Privacy Policy

1. Who processes your data

The controller of your personal data is the operator of the Ayva app:

For anything about personal data, write to veselyjan@ayvaai.com. We have not appointed a data protection officer — we are not required to; questions are answered directly by the operator.

2. In short

• Servers in the EU, AI also outside the EU. Ayva’s database and server run in Frankfurt (Supabase, Fly.io). Content is, however, processed by AI providers: typed chat and other text by OpenAI in the USA, voice conversations by Google Gemini — see sections 7 and 11.
• Your phone sends only what you allow. Notification reading, contacts, location, the phone calendar and your own MCP servers are optional; you turn each one on separately after a notice explaining exactly what is sent. Only the basic phone state (e.g. battery and headphones) and the first unlock of the day are sent by the app with your consent to AI processing, without a separate switch — see section 6.
• Sensitive notifications stay on the phone. Notifications from banking and payment apps and health apps, one-time codes and password managers are never sent to the server.
• Content is encrypted. Messages, lists, contacts, phone calendar events, notifications and access keys are stored encrypted in the database, and from memory facts, summaries, people and planned follow-ups. The topics of summaries, the nightly overview about you and location events are not encrypted — see section 14.
• We don’t sell your data or use it for ads. Ayva has no ads and no advertising identifier.
• Download your data or delete your account at any time — in the app (your data under Settings → Privacy & data, your account under Settings → Account Settings) or on the website.

3. Account, subscription and payments

Account

Data

e-mail, password (stored only as a hash, never readable), a name or nickname if you enter one, language, time zone, app settings and sign-in records (time, IP address) at the sign-in provider.

Purpose

creating the account, signing in, verifying your e-mail, resetting your password, deleting the account.

Legal basis

performance of a contract (Art. 6(1)(b) GDPR). The e-mail and password are needed to conclude the contract — you cannot create an account without them. Everything else in this policy is optional; some features just don’t work without it.

Retention

until the account is deleted. One-time verification codes and links are valid for 10 minutes and deleted a day after they expire.

Subscription

Data

account identifier, account e-mail, subscription status (trial, active, cancelled), product, start and end of the period, a log of subscription changes sent to us by the payment processor and, for invitations, the invite code. We pass the account identifier and e-mail to RevenueCat, which manages the subscription. For the contract confirmation and payment-problem alerts we record what we sent and when (product, price, period, Google Play order number — without the e-mail). You can also pay for the subscription from a computer through RevenueCat’s payment page (RevenueCat Web Billing): the link to it carries your account identifier and e-mail, you enter your card there directly and Stripe processes the card payment. We never receive card or bank details — Google Play processes the payment, or Stripe when you pay from a computer.

Purpose

unlocking paid features, managing the free trial, restoring the subscription after reinstalling, confirming the concluded contract by e-mail to your account’s verified address (what you ordered, the price, the end of the trial and the date of the first payment, how to cancel, information on withdrawal with the model form), a notification that a Google Play payment failed, withdrawal and refunds, invitation rewards. NÁVRH

Legal basis

performance of a contract (Art. 6(1)(b) GDPR); for payment records, the e-mail confirming the contract (Section 1824a of the Czech Civil Code) and withdrawal also compliance with legal obligations (Art. 6(1)(c) GDPR).

Retention

subscription status until the account is deleted; the log of subscription changes for 400 days and the record of sent contract confirmations and payment alerts for 400 days NÁVRH. When you delete your account we have the payment processor (RevenueCat) delete your subscription data; if that fails automatically, we are alerted and delete it manually. Google Play keeps its order history under its own rules.

4. Conversations, voice and memory

Typed chat

Data

what you write to Ayva, its answers and the attachments you send (photos, videos, a screenshot).

Purpose

answering you and continuing the conversation.

Legal basis

performance of a contract (Art. 6(1)(b) GDPR).

Retention

chat history: the last 100 messages, none older than 365 days NÁVRH. Photos and videos you send are deleted from storage together with their message when it leaves the history (and always when the account is deleted). A screenshot you ask Ayva about is used for that one answer only and deleted right after; it is not saved in the history.

Voice

Data

the sound of your voice, the transcript of the conversation, the length of voice sessions.

Purpose

talking to Ayva (Google Gemini Live).

Legal basis

performance of a contract (Art. 6(1)(b) GDPR).

Retention

Ayva does not store audio — the phone sends it straight for processing and it is gone after the answer. The transcript is saved in the chat history (see above). Records of voice session length (for the monthly voice limit) are kept for 400 days NÁVRH.

