Privacy Policy

Welcome to AIary, a mental health and wellness application operated by APLICART, S.L.U ("we," "us," or "our"). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our mobile application and related services.

We are committed to protecting your privacy and ensuring the security of your personal data, especially given the sensitive nature of mental health information. This policy complies with applicable data protection laws, including the General Data Protection Regulation (GDPR) and other relevant privacy regulations.

By using AIary, you agree to the collection and use of information in accordance with this policy.

We collect several types of information to provide and improve our services. All of it is collected directly from you when you use the app, or automatically by the app as described below:

Account Information: When you create an account, we collect basic information such as your device identifier, platform (iOS/Android) and language preferences. We do not require email addresses or personal names for basic functionality.

Optional Profile Information: Your first name, only if you choose to provide it in the app.

Check-ins and Conversations: The text messages you write, the mood rating you select (1 to 5) and your conversation history with the AI companion, collected when you use check-ins and conversations.

Voice Recordings: If you choose to record a voice check-in, the recording is sent to be transcribed into text. We keep only the resulting text; the audio recording itself is not stored.

AI-Generated Data: From your check-ins, AIary generates mood and emotional intensity estimates, check-in summaries, a short memory of previous days, suggested micro-actions and insights.

Approximate Location: Your country and timezone, derived automatically from your IP address when you open the app. We do not collect your precise location.

Usage Data: We collect information about how you use the app, including features accessed, session duration and interaction patterns, to improve our services.

Device Information: We may collect device-specific information such as operating system version, app version and device model to ensure compatibility and optimal performance.

Analytics Data: We collect aggregated, anonymized usage statistics to understand user behavior and improve our app functionality.

We use your personal information for the following purposes:

Service Provision: To provide AI-powered responses, mood tracking, and personalized wellness recommendations based on your journal entries.

Personalization: To customize your experience and provide relevant content, insights, and features tailored to your emotional wellness journey.

Communication: To send you important service updates, notifications, and respond to your support requests.

Improvement: To analyze usage patterns and improve our AI algorithms, user interface, and overall service quality.

Legal Compliance: To comply with applicable laws, regulations, and legal processes.

Safety: To protect the safety and security of our users and prevent misuse of our services.

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances:

AI Service Provider (OpenAI): The content of your check-ins and conversations is sent to OpenAI to generate AI responses, only after you have given your permission in the app. Section 5 "AI Processing and Sharing with OpenAI" explains exactly what is sent, why, and how it is protected.

Service Providers: We work with trusted third-party service providers who help us operate our services, such as cloud hosting, subscription management, analytics and customer support. These providers are bound by strict confidentiality agreements and may only use your data to provide their service to us.

Legal Requirements: We may disclose information if required by law, legal process, or government request, or to protect our rights, property, or safety.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction, subject to the same privacy protections.

Consent: We may share information with your explicit consent or at your direction.

Emergency Situations: If we believe disclosure is necessary to prevent serious harm to you or others, we may share relevant information with appropriate authorities or emergency services.

AIary's AI features (conversation replies, voice check-ins, mood analysis, summaries and insights) are powered by a third-party artificial intelligence service. This section explains exactly what data is sent, who receives it, why, and how you stay in control.

Who receives your data: OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, United States, through the OpenAI API. OpenAI acts as our data processor: it processes your data only to return a result to us. No other AI provider receives your data.

What data is sent:
• The text messages you write in check-ins and conversations
• Voice recordings you choose to make, sent only to be transcribed into text
• The mood rating you select (1 to 5)
• Your first name, if you chose to provide one
• Summaries of your previous check-ins and suggestions generated by AIary, so that replies stay consistent over time
• Your app language, platform (iOS or Android), approximate country and timezone

What is never sent: your device identifier, email address, IP address, precise location, payment or subscription details, contacts, photos, or health data from other apps.

How it is collected: only from what you actively type, select or record in AIary. Data is sent when you send a message or a voice recording, and shortly afterwards in the background to produce your mood analysis, check-in summary and insights.

Why it is sent: to generate the AI replies in your conversations; to transcribe your voice recordings; to estimate your mood and emotional intensity and generate summaries, suggested micro-actions and insights; and to detect messages that may indicate a crisis, so that the app can show you crisis resources. Your data is never used for advertising, never sold, and never shared with OpenAI for any other purpose.

Your permission: Before any of your data is sent to OpenAI, the app shows you a screen that explains what data is sent and to whom, and asks for your explicit permission. Nothing is sent until you agree. If you decline, the AI features stay disabled and no data is sent to OpenAI. You can withdraw your permission at any time in the app settings; from that moment no further data is sent to OpenAI. Withdrawing permission does not affect processing carried out before.

How OpenAI protects your data: Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models. OpenAI may keep API data for up to 30 days to detect abuse, after which it is deleted, unless the law requires it to be kept longer. Our use of OpenAI is governed by OpenAI's Data Processing Addendum, which includes the Standard Contractual Clauses for transfers outside the European Economic Area. Data is encrypted in transit (TLS). OpenAI is contractually required to protect your data with the same or equal protection as described in this policy.

