Reporting security vulnerabilities

1. What this policy covers

• the Ayva app for Android (Google Play, package com.ayva), including the floating window, the widget and voice conversations,
• the Ayva server (api.ayvaai.com) and its API,
• the ayvaai.com website, including its forms (waitlist, account deletion, contract withdrawal) and the shared-reminder pages ayvaai.com/r/….

Out of scope: third-party services we use (Google, Supabase, Fly.io, RevenueCat, Sentry, Vercel and the others in the recipients table) — report issues in them to their operators directly; your own MCP servers and connected accounts; social engineering, phishing and physical attacks; denial-of-service and load testing; automated scanner output without a demonstrated real impact.

A wrong or inappropriate AI answer is not a security issue in itself — report it in the app (how). But if some text (in a message, a notification or a web page, for example) can make Ayva reveal someone else’s data or do something without the user’s instruction, that is a security issue and belongs here.

2. How to report

Write to veselyjan@ayvaai.com with the subject “Security” — in English, Czech or Slovak. It helps us to know:

• what and where: the address, the part of the app and its version (in the app under Settings → Account Settings, at the very bottom),
• the steps to reproduce the issue and what you observed,
• the impact as you see it (whose data, which action),
• how we can reach you and whether you would like to be credited when the fix is published.

We do not have an encrypted channel (PGP) yet. Please send a working exploit or other sensitive details only after we reply — we will agree on a safer way. Do not include other people’s personal data in your report; if you came across any, just tell us that you did and where.

3. How to test

• Test only on your own account or on accounts you create for that purpose. Do not use other people’s accounts or leaked passwords.
• Do not access, change or delete other people’s data. If you come across any, stop, keep nothing and let us know.
• Demonstrate the impact with the smallest possible intervention: no bulk downloads, no lasting changes, no moving further into the system.
• Do not flood the server or the forms that send e-mails (waitlist, withdrawal, account deletion) — real people receive those e-mails.
• Do not publish the issue until we have fixed it, and at most 90 days after your report unless we agree otherwise. NÁVRH

4. What you can expect from us

• We will acknowledge your report within 3 working days and tell you within 10 working days whether we can confirm the issue and how severe it is. NÁVRH
• We will keep you updated and let you know when the fix is out. Server and website fixes go live immediately; app fixes arrive as an update through Google Play.
• We fix serious issues first and agree the disclosure with you. If you wish, we will credit you by name or handle.
• We do not pay financial rewards (no bug bounty).

If an issue put users’ personal data at risk, we treat it as a personal data breach: without undue delay, and where feasible within 72 hours of becoming aware of it, we notify the Czech Office for Personal Data Protection under Art. 33 GDPR (unless the breach is unlikely to result in a risk to people’s rights), and if the risk is high we also inform the affected users (Art. 34 GDPR). We also report actively exploited vulnerabilities and severe incidents under Art. 14 of Regulation (EU) 2024/2847 (the Cyber Resilience Act) to the competent CSIRT and to ENISA. NÁVRH

5. Good-faith research

If you look for and report issues in good faith and in line with this policy, we will not file a criminal complaint or a lawsuit against you over it, and we will consider your actions authorised. If someone else takes action against you because of your research, we will confirm that you followed this policy. We cannot make promises on behalf of third parties (such as the service providers in section 1) or of law-enforcement authorities. If you are unsure whether something is in line with this policy, ask us first. NÁVRH

6. Contact

Send security reports to veselyjan@ayvaai.com. Who operates Ayva is on the Operator page. The same contact is available in machine-readable form in security.txt (RFC 9116).