Privacy Policy

Amalgame ("Amalgame", "we", "us") is operated by Ultra Scalability LLC, a company based in the United States. This Privacy Policy explains what information we collect when you use www.amalgame.io (the "Service"), how we use it, and the choices and rights you have. If you have any questions, you can reach us at contact@ultra-scalability.com.

1. Information we collect

You can browse and read recipes on Amalgame without creating an account. We collect account information (such as your email address) only when you sign in; for every visitor, signed in or not, we also collect the pseudonymous audience and product usage data described below.

• Account information. When you sign in with your email address, we collect that email address so we can send you a one-time sign-in code. When you sign in with Google Sign-In, Google shares your name, email address, and profile picture with us; we only request the email and profile scopes — we never request access to your Google Drive, contacts, or other Google data.
• Usage data. We store the recipes you choose to save, such as bookmarks and the collections you create, so we can show them back to you when you return.
• Audience measurement. We use Google Analytics to understand, in aggregate, how visitors use the Service (pages viewed, general location, device type). Google Analytics is present on the site through a measurement ID. It may receive the full address of the pages you view, including the words of a search, and the address of a creator's post that you open from a recipe.
• Product usage measurement. We use PostHog to understand how the Service is used so we can improve it: for example, which recipe pages are viewed, whether a recipe video is started, which searches return no results, whether saving a recipe succeeds, and how fast pages load. PostHog stores a random, pseudonymous identifier in your browser's local storage. If you sign in, that identifier is linked to your account ID. We do not send your email address or your name. PostHog also receives the country of your visit, which our hosting provider determines from your connection; your IP address is never sent to PostHog. When we report a search to PostHog or Google Analytics ourselves, we first remove the email addresses, web addresses and phone numbers we can recognize, as well as any run of four or more digits, and we keep at most 60 characters. We do not record your screen or your sessions. PostHog processes this data on servers in the United States. We also copy part of these measurements (page and recipe views, searches, clicks on search results, sign-ups, and visits through our short links) into our own database, hosted by Supabase, in pseudonymous form: the identifiers are replaced by keyed, one-way pseudonyms, and the copy never contains the text of your searches, the addresses of the pages you visit, or your IP address.

2. Amalgame Chrome extension

If you connect the Amalgame Chrome extension, it reads only the information needed to bring your saved Instagram recipes into your Amalgame account: your Instagram username and account ID, the names of your saved collections, and the posts in the collections you choose on Amalgame. It never reads your Instagram password, messages, or cookies.

To show you which account is connected and what you are choosing, the extension also displays your Instagram display name and profile picture, the cover image of each saved collection, and the images of the posts it reads. It takes them from the same Instagram responses, shows them only to you, in the extension and on amalgame.io while you set up Amalgame Plus, and does not store them: they are never saved in the extension or sent to our database. When Instagram does not let amalgame.io display an image directly, our server passes it through to your browser without keeping a copy.

The extension has read-only access. It does not publish posts, like posts, follow accounts, or take any other action on Instagram for you. If Instagram presents a login or verification challenge, the extension stops immediately; it does not try to bypass the challenge or continue on its own.

We use the Instagram information received through the extension only to import and keep in sync the recipes you saved for your own Amalgame account. We do not sell it, use it for advertising, or share it for another company's marketing. You can disconnect the extension at any time. You can also ask us to delete the connection and your imported data by emailing contact@ultra-scalability.com.

Our use of information received from the Amalgame Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

3. Advertising measurement with Meta

We advertise Amalgame Plus on Instagram. To learn which ads lead to real sign-ups and subscriptions, our server shares a limited set of events with Meta Platforms through Meta's Conversions API: when you create an account from the Amalgame Plus pages, when you choose the Instagram collections to import (this event only says that the step was completed; it contains nothing read from Instagram), and when you subscribe (plan and amount). Each event carries your email address and account ID in hashed (SHA-256) form, never in clear text, together with the IP address and browser type of the request and, if you arrived by clicking a Meta ad, the click identifier Meta added to the link. No Meta code (pixel, script or SDK) runs on our pages.