Memory: what Ayva knows about you

Data

facts and preferences from your conversations (e.g. where you work, what you like), people you talk about, plans, summaries of your days and your learned daily rhythm. Ayva may also remember facts from notifications you allow it to read (section 5), from how you consistently react to its messages (e.g. that you usually dismiss evening tips) — such facts are marked “from how you react to messages” NÁVRH —, and from how you rate its answers (below) — those are marked “from your ratings of answers”.

Purpose

so Ayva doesn’t start from scratch every time and can help you on its own.

Legal basis

performance of a contract (Art. 6(1)(b) GDPR). For health data see below.

Retention

until the account or the fact is deleted. A fact you delete disappears from the app immediately and from the database within 90 days NÁVRH. Earlier versions of a fact that changed (e.g. a previous address) are kept as history until the account is deleted NÁVRH.

You can see, correct or delete everything Ayva remembers in the app under What Ayva knows about me — including what it worked out about you itself (the summary about you, your daily routine, your style). Nightly processing does not overwrite your correction or deletion with old data.

Rating answers (thumbs up and down)

Data

a thumbs up or down on an answer from Ayva in the chat, the floating window or a voice conversation, for a thumbs down the reason (e.g. too long, too formal, wrong), where you rated it, and an optional note of up to 300 characters (encrypted).

Purpose

so Ayva learns how to answer you. Once a night it works out stable patterns from your ratings (e.g. that you want shorter answers), and from your recent ratings with a thumbs down or a note (together with the rated answer and the question before it) the model proposes at most a few short style rules. Both are saved in memory as facts marked “from your ratings of answers” — you can see and delete them in “What Ayva knows about me”, and a deleted fact does not come back.

Legal basis

performance of a contract (Art. 6(1)(b) GDPR).

Retention

ratings 180 days NÁVRH; learned facts until you delete them or the account — they expire on their own when new ratings stop supporting them.

Lists and trackers (Life Cards)

Data

lists, counters and tables you keep with Ayva or that it creates at your request (e.g. a shopping list, notes, expenses, weight, habits): title, description, items and values.

Purpose

to keep track of what you ask Ayva to track, answer questions about it and remind you of what you haven’t logged today (e.g. in Ayva’s quick window or the morning briefing).

Legal basis

performance of a contract (Art. 6(1)(b) GDPR).

Retention

encrypted, until you delete the list or the account.

Health data

Ayva has no health features and does not deliberately collect health data. It can still end up being processed: when you tell Ayva something about your health yourself (an allergy, a medication, a dietary restriction), when you keep a list with it that concerns your health (e.g. your weight), when a notification you allow it to read contains such information (e.g. a text message or e-mail from a pharmacy, an insurer or a doctor), or from an event in your calendar (e.g. “dentist”). The model then processes it like any other content — for an answer, a reminder or the day overview — and whatever Ayva remembers you can see and delete in “What Ayva knows about me”. Like other content, it can affect what Ayva reminds you of and when it gets in touch — for example, after a doctor’s visit you told it about, it may ask how it went (profiling is described in section 7). We do not use health data to evaluate you, for decisions with legal or similarly significant effects or for any other purpose, and we share it only with the processors in section 11. If you don’t want it processed, don’t tell it to Ayva, delete the fact, or tell Ayva to forget it. NÁVRH

Health data is a special category of personal data. We process it based on your explicit consent (Art. 9(2)(a) GDPR), which you give in the app in the notice about AI processing (the “Health data” part). You can withdraw the consent at any time in the app under Settings → Privacy & data with the “AI processing” switch — but Ayva can’t work without it. This does not affect processing before the withdrawal, and withdrawing deletes nothing: whatever Ayva remembers you can delete in “What Ayva knows about me” or by deleting your account.

5. Data from your phone — all optional

You turn each of these features on separately. Before it is turned on, the app tells you exactly what is sent and where, and only with your consent asks Android for the permission. You can withdraw consent and permissions at any time in the app or in Android settings — processing then stops from that moment. The legal basis is your consent (Art. 6(1)(a) GDPR); we record when you agreed and to which version of the notice (see section 8).

Reading notifications

Data

the app name and package (e.g. com.whatsapp), the title, text and subtext of the notification (often the name of an e-mail account or group), its category and time, for notifications from your other apps (messages, e-mails, deliveries, reminders). For conversations that can be replied to, also the conversation name, a group flag and an opaque identifier that does not reveal any phone number.

Purpose

spotting what matters, reminding you of it, summarising notifications and, on your instruction, replying to a message.

Retention

the notification log for 30 days. Anything Ayva remembered from notifications is in “What Ayva knows about me”.

Sensitive notifications are filtered out on the phone and never sent: banking, payment and wallet apps, health apps (health and fitness, sleep, cycle and pregnancy, mental health, medication, doctors, pharmacies and health insurers), authenticators and password managers, notifications the app itself marks as secret, one-time and verification codes, passwords and bank alerts with an amount. You can exclude more apps yourself in Settings → Privacy & data. Playback controls and calls are not sent either. Notifications from your phone’s work profile (apps managed by your employer) are not read at all.

