Sources

Status: 22 September 2026. This page is provenance plus operations/privacy. Gaps and exports: Methodology. Legal text: Privacy. Host evidence: Status.

Public places you can open yourself

Alveos does not invent installs, downloads, or updates from estimates or paid scrapers. Counters come from the same public APIs and listings you can read yourself: VS Code Marketplace, Open VSX, GitHub Releases, PyPI, Packagist. YouTube only after a workspace connects its own product videos.

What the vendor publishes, Alveos stores as a daily snapshot. What the vendor does not publish is not invented from Gallery numbers.

Beacon

Beacon: The product sends events to Alveos. Not a marketplace fetch, not for sale, not a currency. Optional lifecycle events via the API after sign-in on the product. Alveos does not fetch Beacon from anywhere. The publisher decides whether anything is sent.

Stored fields: anonymous instance_id, app, event, version, time, optional build/platform — no name, no email. Beacon is workspace product statistics, not ads and not cross-site people tracking. Alveos does not sell Beacon data.

Streaming Zebra (coming soon)

Streaming Zebra is not a marketplace and not a Gallery figure. It is optional first-party delivery and lifecycle counts (install, kept, update) for SKUs the publisher enrolled there. Alveos fetches only the daily summary: redeem stays Downloads, client_update sits in Updates. No enrollment, no Streaming Zebra row.

Limits stay limits

Gallery installs measure acquisition, not lifecycle. Open VSX counts VSIX downloads only — it does not report kept installs. YouTube clicks are demand, not store installs. Those series are not added into one number.

European law, your statistics

What Alveos stores (account, snapshots, optional telemetry) sits under European data-protection law: controller in Luxembourg, hosting in Germany. Alveos does not sell those workspace metrics. The public sources themselves (GitHub, Microsoft, Google, …) may sit outside the EU; their own terms apply there. Alveos does not turn a US source into an EU source.

Site operator: Serap Kusu-Eryigit — Alveos
Serviceable address: 21, rue Basse, L-3813 Schifflange, Luxembourg
No walk-in customers.
Email: contact [at] alveos [dot] eu

Technical responsibility: Serap Kusu-Eryigit — www.alveos.eu

Phone: +352 691 868 822

Support mailbox: support [at] alveos [dot] eu

Alveos processes account and workspace identity, public distribution identifiers, stored metric snapshots, and optional product lifecycle telemetry.

Stored data

• Account and workspace: GitHub username, email where needed, privacy confirmation, membership, role, login and audit times.
• Metric connections and snapshots: public package, extension, repository, channel or product ids and the named source counters.
• Beacon: sent by the product, not fetched. Anonymous instance_id, app, event, version, time; optional build/platform.
• Workspace secrets: optional provider keys and OAuth tokens are encrypted. Public exports never include tokens or Beacon instance ids.

Retention, deletion, processor

A downgrade does not delete history. Visible span follows the plan: Look 30 days through Studio three years. Deletion is a verified manual process via support@alveos.eu.

Current infrastructure processor: Neue Medien Münnich, Germany (ALL-INKL.COM) — website, login, MariaDB, Sendmail.

External sources (not each one is a processor): GitHub, Microsoft Gallery, Open VSX, PyPI/PypiStats, Packagist, Google (Analytics only with consent; YouTube after a connection), Streaming Zebra only for an enrolled SKU.

Alveos does not store card data; payments go through the payment service (currently Payhip). Details on Pricing.

Security reports with subject [SECURITY] to the same mailbox. Public incidents of Alveos hosts are on Status — that is not a single marketplace API outage such as YouTube.

Terms

Beacon

The product sends events to Alveos. Not a marketplace fetch, not for sale, not a currency.

Snapshot

Stored provider value on a UTC day. Missing days stay gaps.

Streaming Zebra

Optional first-party delivery, still being built. Only for an enrolled product.

Gallery

Public VS Code Marketplace counters. Acquisition, not “still installed”.