Alpha IN · alphain.space

Alpha IN Privacy

Last updated: October 24, 2026. This page explains, in plain words, exactly what Alpha IN stores, why, and what we never do. If a claim is on this page, it is because the product actually works that way.

The short version

No ads. No selling your data. No third-party trackers. One cookie.

• No ads — there is no advertising in Alpha IN, and nothing you do here feeds an ad system.
• We never sell your personal information — not your details, not your mail, not anything.
• No third-party trackers — Alpha IN's own pages load no analytics scripts, no ad pixels, no external fonts or code from other companies. Nothing phones home about you.
• One cookie — a single sign-in cookie named ain_session. It holds a random token (not your password, not your details), is marked HttpOnly, Secure and SameSite=Lax, and lasts 30 days. Our server stores only a hash of that token — so even the cookie's value is never kept in readable form.

What we store — and why

Your name, date of birth and country

Alpha IN's promise is verified real people, and these details are how the promise is kept: your date of birth proves you meet the 18+ rule, your name proves the account stands for a real person (and blocks impersonators), and your country comes from the real list of countries. We store them as part of your account profile so the verification stays on record — they are not used for advertising, ever.

Your backup email

Your backup email is where verification codes go — at signup, at sign-in and when you reset a password — and it is your way back in if you forget your password. We store it so those codes can reach you. It is only ever shown back masked (like s•••@example.com).

Your password — never in readable form

Your password is stored only as a salted PBKDF2 hash (100,000 rounds of SHA-256). Nobody — including Alpha IN — can read it back. Verification codes get the same treatment: stored only as hashes, and they expire 10 minutes after they are sent.

Your mail and attachments

Your messages live in Alpha IN's database and your attachments in Alpha IN's file storage, on Cloudflare infrastructure — that is simply what makes your mailbox work, from any device. They count toward your 5 GB of storage, and deleting them removes them (Trash deletes permanently after 30 days).

Your sign-ins

Each signed-in session records the device/browser, the network (IP) address and the last activity time. This exists for one reason: so Settings → Active Sessions can show you every place you are signed in, and let you revoke any session you do not recognize. A password change signs out your other sessions automatically; a password reset signs out everything.

Short-lived security records

To stop bots and brute force, Alpha IN keeps verification attempts and rate-limit counters. These are abuse-fighting records, not a profile of you: rate-limit events are pruned within 24 hours, unfinished signups expire within minutes, and used or expired codes are deleted.

What we never do

• We never sell your personal information.
• We never show ads, and we never build advertising profiles from your mail or your activity.
• We never load third-party trackers on Alpha IN's pages.
• We never store your password or your verification codes in plain text.

Who can see your mail

Only you, while signed in to your account. System messages from verification@alphain.space — your codes and account notices — are automated; no person writes or reads them. Your inbox is not read to target ads or for marketing, and it is never a product to be sold.

Security, concretely

• Passwords: salted PBKDF2 hashes, 100,000 iterations of SHA-256.
• Codes: 6 digits, hashed, 10-minute expiry, limited attempts and resends.
• Sessions: random tokens, stored hashed, 30 days, revocable one by one or all at once.
• Connections: HTTPS everywhere, with strict security headers and cross-site request blocking on the whole service.

Your controls

• Change your password in Settings — your other sessions are signed out automatically.
• Change your backup email in Settings — it only takes effect after a code sent to the new address proves it is yours.
• See and revoke every active session in Settings → Active Sessions.
• Delete any message; empty Trash or delete forever for permanent removal. Trash also deletes itself after 30 days.
• Watch your storage in Settings — every account has 5 GB, and deleting frees space immediately.

Where your data lives

Alpha IN runs on Cloudflare's global network — its database (D1) and file storage (R2). There are no home servers and no office machines holding your mail; it lives in professional cloud infrastructure that stays on around the clock.

Changes and contact

If this policy changes, the updated version will be posted here with a new date. Questions about privacy at Alpha IN: reach the founder through benjaminocal.com.