AYA: Privacy Policy

This Privacy Policy explains what data AYA collects, why we collect it, how we protect it, who we share it with, and your rights regarding your data. We take your privacy seriously. AYA is designed so that your wellness data stays yours.

1. Data We Collect

1.1 Account Information
When you create an account, we collect your phone number (used for authentication via a one-time passcode) and, if you choose to sign in via Apple or Google, the email address and display name those providers share with us. We also collect the username, display name, profile avatar, and year of birth (used to confirm you are at least 13) that you provide.

We store your phone number in two forms: as the original E.164 number (so we can authenticate you and show it back to you in Settings) and as a one-way SHA-256 hash (so other AYA users who have your number in their contacts can find you without us ever revealing your number to them). We do not sell or share your phone number with any third party for marketing, advertising, or analytics purposes. Our analytics provider (PostHog, see Section 3) records your account ID so we can understand product usage; we do not send your phone number, email, or location to PostHog.

1.2 Dosha and Wellness Data
When you take the AYA quiz, we collect your responses (26 baseline questions, up to 15 deepening questions, and periodic 6-question check-ins). From these responses, we calculate your dosha percentages (Vata, Pitta, Kapha), guna scores, archetype assignment, and current balance state (vikriti). We also store a timestamped history of your balance check-ins so you can track changes over time.

The quiz and check-ins collect information that is health-related: questions about sleep patterns, digestion, energy, mood, body temperature tendencies, body characteristics, and (if you indicate your gender) menstrual cycle. We treat all of this as sensitive personal information and protect it accordingly under applicable privacy laws. AYA is not a medical service and this is not clinical or diagnostic health data. We do not use this information to diagnose, treat, cure, prevent, or mitigate any disease or condition.

1.3 Location Data
AYA requests your device location to provide weather-aware daily guidance. If you grant location permission, we use your latitude and longitude to fetch current weather, 7-day forecasts, and air quality data from third-party weather APIs. With your permission, we save your latitude and longitude to your AYA account so the app does not have to re-request location each time you open it, and so friend-pairing features can compute approximate distance between two friends. You can change or remove your stored location at any time in Settings. If you deny location permission, AYA still works but uses generic environmental data.

1.4 Contact Information
AYA does not currently access your phone's address book or contacts. You can find friends by searching their AYA username, or by typing a phone number into the search field — when you type a phone number, AYA hashes it on your device with SHA-256 and looks for an existing AYA user whose stored hash matches. We never receive or store the raw phone numbers you type into search.

1.5 Teacher Chat and AI Content
AYA uses Anthropic (Claude) to generate four kinds of personalized content: the daily forecast, the environmental narrative on your forecast tab, the Teacher chat, and friend-pairing hooks. Each sends a different slice of your data to Anthropic.

When you use the Teacher chat, we send Anthropic the messages you type, plus your dosha percentages, archetype, current balance state (vikriti), season, and city name. Do not type information into the Teacher chat that you would not want sent to a third-party AI service.

For the daily forecast and the environmental narrative, we send Anthropic your dosha percentages, archetype, current balance state, the current season, your city name, and current weather data — temperature, conditions, humidity, wind, air quality, and a multi-day forecast outlook — derived from your latitude and longitude.

For friend-pairing hooks, we send Anthropic both your and your friend's dosha percentages, archetypes, current balance states, and exact coordinates (latitude and longitude), along with the weather at both locations, so the AI can ground its guidance in the distance and environmental contrast between you. We also send a single text identifier for your friend so the AI can address them by name: their display name when they have set one on their AYA profile, or their username when they have not. If neither is available, the AI is instructed to refer to them as "your friend" instead. We do not send your friend's phone number, email, gender, or any free-text content typed by you or your friend.

We do not send your raw phone number, email address, contact list, or full quiz answers to Anthropic. Anthropic does not store the content of these requests beyond what is necessary to return a response and to operate its service in line with its own data policy.

1.6 Usage and Device Data
We collect product usage data through our analytics provider PostHog to understand how the app is used and to fix problems. PostHog receives: your AYA account ID, the names of events you trigger inside the app (such as quiz_completed, forecast_viewed, friend_profile_viewed, recommendation_tapped, learn_article_viewed), the page URLs you view inside the app, the referring page where applicable, your device type and model, your operating system version, and your IP address.

PostHog does not receive: your phone number, email address, profile content, free-text messages, location coordinates, dosha data, quiz answers, or anything you type into the Teacher chat. Our analytics code explicitly blocks sending these fields.

We do not use third-party advertising trackers, we do not share data with data brokers, and we do not build advertising profiles from your data. AYA does not request App Tracking Transparency (ATT) permission because we do not engage in cross-app or cross-site tracking as defined by Apple. Product analytics are enabled by default for all users and cannot be disabled inside the app in the current version; if you restrict tracking at the device level (iOS Settings → Privacy → Tracking) we respect that setting.

1.7 Cookies and Local Storage
AYA stores a small amount of data on your device using local storage and cookies — for example, to keep you signed in, remember your preferences, and let our analytics provider attribute events to a single anonymous session and your account ID. We do not use advertising cookies or cross-site tracking cookies. You can clear this data by signing out, deleting the app, or clearing your browser data where AYA runs in a browser.