Ayva replies to a message only on your instruction and only after showing you the text and you confirming it. It sends the reply through the “Reply” button of that app’s notification; the button itself never leaves the phone.

Contacts

Data

the names and phone numbers of the contacts on your phone.

Purpose

so you can say “call Peter” or “text Mum”.

Retention

encrypted until you disconnect contacts or delete the account. You always complete calls and texts yourself on the phone.

Location and places

Data

the phone’s location, also in the background when the app is closed (only with the “Allow all the time” permission), arrivals at and departures from saved places, places such as home and work, places you visit often (Ayva offers to name them), commute history and addresses looked up from the location.

Purpose

place-based reminders (also at any branch of a chain — we look up branches near you from your location), travel alerts, weather, answers to “where am I” and automations.

Retention

location events 30 days, stored rounded to about 100 m; addresses looked up from the location 30 days (deleted immediately when you turn location off); places you visit often are deleted at the latest a day after 8 days have passed since they were last computed NÁVRH (deleted immediately when you turn location off); saved places until you delete them or the account.

Phone calendar

Data

the title, time, place and all-day flag of events from every calendar synced to the phone for the past day and the next 14 days, the calendar’s name (for a Google calendar this is often your e-mail address) and its account type (e.g. Google). The app does not read event descriptions or attendees. With the notice version of 21 October 2026, also whether each event is marked busy, free or tentative, and your own reply to an invitation (accepted / maybe / not answered yet) — not other people’s replies or the attendee list; we store these unencrypted, as they are only these values NÁVRH. The phone sends them in the background, also when the app is closed, after every change and at least once a day.

Purpose

the morning briefing, meeting reminders and answers about your schedule, including “when am I free” and a note when a new meeting overlaps another; at your request also writing to the calendar (below).

Writing to the calendar

when you ask, Ayva adds a new event to the phone calendar (which you can undo right away), moves one or deletes one. You always confirm deleting or changing an event in the phone calendar on your phone first; for a repeating event only one occurrence changes unless you say otherwise. If you have also connected Google Calendar, Ayva creates new events there and changes Google Calendar events directly through Google (see below), without a confirmation on the phone; on the phone you confirm changes to events that are not in Google Calendar. Without the permission to write, Ayva asks for it when you request a change; otherwise it only prefills a new event in your calendar app and you save it. A record of what Ayva added, changed or deleted in your calendar (the event and calendar name, encrypted, and the outcome) is kept for 7 days NÁVRH.

Retention

encrypted; each event until 30 days after it ends NÁVRH. Disconnecting the calendar deletes everything immediately; a phone that hasn’t synced for 90 days is deleted with its events NÁVRH.

Google Calendar

Data

the access key to your Google Calendar (encrypted), the list of your calendars (so Ayva reads all of them and knows where a new event belongs) and the events Ayva reads when you ask, or creates, changes or deletes on your instruction. Ayva doesn’t change whole calendars or their sharing.

Purpose

answering questions about your schedule, reminders and managing events on your instruction. Only users who connected Google Calendar earlier can connect it.

Retention

the key until you disconnect or delete the account; we don’t store Google Calendar events — they appear only in answers and reminders.

Ayva’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: it is used only for features you asked for, not transferred except to processors needed to run the service, not used for advertising, and nobody reads it unless security, the law or your explicit consent requires it.

Screen

When you summon Ayva over another app and ask about what’s on the screen, the app reads the screen text, the name of that app and the address of the open page or — after a system dialog you confirm every time — takes one screenshot. Before the first read the floating window shows you a notice (what is read, what for, where it goes and how to turn it off) and reads the screen only once you tap “Allow screen reading”; “Not now” reads nothing. The screen content is processed by AI only when you ask about the screen: in typed chat it goes through Ayva’s servers in the EU to OpenAI in the USA, in a voice conversation straight from the phone to Google Gemini Live (section 7). We don’t store the screen text or the screenshot: the screenshot is used for that one answer and deleted right away; what stays is your question with the answer and, for “remind me about this”, the page address in the reminder. Over a locked phone Ayva does not read the screen at all. We record the consent (section 8) and you withdraw it under Settings → Privacy & data → Screen reading. Legal basis: performance of a contract, as it is your explicit request; the notice and the consent make sure you know about screen reading in advance. NÁVRH

Automations

Rules you set up (arriving at a place, connecting to a Wi-Fi network or Bluetooth device, starting to drive or walk, a time, a notification with a keyword) are stored until you delete the rule or the account. The phone itself works out whether a rule applies; it sends the server only which rule fired and with which event — depending on the rule, the Wi-Fi network name, the name and address (MAC) of the Bluetooth device or the notification title (for a sensitive notification the phone doesn’t send, only the app). The event goes to the model that responds to the rule; we don’t store it separately. Movement detection (activity recognition) stays on the phone. A rule that fires may read what it needs but changes nothing on its own: music, navigation, a calendar entry, a reminder, a Life Cards change or an action of a connected service is offered as a button in the notification and runs only when you tap it. The server keeps the offered action (encrypted) for 24 hours and deletes its record at the latest a day after 2 days have passed NÁVRH.

