Version: 2026-10-13
AYA is operated by Aya Neurosymbolic Networks LLC, a Wyoming limited liability company. This policy describes what the running system does as of the version date.
1. Who processes your data
Aya Neurosymbolic Networks LLC, a Wyoming limited liability company, which operates AYA. There is no data protection officer and no privacy team. Every request lands with one person.
Contact for access, correction, deletion, and complaints: hobbes@aya.network.
2. What is collected
At registration
| Data | Why | How it is stored |
|---|---|---|
| Email address | Account identity, sign-in, contact | Encrypted, with a SHA-256 hash used as the lookup index |
| Password | Authentication | bcrypt hash, salted. The plaintext is never stored |
| Username, display name | Optional, shown in the interface | Plaintext |
| Organization | Optional, groups accounts into a tenant | Plaintext |
| Invitation code | Access control during the alpha | Plaintext |
| Terms acceptance | Record that you accepted, which version, and when | Plaintext version string and timestamp on your account row |
While you use AYA
| Data | Why | How it is stored |
|---|---|---|
| Conversations and the content you submit | To answer you and to show your history | PostgreSQL, with content encrypted where the account setting applies it |
| Images you upload, including a profile image | To show them back to you | PostgreSQL. Stored as image data in the database; not separately encrypted at the field level |
| Session records: token hash, IP address, user agent | Sign-in security, session limits | PostgreSQL and Redis. Tokens are stored as SHA-256 hashes, never in the clear |
| Known-device records and device sign-in codes | Sign-in security | PostgreSQL. A device hash and a label, not the device itself |
| Activity log and command audit records: sign-in, sign-out, resource access, commands run on your behalf, with arguments redacted | Security and audit | PostgreSQL |
| Message log between internal AYA components | Operating and debugging the system | PostgreSQL. May contain parts of what you submit while it is kept |
| Credentials for platforms you connect, such as OAuth tokens | To act on the platform you connected | Encrypted credential vault |
| Your own model API key, if you supply one | To send your requests under your key | Encrypted |
| Operational metrics and error records: timings, token counts, cost, error details | To keep the system running | TimescaleDB and PostgreSQL |
| Billing identifiers, only if a paid plan is ever turned on for you | To bill you | Stripe customer and subscription identifiers. Card data never touches AYA. No billing is live during the alpha |
No advertising identifiers are collected. No third-party analytics or session replay tools are installed.
Cookies and browser storage. The AYA app keeps values in your browser's local storage so it works: sign-in state, the idle-lock setting, and a pointer to your organization for single sign-on. There are no advertising or tracking cookies. The legal pages load two web fonts from Google Fonts, so Google receives your IP address and browser details when you open them.
3. Where it is stored
The main server is an Amazon EC2 instance in the AWS us-east-1 region (northern Virginia). PostgreSQL holds user data, Redis holds live sessions, and TimescaleDB holds metrics.
Copies leave that instance, and they go to a second region. Full database backups, write-ahead logs, and a journal of changes are shipped to an Amazon S3 bucket in the AWS us-west-2 region (Oregon). A standby copy of the database, run as an off-server observer on a separate small server, also sits in us-west-2. Both regions are in the United States. Deleted data stays in these copies until they expire (see section 7).
There is no data residency control. If you are outside the United States, your data is stored and processed in the United States. Some model providers listed in section 4 are located outside the United States. No standard contractual clauses or other transfer mechanism is in place yet, which is one reason the alpha is invitation-only. Counsel review owed on cross-border transfers.
4. Who else sees it
| Recipient | What they get | Why |
|---|---|---|
| Model providers: OpenAI, Anthropic, Google (Gemini), Amazon Bedrock, DeepSeek, Qwen (Alibaba), Moonshot AI, Zhipu AI, MiniMax, Mistral AI, Meta, OpenRouter, Together AI, Groq, Cohere, Fireworks AI, StepFun | The prompt and the content needed to answer it | Model inference. The default is OpenAI; the others receive your prompt only when a model from that provider is used |
| Amazon Web Services | Everything, as the host of the server, backups, and storage | Infrastructure |
| SendGrid | Your email address and the text of account emails | Sending sign-up verification and password reset emails |
| Discord | System alerts for the operator, which can carry account identifiers | Telling the operator when something breaks. Not a channel you use |
| Let's Encrypt | The domain name of the site, when the web certificate is issued or renewed | Issuing the TLS certificate for the site. No user data |
| Stripe | Customer and subscription identifiers, only if a paid plan is turned on | Payment processing. Not live during the alpha |
| A service you connect yourself (see section 5) | Whatever that connection sends or reads | Only for connections you turn on |
Your data is not sold, not rented, and not used to train any large language model.
If you supply your own model API key, requests go to that provider under your key and their terms apply in addition to this policy.
5. Data from services you connect
You can connect accounts such as Google (Gmail, Calendar, Drive), Microsoft (Outlook, OneDrive, Teams), Slack, GitHub, Trello, HubSpot, Zendesk, Notion, LinkedIn, X (Twitter), and Discord. Nothing is connected unless you click through that service's own consent screen. Which of these are switched on can change during the alpha. Microsoft publisher verification needs a named legal organization, which does not yet exist; Microsoft connections show an unverified-publisher notice until then.
What AYA does with connected-account data
- It reads or writes that data only when you ask AYA to do something that needs it, and only to provide that feature to you.
- To answer your request, the content it fetched can be sent to the model provider that handles your request (section 4). Text sent out to a platform or provider passes through an automated scrubber first. The scrubber is best effort and does not make it safe to enter regulated data.