More information: OpenAI privacy policy: https://openai.com/policies/privacy-policy
OpenAI API data usage: https://openai.com/enterprise-privacy

We implement industry-standard security measures to protect your personal information:

Encryption: All data exchanged between the app, our servers and our service providers is encrypted in transit using TLS.

Secure Storage: Your data is stored on secure servers with multiple layers of protection, including firewalls, access controls, and monitoring systems.

Access Controls: We limit access to your personal information to authorized personnel who need it to provide services, and all access is logged and monitored.

Regular Security Audits: We conduct regular security assessments and updates to ensure our systems remain secure against evolving threats.

Data Minimization: We collect and retain only the minimum amount of data necessary to provide our services effectively. Voice recordings are not stored after transcription.

While we strive to protect your information, no security system is 100% secure, and we cannot guarantee absolute security.

You have several important rights regarding your personal data:

Right to Access: You can request a copy of the personal information we hold about you.

Right to Rectification: You can request correction of inaccurate or incomplete personal information.

Right to Erasure: You can request deletion of your personal data, subject to certain legal limitations.

Right to Portability: You can request your data in a structured, machine-readable format to transfer to another service.

Right to Restrict Processing: You can request that we limit how we process your personal information in certain circumstances.

Right to Object: You can object to certain types of processing of your personal information.

Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise these rights, please contact us using the information provided at the end of this policy.

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy:

Active Accounts: While your account is active, we retain your data to provide continuous service and maintain your journal history.

Deleted Accounts: When you delete your account, we begin the process of removing your personal data from our systems within 30 days, unless we have a legal obligation to retain certain information.

Legal Requirements: Some data may be retained longer if required by law, for legal proceedings, or to protect our legitimate interests.

Aggregated Data: We may retain anonymized, aggregated data indefinitely for research and service improvement purposes.

You can request earlier deletion of your data by contacting our support team.

Our mobile application may use technologies similar to cookies to enhance your experience:

Local Storage: We store preferences and settings locally on your device to improve app performance and remember your choices.

Analytics: We use analytics tools to understand app usage and improve our services. This data is typically anonymized and aggregated.

Third-Party Services: Some features may involve third-party services that use their own tracking technologies, subject to their respective privacy policies.

Opt-Out: You can control certain tracking through your device settings or by contacting us for assistance.

We do not use tracking technologies for advertising purposes.

Our app integrates with certain third-party services to provide enhanced functionality:

OpenAI: We use the OpenAI API to power our AI features. With your permission, the content of your check-ins and conversations is processed by OpenAI to generate responses. See section 5 "AI Processing and Sharing with OpenAI" for full details.

RevenueCat: We use RevenueCat for subscription management. They process subscription status and purchase receipts, subject to their privacy policy. Payments themselves are handled by Apple or Google.

Cloud Services: We use secure cloud hosting services to store and process your data with appropriate security measures.

Analytics Providers: We may use analytics services to understand app usage, always with appropriate data protection measures.

We carefully vet all third-party services and require them to provide the same or equal protection of your data as described in this policy.

AIary is not intended for use by children under the age of 13, and we do not knowingly collect personal information from children under 13.

Age Verification: While we don't require age verification for basic use, we recommend parental supervision for users under 18.

Parental Rights: Parents or guardians can contact us to review, modify, or delete their child's information if they discover their child has provided information without consent.

Teen Users: For users between 13-17, we recommend parental involvement in their mental health journey and app usage.

If we become aware that we have collected information from a child under 13, we will take steps to delete such information promptly.

As a company based in Andorra, we may transfer your personal data to other countries to provide our services:

Data Protection: We ensure that any international transfers comply with applicable data protection laws and provide adequate protection for your personal data.

Safeguards: We use appropriate safeguards such as Standard Contractual Clauses or adequacy decisions to protect your data during international transfers.

Service Providers: Our cloud hosting and AI service providers may be located in different countries. In particular, OpenAI processes data in the United States under Standard Contractual Clauses. All providers are required to maintain appropriate data protection standards.

Your Rights: Your privacy rights remain protected regardless of where your data is processed.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements:

Notification: We will notify you of significant changes through the app or by email if we have your contact information.

Effective Date: Changes become effective when posted, unless otherwise specified.

Review: We encourage you to review this policy periodically to stay informed about how we protect your information.

Continued Use: Your continued use of AIary after changes indicates your acceptance of the updated policy.

Previous versions of this policy are available upon request.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: contact@aiary.io
Support: Use the contact form in our app or website
Mail: APLICART, S.L.U, Carrer de la Solana 91, Andorra

We are committed to addressing your privacy concerns promptly and transparently. For data protection inquiries, please include "Privacy Request" in your subject line to ensure proper routing.

You also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction if you believe we have not adequately addressed your concerns.