# Ayme — Privacy Policy (DRAFT v1, July 2026)
> **Borrador para publicar en web (URL requerida por App Store).** Canonical en
> inglés; publicar también versión en español. Revisar [placeholders] antes de
> publicar. Principio rector: no prometer más de lo que el código hace.
---
**Last updated: [date]**
**Contact: [contact email]**
Ayme is an AI companion app. This policy explains what data we collect, how we
use it, and the choices you have. It is written to be read, not skimmed.
## The most important things
- **Ayme is artificial intelligence, not a person.** Conversations are generated by AI language models.
- **Ayme is not therapy, medical care, or an emergency service.** If you are in danger, contact your local emergency number.
- Your conversations are **private by default**: no ads, no selling of data, no cross-app tracking.
- A small number of safety situations may involve **human review** (see below).
- For **support and quality debugging**, the operator may access conversations through an authenticated admin tool. This access is limited, logged, and never used for advertising.
## What we collect
- **Your messages** (text, and voice recordings you send — voice is transcribed to text to generate a reply; [confirm: audio files are not retained after transcription]).
- **Derived profile**: to make Ayme feel like it knows you, we generate and store summaries of your conversations ("memory snapshots"), a writing-style profile, and detected goals, important people, and topics ("insights"). These are derived from what you choose to share in chat.
- **Notification data**: your device push token and timezone, used to deliver messages and respect your local quiet hours (no notifications 22:00–09:00 local time).
- **Purchase data**: your subscription status and Apple transaction identifiers, used to manage your access. Payments are processed entirely by Apple; we never see your payment details.
- **Technical logs**: operational events (errors, delivery status of notifications, usage volumes and AI cost accounting) to keep the service reliable.
We do **not** collect your contacts, location, photos, or browsing activity. We do **not** use advertising or tracking SDKs.
## How your messages are processed
- To generate replies, your messages (and relevant derived context) are sent to third-party AI providers **via OpenRouter** (e.g. OpenAI, Anthropic, Google, and similar model providers). They process the content to produce the response, under their API terms.
- **We do not use your conversations to train our own AI models.**
- [Duda a revisar: afirmación sobre providers — mantener neutro: "AI providers process API data transiently under their own terms; we select providers whose API terms exclude training on customer data where available." Verificar términos de OpenRouter antes de publicar.]
## Human review (safety only)
Ayme is AI end-to-end, with one exception: **safety**. If our systems detect
that you may be at risk (for example, signs of self-harm or crisis) or severely
frustrated, an excerpt of the relevant message can be sent to our support
operator (via a private Telegram channel) so a human can review the situation
and, in rare cases, step in. This exists to protect you, not to monitor you.
These alerts are rate-limited and limited to the flagged content.
## Crisis situations
If you express intentions of self-harm or immediate danger, Ayme will respond
honestly — it will tell you it is an app, not a professional — and will show
you verified crisis resources for your region (e.g. 024 in Spain, 988 in the
US). These resource numbers are hard-coded and verified, never generated by AI.
For 72 hours after such an event, Ayme will not send you proactive
notifications.
## Data retention & deletion
- Your data is retained while your account exists.
- You can **delete your account and data from the app** (Settings → [confirm exact path]). Deletion removes your messages, snapshots, profile, goals, and insights from our database. [Confirmar alcance real del borrado en código antes de publicar: qué borra exactamente el flujo actual.]
- You can also request deletion by email: [contact email].
- Operational logs are retained for [X days — decidir] and contain at most short message excerpts (safety alerts) and technical metadata.
## Reinstalls and identity — an honest limitation
Your identity currently lives on your device. If you uninstall the app, your
device loses the link to your history; a reinstall starts fresh. If you had an
active subscription, "Restore purchases" restores your access [and, when
account linking ships, your history — remove/adjust when P1-4 lands]. If you
want data from a previous installation deleted, email us.
## Where your data lives
Our database and servers are hosted on Railway (PostgreSQL) [confirm region].
AI providers process message content as described above. Push notifications
are delivered via Expo's push service and Apple.
## Children
Ayme is rated 17+. It is not directed at children and must not be used by
anyone under 17.
## Changes
We will update this policy as the product evolves and change the date above.
Material changes will be communicated in the app.
---
### Nota interna (no publicar)
- Cubre: mensajes ✓ voz ✓ snapshots ✓ style profile ✓ goals/relations/insights ✓ push tokens ✓ compras ✓ OpenRouter ✓ Telegram handover ✓ crisis alerts ✓ logs ✓ retención ✓ borrado ✓ reinstall ✓ no-terapia ✓ AI disclosure ✓.
- Pendientes de confirmar en código antes de publicar: (1) qué borra exactamente el flujo de borrado de cuenta; (2) si el audio de voz se persiste o solo se transcribe; (3) región de Railway; (4) política de retención de logs (elegir X).