Music

Ayva can control playback in the app that is currently playing (this needs notification reading). The phone attaches what is playing (track, artist, album, app, position in the track, what plays next, music volume) to your message in the quick window and in the app; the model only uses it when you ask about the music. On “play …” it passes the search straight to the music app on your phone. Only users who connected Spotify earlier can keep it connected; the access key is encrypted and deleted when you disconnect or delete the account.

Learn my music taste

Data

what plays in music apps on your phone: track title, artist, album, app, time and how many seconds you listened. The phone keeps this history encrypted on the phone only, for at most 90 days, and does not send it to the server. Once a day it computes a short music profile from it — your most played artists and tracks, your music apps and the time of day you listen — and sends only that profile to the server. Capturing playback needs notification reading.

Purpose

so that for requests where your taste matters (“play something I like”, a gift idea) Ayva goes by what you actually listen to. The AI model reads the profile only when your taste matters.

Legal basis

your consent (Art. 6(1)(a) GDPR). The feature is off by default; you turn it on under Apps Connections → Music after a notice explaining what is recorded, and you withdraw consent by turning it off.

Retention

playback history on the phone only, 90 days; the profile on the server until you turn the feature off or delete the account. Turning it off deletes the history on the phone and the profile on the server. If you have Spotify connected, a profile computed from Spotify may replace the one from the phone.

Locked phone and widget

Over a locked phone Ayva answers nothing personal (memory, calendar, notifications) until you unlock it, and what is typed over the lock screen is not saved in the history or memory. For accounts created from 2 October 2026 the “Ayva today” widget hides event names by default; for older accounts hiding is off and you turn it on under Settings → Privacy & data.

6. Proactive messages, widget and sharing

Data

reminders and messages Ayva planned or sent you, how you reacted (opened, read aloud, action, swiped away, dismissed, “Keep sending” or “Don’t send” on the morning briefing), whether you unlocked the phone at the moment Ayva postponed a message to, records of why Ayva did or didn’t send a message, phone events such as the first unlock of the day or opening the app, and the phone’s latest state: battery rounded to 5 %, charging and battery saver, whether headphones are connected (wired or Bluetooth — without the device name), ringer mode and Do Not Disturb, and the connection type (Wi-Fi or mobile data — without the network name). The phone sends its state when it changes (and without a change at most once every 3 hours), and we keep only the latest one. The app sends the phone state and the first unlock of the day with your consent to AI processing (section 7), without a separate switch.

Purpose

so Ayva gets in touch at the right moment with what matters to you, and learns what helps you.

Legal basis

performance of a contract (Art. 6(1)(b) GDPR) — proactive help is the core of the service.

Retention

messages, reactions and planned follow-ups 180 days NÁVRH (planned reminders until they are sent); decision records 90 days; phone events 30 days; the latest phone state is deleted at the latest a day after 24 hours have passed since it was last reported NÁVRH.

You can turn proactive messages off entirely, or separately the morning briefing, tips during the day and the evening summary — in the app under Settings → Assistant Settings → “Ayva reaches out on her own”. Reminders you ask for yourself, your automations and notices about your account and subscription keep coming.

Your week with Ayva and First impression

The numbers on the Sunday “Your week with Ayva” card are counted from data we already hold for your account. The “Your week with Ayva” and “First impression” cards are created on your phone and leave it only if you share them yourself. For the “First impression” sentence only calendar patterns (when you tend to be busy and which weekdays have recurring meetings) are sent to OpenAI, never event titles, places or attendees; the sentence is saved with your account. The first tip within 24 hours of setup is based on your next calendar event, or is an evening look back at your day; like other messages it may contain the event name.

Shared reminders

When you ask Ayva to remind someone else of something and confirm the link, we create a page at ayvaai.com/r/<id> and your phone opens the share sheet — you send the message yourself. We store the reminder text you approved (at most 500 characters, encrypted), an optional date and time with your time zone, the page language and your invite code. We don’t store the recipient’s name or number, and the page never shows your name or e-mail. Anyone with the link can open the page; the link cannot be guessed and search engines don’t index the page. The IP address of whoever opens the page is used only to limit the number of requests (as a hash in a counter deleted by the next day). A reminder is deleted 30 days after it was created. Legal basis: performance of a contract — you asked for the link.

