and Switzerland, non-essential cookies and AdSense personalisation will be subject to a Google-certified Consent Management Platform (CMP) integrated with the IAB Transparency and Consent Framework, in accordance with Google’s EU User Consent Policy.

7. Analytics

We use self-hosted Umami (hosted in the United States under our control) for privacy-friendly, cookieless analytics. Umami does not set cookies and is configured to avoid collecting personal data beyond what is strictly necessary for aggregated page-view and event statistics. The analytics endpoint is served from analytics.alpeya.com. Analytics and visit recording run only after you accept in the cookie banner; declining leaves them off.

We do not use Google Analytics or similar third-party analytics platforms that rely on persistent identifiers.

8. Advertising (Google AdSense)

On release of the production site we intend to display advertisements via Google AdSense. No advertising cookies are set today.

• Third-party vendors, including Google, use cookies and similar technologies to serve ads based on a user’s prior visits to this Website and/or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads based on your visits.
• You can opt out of personalised advertising by visiting Google’s Ads Settings (https://adssettings.google.com) and the industry opt-out pages linked above.
• We will implement Google Consent Mode and a certified CMP so that, in regions where consent is required, personalised ads and related data processing only occur after valid consent.

For more information see Google’s Privacy Policy: https://policies.google.com/privacy and the Google AdSense Help pages on cookies and consent.

9. Sharing and Disclosure

We share or disclose information only in the following circumstances:

• Service providers / processors that help us operate the infrastructure (hosting, Cloudflare, email if used for feedback replies). These parties process data under our instructions and appropriate contractual safeguards.
• Legal requirements: when required by law, court order, or governmental request, or to protect the rights, property, or safety of BarnTrucking LLC, our users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to continued protection of the information.
• Aggregated / de-identified data: we may share aggregated, non-identifying statistics (e.g. total uses of a particular tool).

We do not sell personal information as defined under the CCPA/CPRA or comparable state laws. We do not share personal information for cross-context behavioural advertising beyond the limited disclosures inherent in using Google AdSense under the terms and consent framework described above.

10. International Data Transfers

The Service is operated from the United States. Information is processed in the United States (including our self-hosted Umami instance and infrastructure protected by Cloudflare).

Where personal data is transferred from the EEA, UK or Switzerland to the United States, we rely on appropriate safeguards, which may include:

• The EU-U.S. Data Privacy Framework (and UK/Swiss extensions) where applicable and valid,
• Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement / Addendum,
• Your consent where required, or
• Other transfer mechanisms recognised under applicable law.

You may request a copy of the relevant safeguards by contacting us.

11. Data Retention

• Application visit records (hashed IP, path, etc.): automatically purged after approximately 30 days.
• Feedback messages: retained as long as needed for support, security, or legal purposes; you may request deletion.
• Aggregated tool-usage counters: retained indefinitely in non-identifying form.
• Infrastructure and security logs: retained according to our hosting and Cloudflare provider policies.
• Cookies and local storage: controlled by you or by the stated lifetimes above.

When data is no longer needed we delete or irreversibly anonymise it.

12. Security

We implement technical and organisational measures appropriate to the limited nature of the data we process, including:

• Client-side-only media processing (files never leave your device for processing).
• Hashing of IP addresses before storage in the application database.
• Rate limiting and abuse controls on feedback and usage endpoints.
• HTTPS everywhere, Cloudflare protection, secure cookie flags (HttpOnly, Secure, SameSite where applicable).
• Restricted administrative access (secure session cookies, no-store cache headers).
• Regular review of third-party libraries and model sources loaded by the client.

No method of transmission or storage is 100 % secure. We cannot guarantee absolute security.

13. Your Rights

Depending on your location you may have some or all of the following rights:

GDPR / UK GDPR (EEA, UK, Switzerland)

• Access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection (including to processing based on legitimate interests), and withdrawal of consent.
• Right to lodge a complaint with a supervisory authority.

California (CCPA/CPRA and 2026 regulations) and other U.S. state privacy laws

• Right to know / access, delete, correct, and opt out of the sale or sharing of personal information and of targeted advertising.
• Right to limit the use of sensitive personal information (we do not intentionally collect sensitive personal information as defined under these laws).
• Right to non-discrimination for exercising your rights.
• We honour Global Privacy Control (GPC) - a GPC signal keeps optional analytics off even with a prior accept - and other universal opt-out preference signals where required.
• California residents may also use the Delete Request and Opt-out Platform (DROP) mechanisms once available for data brokers; we are not a data broker.

How to exercise your rights

Contact us at the email address in Section 1. We will respond within the timeframes required by applicable law (generally 30-45 days, with possible extension). We may need to verify your identity. Because ordinary users have no accounts and we store only hashed identifiers and limited feedback data, some requests (especially access to “all data about me”) may return limited or no records.

You may also clear local storage, cookies, and browser caches yourself at any time.

14. Children’s Privacy

The Service is not directed to children under 13 (or the higher age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

15. Automated Decision-Making and Profiling

We do not engage in automated decision-making that produces legal or similarly significant effects on individuals, nor do we perform profiling for such purposes. Client-side tools may use machine-learning models (face detection, background removal, etc.) solely on your device to produce the output you request; those models do not send results or media back to our servers.

16. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change, and material changes will be indicated on the Website or by other reasonable means. Continued use of the Service after the effective date of a revised Policy constitutes acceptance of the changes, to the extent permitted by law.

17. Contact

For privacy-related questions, requests, or complaints:

BarnTrucking LLC (Alpeya)
Email: [email protected]
(Website contact form or the address published on https://alpeya.com)

If you are in the EEA you may also contact your local data protection authority. A list is available from the European Data Protection Board.