- AYA stores the access token for the account in the encrypted credential vault. It does not keep a standing copy of your mail, calendar, or files. Content appears in AYA only as part of a conversation, an action record, or the message log, and then follows the retention in section 7.
- It is not sold, not used for advertising, not used to decide credit or eligibility, and not used to train any model.
- No person at AYA reads your connected-account content, except when you ask for support and agree, when it is needed to investigate abuse or a security problem, or when the law requires it.
Google user data. AYA's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
AYA asks Google only for the access each feature needs. Each Google service is connected on its own and appears on Google's consent screen with its own permissions. The scopes AYA requests are these.
- Every Google connection:
openid,email,profile. Used to identify which Google account you connected. - Gmail:
gmail.readonlyto read the messages you ask about,gmail.sendto send a message you approved,gmail.modifyto label, archive or mark messages you ask AYA to change. - Google Calendar:
calendar.readonlyto read your calendars,calendar.eventsto create or change events you approve,calendarto manage calendars, the calendar list and sharing settings when you ask. - Google Drive:
drive.readonlyto read files,drive.fileto create or open files AYA works with,driveto change, copy, delete or share a file AYA did not create, when you ask and approve. - YouTube:
youtube.readonlyto read your channel,youtube.uploadto upload a video you approved,youtubeto manage your channel content, andyoutube.force-sslfor captions and comments.
This is the list the code requests as of 2026-10-13. It must match the consent screen before verification. Counsel review owed.
Model providers and Google data. The rule for Google user data is that it goes to a model provider only to answer a request you made, only to a provider whose terms bar training on it and bar keeping it, and never to the non-US providers listed in section 4. That rule is the commitment. A routing exclusion that enforces it for Google content is not built or verified yet, and the provider terms have not been checked one by one. Until both are done, connect Google only if you accept that gap. Counsel review owed.
Google data retention and deletion. Google content that passes through AYA is deleted when you ask by email to hobbes@aya.network, or as part of closing your account, and it ages out of the message log and change journal on the schedules in section 7 (30 days raw in the message log, up to 400 days in the journal). Backups hold it until they expire (sections 3 and 7). There is no self-serve delete yet.
Taking access away. Revoke AYA at the service itself. For Google, that is myaccount.google.com/permissions. Revoking stops new access at once. You can also email hobbes@aya.network and the stored tokens for that service will be removed by hand. A disconnect button inside AYA is not confirmed for every service yet. While the Google connection is in testing mode, Google expires the access every 7 days and you will be asked to reconnect.
6. Encryption
- At rest: stored credentials, email addresses, and the conversation content that the account setting covers are encrypted with authenticated encryption. Keys are held in server environment configuration. Image data is not field encrypted. Whole-disk encryption of the database volume is not claimed here.
- In transit: TLS 1.2 or better, terminated at the server's reverse proxy.
- Passwords: bcrypt, salted, one-way.
- Session tokens: SHA-256 hash, one-way.
No third-party security certification exists. AYA has not been audited against SOC 2, ISO 27001, or any comparable standard, and no such claim is made here.
7. How long it is kept
| Data | Retention |
|---|---|
| Conversations | Configured at 7 days for the default alpha tier. Enforcement of that figure is not yet verified, and the cleanup job may not be on |
| Live sessions in Redis | 24 hours |
| Session activity records | Under review; no verified deletion job. Counsel review owed |
| Security events | Under review; no verified deletion job. Counsel review owed |
| Message log between internal components (bridge message log) | 30 days of raw rows |
| Operational metrics | Raw 7 days, summarized rollups 400 days |
| Error records | 180 days |
| Change journal copies in S3 | Moved to cheaper storage at 30 days, deleted at 400 days |
| Database write-ahead log copies | 21 days, after two full base backups exist |
| Account record | Until you ask for deletion |
These values are configuration, and configuration changes during an alpha. Some of the cleanup jobs behind these values are still being switched on, so a row can live longer than the table says until that is finished. Backups age out on the schedules above, so deleted data can remain in a backup for up to that long. Retention for audit records is under review; counsel review owed.
8. Your choices and requests
Email hobbes@aya.network to ask for a copy of your data, a correction, or deletion. State which account. A reply is targeted within 45 days. Counsel review owed on the 45-day figure.
Honest limits during the alpha, so you know what you are getting:
- Requests are handled by a person, not by a button. There is no self-serve delete or export in the app yet.
- Deletion is done by hand. Related rows in secondary tables may survive a first pass; ask and it will be chased down.
- Export may be produced by hand.
- Records held for audit or security purposes are kept for the periods in section 7 even after account deletion, because their purpose is to show what happened.
- Backups hold deleted data until they expire (sections 3 and 7).
9. Protected health information
Do not put real protected health information into AYA. No signed Business Associate Agreement is in place and none is offered during the alpha. See section 6 of the Terms of Service.
10. Children
AYA is not for anyone under 18 and is not directed at children. No data is knowingly collected from them. If you believe a minor has registered, write to hobbes@aya.network and the account will be removed.
11. Breaches
If your data is exposed, affected users will be told by email at the address on the account, without undue delay and as the law requires, with what was affected and what is being done. Scoping is done by querying the audit log by hand today, so expect a first notice that is honest about what is still unknown. Counsel review owed on notice duties.
12. Changes to this policy
When this policy changes, the version date at the top changes. Where the change is material you may be asked to accept again at sign-in.
13. Contact
Privacy Policy, version 2026-10-13. Paired with the Terms of Service.