7. Artificial intelligence

Ayva is artificial intelligence, not a person. Its answers, voice, suggestions and proactive messages are generated by language models from OpenAI (GPT) and Google Gemini — who processes what is below. The model can make mistakes — double-check anything important. The app tells you so before first use; in the chat and in the floating window there is a permanent line “Ayva is AI and can make mistakes.”, notifications with text from the AI carry an “AI” label in their header, and in your first voice conversation Ayva introduces itself as an AI assistant. In the data export, messages, summaries and facts show what was created by the AI. Shared cards and reminders say they come from the AI assistant Ayva; card images also carry this in their metadata (a card with a sentence from the model also that it is AI output), and a shared reminder is marked as AI output in machine-readable form on its page and in the calendar file.

Who processes what. OpenAI (GPT models, servers in the USA) processes typed chat and every other text task: answers in the chat and the floating window including photos, attachments and the screen content you ask about, the morning briefing and evening summary, deciding whether and when to get in touch, sorting notifications, saving and merging facts in memory, nightly processing, conversation summaries, the “First impression” sentence, automations, tasks Ayva needs to carry out during a voice conversation (e.g. looking something up or writing something down), and looking up a contact when the name can’t be found directly — for that the model receives the list of your contacts’ names (without numbers). Google Gemini processes voice conversations (Gemini Live — audio goes from the phone straight to Google), memory search (Google receives the text of facts and queries and returns a numerical fingerprint of them), searching for places near you (the query and your location), large attachments that are uploaded to Gemini’s storage for processing, and the fallback web search.

What the model receives: your message or voice, part of the conversation history, facts from memory relevant to the request and the context you allowed (e.g. time, location, upcoming events, notifications, the phone’s state). If an answer needs current information from the web, OpenAI searches for it: it receives a query derived from your question, your country and time zone, not your exact location. If the search at OpenAI fails, Google Search is used and Google receives the query.

How OpenAI and Google handle it: both are our processors. With OpenAI we use the paid API; under its terms OpenAI does not use inputs or outputs to train models and keeps them for at most 30 days to detect abuse. We also tell OpenAI not to store responses (store=false), and instead of your account identifier we send only a one-way hash of it (a pseudonym) that lets OpenAI detect abuse of the service. With Google we use the paid Gemini API; under its terms Google does not use prompts or responses to improve its products and keeps them only for a limited time to detect abuse.

Consent to AI processing. Before the app first sends anything to the AI, it shows the notice “Ayva is artificial intelligence” (what is sent, where, and that the model can make mistakes) and asks for your consent; without it Ayva doesn’t answer. The legal basis for processing your messages, voice, memory and proactive messages remains performance of a contract (sections 4 and 6) — with the consent you confirm that you know about and want AI processing. Until you give it, the app itself sends nothing to the AI: it doesn’t send your message, start a voice conversation or read the screen. NÁVRH You can withdraw the consent at any time in the app under Settings → Privacy & data with the “AI processing” switch. The app then sends nothing more to the AI, and within a few minutes the server also stops running the AI on its own (proactive messages, the morning briefing, learning from notifications) — so Ayva doesn’t work until you consent again. Withdrawing deletes nothing: whatever Ayva remembers you can delete in “What Ayva knows about me” or by deleting your account. We record when and to which version of the notice you gave or withdrew the consent (section 8).

Your own MCP servers (e.g. your Home Assistant) are connected by you, and only after a notice. We don’t run such a server: it receives the key you enter and whatever you send it through Ayva (e.g. a device name or a search term), and handles it as an independent controller under its own rules. We store the key encrypted until you remove the server or delete the account.

Automated decision-making and profiling

Ayva makes no decisions about you that have legal effects or similarly significantly affect you (Art. 22 GDPR). It uses profiling only to decide what to remember, what to suggest, how to answer you and when to get in touch: from memory, the calendar, location, notifications, the phone’s state, how you reacted to earlier messages and your ratings of answers it estimates what is useful to you now and whether it is a good moment to interrupt. The only consequence is that you get a message, or you don’t, and how Ayva answers you. The legal basis is performance of a contract (Art. 6(1)(b) GDPR) — proactive and personal help is the core of the service. You can turn proactive messages off (section 6) and delete anything from memory. You can object at any time to processing we do based on legitimate interest (e.g. product events in section 9) — see section 13.

