Alternaut
Download for Windows
Menu
Back to Alternaut

Website, Windows app and recommendation service

Privacy policy

Alternaut is designed to keep your installed-app inventory and usage history on your computer. This notice explains what stays local, what is sent when you request recommendations, and the limited technical data used to operate the service.

Last updated: 18 September 2026

Local by default
Your installed-app inventory and usage history stay on your PC.
No account
The current app does not require an account or install identifier.
No tracking
The website currently uses no analytics or advertising cookies.
Small requests
Recommendation requests send app and task context, not usage history.

1. Who is responsible

Dejan Honderd, operating Alternaut, is the controller for the personal data described in this notice. For a private privacy request, email [email protected].

This policy covers alternaut.app, the Alternaut Windows desktop application, and the recommendation API at api.alternaut.app.

2. Data kept on your PC

The desktop app stores the following information locally:

  • Installed application name, publisher, version, local icon and last scan time in alternaut.sqlite.
  • Foreground process name, timestamps and idle status inactivitywatch.db. Alternaut uses this to calculate recent active time and order your apps.
  • Previously returned product, task and recommendation responses in a bounded recommendations.json cache.

Alternaut does not record window titles, visited URLs, keystrokes, document contents or a screen recording. Existing ActivityWatch databases are read locally and are not modified by Alternaut.

3. Data sent to the recommendation service

When Home is visible, the app may automatically look up as many as three eligible apps. A manual recommendation request also contacts the service. Depending on the step, a request can contain:

  • one selected app name and a known display-name alias;
  • the resolved product and selected task identifiers;
  • your selected goal, such as cheaper or more private;
  • a Windows compatibility constraint; and
  • network information needed to deliver and protect the service, including your IP address and request metadata.

Alternaut does not send the complete installed-app list, active-time totals, raw usage history, window titles, URLs, interview text or a machine identifier. The public API does not create user profiles or keep a per-user recommendation history.

Product icons returned by the API can load from an external image host. The desktop app removes cookies and referrer information from those requests and rejects cookies in the response. The image host can still receive your IP address and basic request metadata.

4. Website data

When you visit alternaut.app, the hosting and network providers process your IP address, request time, requested path, browser or user-agent information, and similar technical data needed to return the site and protect it from abuse.

The website currently has no account, contact form, behavioural analytics, advertising technology or non-essential cookies. The homepage loads an official badge image from Product Hunt. Product Hunt can receive your IP address, browser information and basic request metadata when that image loads. Links to other sites are governed by their own privacy terms after you follow them.

5. Purposes and legal bases

We process the limited service and website data to:

  • return software information and recommendations you request;
  • operate, secure and troubleshoot the website and API;
  • apply short-lived rate limits and prevent misuse; and
  • respond when you contact us about privacy or support.

Under the GDPR, these purposes rely on our legitimate interests in providing and securing a free, anonymous software-recommendation service. We balance those interests through data minimisation, short retention, no behavioural advertising and local-first app processing. You may object to this processing as described below.

Recommendations are automated, but they do not produce legal or similarly significant effects. Alternaut does not sell personal data or use it for advertising.

6. Sharing and international transfers

We use Railway to host the website and Cloudflare to deliver and protect public network traffic. Infrastructure providers may process technical request data on our behalf. External icon hosts receive only the information described above when an icon is requested. Product Hunt receives the limited badge-request data described in the website section.

These providers may process data outside the European Economic Area. Where required, transfers are protected through an adequacy decision, the EU Standard Contractual Clauses, or another lawful transfer mechanism. We may also disclose information when required by law or when necessary to protect the service and its users.

7. How long data is kept

  • Local desktop data remains on your PC until you delete it. The recommendation cache is limited to 200 source apps and 5 MiB.
  • The API's IP-based rate-limit key expires after 60 seconds.
  • Alternaut does not retain a per-user lookup history in its product database. Product research and catalogue facts are not linked to an individual user.
  • Infrastructure access and security logs are retained for no more than 30 days unless a longer period is needed to investigate an incident or meet a legal obligation.
  • Privacy correspondence is kept only as long as needed to answer the request and meet applicable legal obligations.

8. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability, or object to processing. You may also withdraw consent where consent is the legal basis, although the current service does not rely on consent for the processing above.

Email [email protected] to exercise a right. Because the service is anonymous and does not create an install identifier, we may have little or no server data that can be linked back to you. We may request limited information to verify a request without collecting more than needed.

You may lodge a complaint with the Dutch supervisory authority,Autoriteit Persoonsgegevens, or another competent data-protection authority.

9. Changes to this policy

We will update this page before introducing materially different data collection, a new purpose, or a new category of recipient. The date at the top shows when this notice was last revised.