To connect a visit to an ad, we keep in a first-party cookie (amg_plus_src, 30 days) the campaign parameters of the link you arrived from and that click identifier, and we attach them to your account when you create it. Meta may use the events it receives to measure and improve the delivery of our ads. Under the privacy laws of some U.S. states, this sharing may be considered "sharing" for cross-context behavioral advertising.

Do not share my information. You can opt out at any time: Do not share my information. Send the request from the email address of your account; we will stop sending events about you to Meta. If your browser sends a Global Privacy Control signal, we do not send these events for the requests that carry it.

4. How we use your information

• To operate the Service: sign you in, keep you signed in, and show your saved recipes and collections.
• To send transactional email — specifically, the 6-digit sign-in code — via our email provider Resend, from no-reply@amalgame.io. We do not send marketing email unless you separately opt in.
• To understand overall usage of the Service through aggregate audience and product usage analytics, so we can improve it.
• To measure which of our ads lead to sign-ups and subscriptions (see section 3).
• To respond to support requests and content take-down requests.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes, except the hashed advertising measurement events described in section 3, which you can opt out of. We do not sell analytics data.

5. Recipe content and creator attribution

The recipes shown on Amalgame are derived from publicly available posts made by creators on Instagram and TikTok. Each recipe is credited and linked back to the original creator and source post. If you are a creator and want a recipe derived from your content removed, email contact@ultra-scalability.com with a link to the recipe and we will review and act on your request (see also our Terms of Service for our full take-down process).

6. Hosting providers and subprocessors

We rely on the following service providers to operate Amalgame. Each only receives the information it needs to perform its function:

• Supabase — our database and authentication provider (United States).
• Vercel — hosts the Amalgame website.
• Algolia — powers recipe search.
• Cloudflare — DNS and delivery of recipe media at media.amalgame.io.
• Google — Google Sign-In (authentication), Google Analytics (audience measurement), and Google Cloud (infrastructure).
• PostHog — product usage measurement (United States).
• Resend — delivery of transactional sign-in emails.
• Meta Platforms — advertising measurement through the server-side Conversions API (see section 3).

7. Cookies and local storage

Amalgame uses only the cookies necessary to keep you signed in (a session cookie) and cookies set by Google Analytics for aggregate audience measurement. On the Amalgame Plus pages, a first-party cookie (amg_plus_src) remembers the ad or link you arrived from (see section 3). We do not let advertising companies set cookies on our pages.

PostHog keeps its pseudonymous identifier in your browser's local storage, which you can clear at any time from your browser settings. Only if your browser blocks local storage does PostHog fall back to a first-party cookie for the same identifier. Members of our own team may also carry a cookie that marks their visits as internal, so that they are left out of our statistics.

8. Data retention

We keep your account information and saved recipes for as long as your account exists. If you ask us to delete your account, email contact@ultra-scalability.com and we will delete your personal information within a reasonable time, except where we must retain information to comply with a legal obligation.

Product usage measurement data sent to PostHog is kept for one year, then deleted automatically. The pseudonymous copy kept in our own database is deleted automatically after 35 days for individual events and visits, and after 400 days for the record of a browser's first visit; after that, only anonymous hourly totals remain. If you ask us to delete your account, we also delete the PostHog records linked to your account ID, and the pseudonymous records in our own database linked to your account or to the browsers you signed in from; anonymous hourly totals are kept.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information (data portability). This includes:

• Residents of the European Union and United Kingdom, under the General Data Protection Regulation (GDPR).
• Residents of California, under the California Consumer Privacy Act (CCPA).
• Residents of U.S. states with consumer privacy laws, including the right to opt out of the sharing described in section 3: Do not share my information.

To exercise any of these rights, email contact@ultra-scalability.com. We will respond within a reasonable time.

10. Children's privacy

Amalgame is not directed to, and does not knowingly collect personal information from, children under 13. If you believe a child under 13 has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date at the top of this page.

12. Contact us

Ultra Scalability LLC — contact@ultra-scalability.com