8. Invitations, consents, withdrawal and reports

Invitations (“Invite a friend” programme)

We store your personal invite code and, for each invitation, which account invited which, how the invitation arrived (install link, a code typed in, the waitlist), when, its status and the plan the invited friend started. An invitation from the waitlist is linked to an account by verified e-mail: if you joined the waitlist through an invitation, whoever invited you becomes your inviter, and if someone enters your waitlist code, the invitation is credited to the account with the same e-mail as your waitlist sign-up. For the person who invited, we keep a record of rewards (a free month and extra voice minutes for invited friends who started a trial) and of any offset after a refund. To prevent abuse we compare e-mail addresses and store a one-way hash (SHA-256) of the device identifier (Android ID — for the Ayva app on a given phone it stays the same even after reinstalling), never the identifier itself. If you were invited, the code and the fact that you were invited are also sent to RevenueCat so the right offer is shown. The person who invited you only sees counts, never your name, e-mail or account. The rules are in the terms.

Legal basis: performance of the programme rules (Art. 6(1)(b) GDPR) and our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR). Retention: the code until the account is deleted; void invitations 90 days and other finished or unpaid ones 400 days after their last change; reward records 400 days after payout, voice minutes for invited friends 400 days after they were credited, failed payout attempts 90 days NÁVRH. Deleting your account deletes your own invitation and detaches the invitations you sent from you; a reward someone already received thanks to you stays with them but is no longer linked to you.

Record of consents

For each consent (AI processing, contacts, notifications, background location, phone calendar, screen reading, music taste, MCP servers, usage statistics, age confirmation) we record when you decided, how and to which version of the notice. Legal basis: the legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR). Retention: until the account is deleted.

Withdrawal from the contract

When you withdraw from the contract (in the app or on the website), we store the e-mail address we send the confirmation to, the time the statement was sent (for the web form also the time the form was sent), your name and the Google Play order number if you give them in the web form, which subscription purchase (contract) the statement concerns, what we found about the subscription and how we handled the withdrawal. For the web form we verify the e-mail with a link valid for 24 hours. A request nobody confirms is not lost: a day after the link expires we hand it, with the e-mail, name and order number, to the operator for manual review and delete it from the server (if it cannot be handed over, after 14 days at the latest). Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest in proving how it was handled in a possible dispute (Art. 6(1)(f) GDPR). Retention: 3 years from sending NÁVRH, earlier if you delete your account.

Reported AI answers

When you report an answer from Ayva, we store the reason, an excerpt of the answer and your note (encrypted). It helps us find mistakes and harmful content and tune filters. Legal basis: our legitimate interest in a safe service (Art. 6(1)(f) GDPR). Retention: 365 days NÁVRH.

Support

When you write to us, we use your message and contact details to answer and resolve it. Legal basis: performance of a contract or our legitimate interest in answering. We keep messages as long as needed to resolve them and to defend possible claims.

9. Measurement, errors and security

Product events

Ayva records a few basic events with your account: which setup steps you saw and whether you finished setup, whether you saw the “What I know about you” and “First impression” screens, when the subscription screen was shown and the result of a trial start or purchase (product code and error code only, never payment details), whether you granted permissions and set Ayva as your assistant, how you first reacted to a proactive message (only the kind of reaction), whether you used, hid or skipped a suggestion, whether you viewed or shared the “Your week with Ayva” card, whether you shared the “First impression” or an invitation, how an invitation was attached to your account, that you reported an answer, and from which campaign link you installed the app (the source, e.g. instagram, and a short campaign name — only if the install came from such a link). The server itself records that an invited friend started a trial or paid and that the inviter received a reward (only the kind of reward). NÁVRH Events carry only short codes, yes/no values and small numbers — never conversation content, names, contacts, location or other free text. They show us whether setup, suggestions and the subscription work and where people get stuck.

Legal basis: our legitimate interest in measuring and improving the app (Art. 6(1)(f) GDPR). Retention: 400 days NÁVRH. You can object to these events at any time (Art. 21 GDPR) by e-mail to veselyjan@ayvaai.com — we will stop recording them for your account and delete those already recorded.

Usage statistics (Google Firebase Analytics) — only with consent

Only if you turn on “Usage statistics” (off by default) does the app send usage events (e.g. screens opened, sign-in, finishing setup) to Google Firebase Analytics with a pseudonymous installation identifier, your account identifier (not your e-mail), your plan and the app language — without conversation content and without an advertising identifier. Legal basis: your consent (Art. 6(1)(a) GDPR), which you withdraw with the same switch in Settings. Google keeps the data for at most 14 months NÁVRH. When you sign out or delete your account, the app on your phone forgets the account identifier, turns collection off and deletes the analytics data on the phone; what has already been sent to Firebase stays there until this period ends.

