Privacy Policy

Last updated: November 10, 2026

1. Introduction

This policy explains what personal data alsok.org collects, why, how long it is kept and what you can do about it. It covers the website alsok.org, the API under alsok.org/api/ and the Telegram bot of the transcription tool (together, the "Service").

Data controller: Alexander Sokolov ("Alsok"), 25/9, MOO.6, Bo Phut, Ko Samui, Surat Thani, 84320, Thailand. Contact: [email protected].

The Service is a personal research lab. It is free, it shows no advertising and it runs no analytics or tracking scripts.

Not covered by this policy:

Anonymizer at anonymizer.alsok.org runs entirely in your browser. Files you open there are not uploaded to us.
cv.alsok.org and vitalitynode.com are separate sites.

2. Information we collect

Account. Your email address and a username made from the part of the address before the @. There are no passwords: you sign in with a one-time code sent by email. Accounts created in the past through Telegram also hold a Telegram user ID.

Sign-in codes. For each code we send: your email address, a hash of the code and of the sign-in link, the time, and the IP address the request came from. The IP address is used to limit how many codes one address can request.

API keys. The name you give a key, its first characters, a SHA-256 hash of the key, when it was created and when it was last used. The key itself is shown once and is not stored.

Rates requests, on the website and through the API. The request parameters (currencies, date, source), the result, the time and the User-Agent header. If you are signed in or use an API key, the request is linked to your account. If you are not, it is linked to a keyed hash of your IP address (API) or of your session ID (website). The raw IP address is not written to this journal. We keep the journal to count requests against the limits and to build the proof for each answer.

Each successful Rates answer has a proof at a public address with a random ID. The proof holds the request parameters and the source documents. It holds no account, contact or network data.

Transcription. The audio or video file you upload, its duration, the transcript with timestamps, and either your account or your session ID. If you use the Telegram bot, also your Telegram chat ID, so the bot can send the result back.

Feedback. Your message, the reply email if you give one, the page you sent it from, the Rates request ID if there is one, your account if you are signed in or a keyed hash of your IP address if you are not, and the User-Agent header.

Server logs. The web server records the IP address, time, requested address, response code, referrer and User-Agent of each request.

What we do not collect. No analytics profiles, no advertising identifiers, no payment data. The Service does not sell anything.

3. Legal basis for processing (GDPR Article 6)

Contract, Article 6(1)(b): your account, sign-in codes, API keys, and running the tools you ask for (rates, transcription).
Legitimate interests, Article 6(1)(f): request limits and protection against abuse, the request journal and proofs, server logs, answering feedback, keeping the Service secure and working.
Legal obligation, Article 6(1)(c): when the law requires us to keep or disclose data.

We do not rely on consent, because the Service sets no optional cookies and sends no marketing email.

4. How we use your information

To sign you in and keep you signed in.
To run the tools and return their results.
To count requests and minutes against the published limits.
To build the proof that comes with each Rates answer.
To send sign-in codes and, rarely, notices about your account or about changes to the terms.
To answer feedback and fix bugs.
To detect and stop abuse.

We do not use your files, transcripts or requests to train models, and we do not build advertising profiles.

5. Data retention

Data	Kept for
Account, API keys	Until you ask us to delete the account
Session cookie	30 days after your last visit
Rates requests without an account	35 days
Rates requests of an account	Until the account is deleted
Uploaded audio or video	Deleted as soon as processing ends, whether it succeeds or fails. Leftovers of an interrupted job are removed by a nightly cleanup
Transcripts	90 days
Feedback messages	1 year on the server. The copy delivered to the operator's Telegram chat is deleted on request
Sign-in code records	30 days
Server logs	A limited time, for security and troubleshooting

You can ask us to delete any of this earlier.

Official rate tables and market data that we store as proof are public documents of their publishers, not personal data, and are kept permanently.

6. Cookies

The Service uses only cookies it cannot work without. There are no analytics, advertising or social media cookies, so there is no cookie banner to accept or decline.

Cookie	Purpose	Lifetime
`sessionid`	Keeps you signed in. Without an account, counts your use of a tool against the anonymous limits	30 days after your last visit
`csrftoken`	Protects forms from forged requests	1 year
`__cf_bm`, `cf_clearance`	May be set by Cloudflare to tell people from bots, including the check on the feedback form	Up to 30 minutes and up to 1 year, as set by Cloudflare

You can delete or block these cookies in your browser. Reading pages and calling the API will still work. Signing in and forms will not.

Files loaded from other servers. Pages load fonts from Google Fonts and scripts from unpkg.com and cdn.tailwindcss.com. Your browser requests them directly, so these providers see your IP address and browser details. They set no cookies on alsok.org.

7. Sharing of information

We do not sell your personal data. We share it only with the providers that run the Service:

Provider	What it does	What it receives
Cloudflare	Network delivery, protection against abuse and bots	IP address and the content of every request as it passes through
Oracle Cloud	Server hosting, in the United States	Everything stored on the server
Resend	Sends sign-in emails	Your email address and the message with the code
Groq	Speech recognition for transcription	The audio of the file you upload
Telegram	Delivers transcripts to bot users. Delivers feedback and error alerts to the operator	Your chat ID and transcript if you use the bot. The text of your feedback message, with the reply email if you gave one
Google Fonts, unpkg, Tailwind CDN	Serve fonts and scripts to your browser	IP address and browser details

We may also disclose data when the law requires it or to protect the Service from abuse.

8. Your rights under GDPR (EEA and UK users)

You have the right to:

access your data (Article 15);
correct it (Article 16);
have it deleted (Article 17);
receive it in a portable format, JSON or CSV (Article 20);
restrict its processing (Article 18);
object to processing based on legitimate interests (Article 21).

Write to [email protected] from the address of your account. We answer within 30 days. You also have the right to complain to your data protection authority.

Similar rights may apply under other laws, including Thailand's Personal Data Protection Act. Write to the same address and we will handle the request the same way.

9. Your rights under CCPA (California users)

You have the right to know what personal information we hold about you, the right to have it deleted and the right not to be treated differently for using these rights. We do not sell or share personal information, so there is no opt-out to offer.

10. International data transfers

The servers are in the United States and the operator is in Thailand. The providers listed in section 7 may process data in other countries. Where the law requires it, transfers rely on the standard contractual clauses offered by these providers.

11. Data security

Connections are encrypted with TLS. There are no passwords to leak: sign-in codes, sign-in links and API keys are stored only as hashes. Access to the server and the database is limited to the operator. No system is perfectly secure, and we cannot promise absolute security.

12. Children's privacy

The Service is not intended for anyone under the age of 18, and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.

13. Changes to this policy

When this policy changes, we publish the new text on this page with a new "Last updated" date. If the change is material, we also email registered users.

14. Contact us

Questions and requests about your data: [email protected].

Alexander Sokolov, 25/9, MOO.6, Bo Phut, Ko Samui, Surat Thani, 84320, Thailand.