Error reports (Sentry)

When the app crashes or runs into an error, a technical report goes to Sentry: the error description, where in the code it happened, the phone model, the system and app versions and the account identifier (not the e-mail). For about 20 % of uses the app also sends performance records — how long the start-up, a move between screens or a request to the server took. We strip message content, e-mail addresses, tokens and coordinates from reports and records. Only the app sends reports; Ayva’s server sends nothing to Sentry. Legal basis: our legitimate interest in a working and secure app (Art. 6(1)(f) GDPR). Retention: at most 90 days NÁVRH. When you sign out or delete your account, the app forgets the account identifier in Sentry; reports already sent are not deleted with the account — they expire at the end of this period.

App protection (freeRASP)

When it starts, the app checks whether the phone is rooted, whether the app has been modified and whether it came from Google Play. The freeRASP library sends its provider Talsec technical data about the security state of the device and the app, the device model and pseudonymous installation and device identifiers — without any content or account details. Talsec also uses it to improve its service and for aggregated security statistics — for these purposes it is an independent controller (section 11). Legal basis: our legitimate interest in protecting the service and its users from abuse (Art. 6(1)(f) GDPR).

Limits and abuse prevention

To protect the service from abuse and keep costs under control, we count requests per account and IP address (as one-way hashes, deleted after 2 days), limit usage (60 days) and AI model consumption per account (400 days NÁVRH). Memory also has its own daily counter of AI costs (numbers only, no content), which we keep until the account is deleted. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Push notifications

To deliver notifications we store your phone’s Firebase Cloud Messaging token (until it is replaced or the account is deleted); the text of Ayva’s notifications passes through Firebase Cloud Messaging. Legal basis: performance of a contract.

10. How long we keep data — overview

Retention periods are enforced by a clean-up that runs once a day — data is therefore deleted at the latest a day after its period ends.

After you delete your account we delete all data described in this policy immediately. Exceptions: the record of a reward someone else already received thanks to you stays with them, no longer linked to you (section 8); subscription data at RevenueCat that cannot be deleted automatically we delete manually (section 3); data kept by Google Play (order history) and by services with their own retention expires under their rules — Firebase statistics and Sentry error reports already sent at the latest after the periods in section 9 (the app on your phone forgets the account identifier and deletes the analytics data on the phone right away), copies of AI inputs and outputs that OpenAI and Google keep to detect abuse after their periods end (at OpenAI at most 30 days, section 7), Talsec under its own policy. Deleted data may briefly remain in automatic database backups at the database provider until those backups are overwritten in its cycle.

11. Who receives data

We don’t sell data. We share it only with processors who run parts of the service for us and may use it only on our instructions (the table), with the app protection provider Talsec and with third parties you choose yourself (both paragraphs below the table). Processors:

Talsec (freeRASP), protecting the app from abuse — USA (AWS cloud). It receives the technical data about the security of the device and the app described in section 9 and also uses it for itself — to improve its service and for aggregated security statistics. It is therefore not only our processor: for these purposes of its own it is an independent controller and follows its own policy. We disclose the data to it based on our legitimate interest in protecting the service and its users from abuse (Art. 6(1)(f) GDPR). NÁVRH

Independent controllers you choose: Google Play (buying and paying for the subscription, and a rating of the app you write there yourself when asked), Google Calendar and Spotify (only for users who connected them earlier), your MCP servers and the apps through which you send a message or share something. Their own policies apply. We disclose data to public authorities only when the law requires us to.

Transfers outside the EU. Where data may leave the European Economic Area (mainly to the USA — e.g. to OpenAI, Google and RevenueCat), the transfer relies on the Commission’s adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795) for recipients certified under it, and otherwise on the Standard Contractual Clauses (Commission Decision (EU) 2021/914) in the data processing agreements, for Talsec in its terms. We will send you a copy of the clauses on request.

Weather data is provided by MET Norway (Norwegian Meteorological Institute) under the CC BY 4.0 licence, source: api.met.no.

12. Information for people who don’t use Ayva

Ayva may process data about people who don’t use it themselves: names and numbers in a user’s contacts, senders and text of notifications a user receives, events in a user’s calendar, people a user talks about, screen content a user asks about and recipients of shared reminders. The data comes from the Ayva user, is used only so that Ayva can help that user, and is processed on the basis of the user’s and our legitimate interest (Art. 6(1)(f) GDPR) for the periods in section 10. We don’t contact you and don’t combine the data across users.

You have the same rights as users (section 13). In particular, you can object to this processing at any time (Art. 21 GDPR) and request erasure. Write to veselyjan@ayvaai.com; since we don’t know you, it helps if you say which user or in what context your data may appear.

13. Your rights

• Access and portability — in the app, Settings → Privacy & data → Download my data gives you the data we hold about you in a machine-readable JSON file (data tied to your e-mail address only with a verified e-mail). AI consumption appears in it as a monthly summary; technical records without content (e.g. limit counters, daily memory costs, links between facts and one-time codes) are not in the file — we will send them to you on request.
• Rectification — edit your profile in Settings and your memory in “What Ayva knows about me”; otherwise write to us.
• Erasure — delete your account in Settings → Account Settings or on the website; delete individual items in the app or ask us to.
• Restriction of processing — you can ask us only to store your data and otherwise not use it, e.g. while you contest its accuracy.
• Right to object (Art. 21 GDPR) — you can object at any time, by e-mail to veselyjan@ayvaai.com, to processing based on our legitimate interest (product events, error reports, abuse prevention, reported answers and, for people who don’t use Ayva, section 12). We will stop unless we demonstrate compelling legitimate grounds that override your interests. Proactive messages and the profiling for them are part of the service (performance of a contract) — you turn them off in the app (section 6).
• Withdrawing consent — at any time, with the same switch in the app or in Android settings (consent to AI processing under Settings → Privacy & data, section 7); this does not affect processing before the withdrawal.

We handle other requests sent from veselyjan@ayvaai.com within one month (in complex cases we may extend this by two months — we’ll let you know). To avoid handing your data to someone else, we may check that the request comes from your account’s e-mail address.

You have the right to lodge a complaint with a supervisory authority — in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz — or with the authority of the EU country where you live, work or where the infringement took place.

14. Security

• All communication between the app, the servers and services is encrypted (TLS).
• Message content, lists and trackers (Life Cards), contacts, phone calendar events, shared reminders, reported answers and access keys to connected services and MCP servers are stored encrypted (Fernet: AES-128 and HMAC-SHA256). From memory we encrypt this way the text of remembered facts, summaries of conversations and days, the summary notes about you, the people you talk about (name, relationship to you, notes and birthday), places, companies, pets and other things Ayva recognises in conversations, and planned follow-ups. We also store encrypted the messages Ayva sends you, your replies and comments on them, notes on your ratings of answers and the content of phone notifications (title, text and conversation name). The sorting details of facts (who or what a fact is about and its topic) that let Ayva recognise that a new fact replaces an old one are stored only as a fingerprint made with a secret key, from which the original word cannot be read. We have converted records stored before October 2026 to this form. Passwords are managed by the sign-in provider, which stores only their hash.
• We do not yet store the rest of memory encrypted — the topics of summaries (short words such as “work”) and the overview Ayva puts together about you each night for planning (people, topics and open matters, your daily routine, style and taste in music) —, automation rules (including the text of reminders tied to a place and the names of the Wi-Fi networks and Bluetooth devices they respond to), the navigation destination attached to a message from Ayva, which app sent you a notification and when, location events, addresses looked up from location, saved places, thumbs ratings of answers (without the note), records of withdrawals from the contract and data from website forms (tester sign-ups and feedback). This data too is only in the database in the EU, which only Ayva’s server can access.
• Only Ayva’s server can access the database; the app on your phone can reach only its own profile.
• The server’s operational logs contain no location, names of people or text of messages and notifications.
• The database and the server run in the EU (Frankfurt).
• Sign-in data on the phone is kept in encrypted storage; over a locked phone Ayva shows nothing personal.

If a breach were likely to result in a high risk to you, we would tell you without undue delay.

15. Age

Ayva is only for people aged 18 and over; you confirm your age when you register. If we find out an account belongs to someone younger, we delete it.

16. The ayvaai.com website and cookies

The website uses no cookies or other storage for analytics, advertising or tracking and embeds no third-party content — details in the cookie policy. The website is run by Vercel, which sees technical data about visits (IP address, browser) in its operational logs.

Website forms send data to our server only when you submit them: account deletion (e-mail, password and the code from the e-mail — only to verify and delete), withdrawal from the contract (section 8), the tester sign-up (e-mail only; you then join the testing group in Google Groups and the testing in Google Play yourself with your Google account), feedback (text, optionally a rating of 1–5 and an e-mail) and the waitlist (its own notice). Legal basis: for the tester sign-up, your request for access to the test version (Art. 6(1)(b) GDPR); for feedback, our legitimate interest in improving the app (Art. 6(1)(f) GDPR). We keep sign-ups and feedback as long as we need them for testing and handling NÁVRH, and delete them when the account with the same e-mail is deleted. Technical data about visits in Vercel’s operational logs is processed based on our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR); Vercel deletes it after a short time under its own rules NÁVRH.

17. Changes to this policy

We change this policy when the app or the law changes. We will tell you about significant changes in advance in the app or by e-mail; if a change needs new consent, we will ask for it. The effective date is at the top; we will send you earlier versions on request.