1.8 Purchases and Subscription Status
If you subscribe to AYA Plus, we store your subscription status on your account: the plan you chose (monthly or yearly), the store you bought it through (Apple or our web checkout), and the date your access is paid through. We use this only to unlock AYA Plus features and to operate the subscription. Payment itself is handled by Apple or, for web purchases, by Stripe via our subscription partner RevenueCat. We never receive or store your card number or full payment details.

2. How We Use Your Data

We use your data for the following purposes and no others: to authenticate your identity and maintain your account; to calculate your dosha profile and generate personalized daily recommendations; to provide weather-aware environmental guidance based on your location; to enable social features (friend connections, compatibility assessments); to operate, debug, and improve the app; and to communicate with you about your account or service changes.

We do not sell your personal data. We do not use your data for advertising. We do not share your individual data with third parties except as described in Section 3.

3. Third-Party Services

AYA uses the following third-party services to operate. Each is bound by its own privacy policy and, where applicable, a data processing agreement that requires equivalent protection of your data.

Supabase (database, authentication, infrastructure): stores your account record, quiz results, vikriti history, friendships, forecasts, push tokens, and saved location. Hosted in the United States.

Twilio (SMS delivery): receives your phone number, via Supabase, to deliver one-time verification codes for sign-in.

Anthropic (AI content generation): receives the data described in Section 1.5 to generate the Teacher chat responses, daily forecast narratives, environmental narratives, and friend-pairing hooks. Anthropic does not receive your raw phone number, email, contact list, or full quiz answers.

OpenWeather (weather data): receives your latitude and longitude to return current weather, 7-day forecasts, and air quality data.

Apple WeatherKit (weather data): receives your latitude and longitude to return weather data, when WeatherKit is the active provider.

BigDataCloud (reverse geocoding): receives your latitude and longitude to return the matching ZIP/postal code so the app can display your area name. No identifier or account information is sent.

RevenueCat (subscription management): receives your AYA account ID and purchase receipt data from Apple or from its web checkout to validate purchases, track subscription status, and notify us of renewals and cancellations. For web purchases, payment is processed by Stripe, which receives your payment details directly; we never see your card number.

PostHog (product analytics): receives your AYA account ID and product usage events (screen views, button taps, feature usage timing). We do not send your phone number, email, profile content, or location to PostHog.

Upstash (rate limiting): stores short-lived counters keyed by your account ID to prevent abuse of our AI and weather endpoints.

Apple Push Notification Service (push notifications): receives a device push token, when you opt in to notifications, so we can deliver alerts.

Apple and Google (sign-in): if you choose to sign in with Apple or Google, your authentication is handled by their respective services. We receive only the email address and display name you authorize.

4. Data Shared With Friends

When someone becomes your accepted friend on AYA, they can see: your display name, username, and profile photo; your archetype and dosha percentages; your current balance state (which doshas are elevated); your daily forecast highlights; compatibility data computed between the two of you; and your approximate location (latitude and longitude) so the app can show whether you are near, in the same region, or far from each other and ground friend-pairing guidance accordingly.

Friends cannot see: your phone number or email address; your year of birth; your gender; your dietary restrictions; your raw quiz answers; or any contact you have searched for.

5. Data Security

We protect your data using: Row Level Security (RLS) at the database level, which ensures that database queries can only return rows you are authorized to see, and column-restricted access functions for friend search and friend profile reads so other users cannot see your phone, email, or other private fields; encrypted connections (HTTPS/TLS) for all data in transit; phone number hashing (SHA-256) for contact discovery, so a phone number you search for is hashed on your device and never transmitted in raw form; server-side API key management, so third-party credentials are never exposed to your device; and authentication via one-time passcodes or OAuth, with no passwords stored.

No system is 100% secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security. If we discover a data breach that affects your personal information, we will notify you in accordance with applicable law.

6. International Data Transfers

AYA is operated from the United States, and our service providers are located primarily in the United States. If you access AYA from outside the United States, your information will be transferred to, stored, and processed in the United States and in other countries where our service providers operate. These countries may have data-protection laws that differ from those in your country. Where required by applicable law (for example, for transfers of personal data out of the European Economic Area or the United Kingdom), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to protect your information.

7. Data Retention and Deletion

We retain your data for as long as your account is active. Your vikriti (balance check-in) history is retained to show you trends over time. Daily forecasts are cached for up to 30 days and then deleted.

You can delete your account at any time from Settings → Delete Account. When you do, we immediately delete your account record and all data linked to it, including your profile, phone hash, location, quiz responses, dosha and vikriti results, daily forecasts, friendships, and push notification tokens. Some backup copies and operational logs may persist for up to 30 days before they are overwritten on the normal retention cycle. After deletion we retain only the minimum information required by law (e.g., basic transaction records if you ever made a purchase).

8. Your Rights

You have the right to: access the personal data we hold about you; correct inaccurate data in your profile; delete your account and all associated personal data (in-app, see Section 7); export your data in a portable format; withdraw consent for optional data collection (location, push notifications) at any time; and opt out of any future non-essential communications.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to request deletion, the right to correct inaccurate information, and the right to limit the use of sensitive personal information. We do not "sell" or "share" your personal information as those terms are defined under the CCPA, and we do not use or disclose your sensitive personal information for purposes that would require us to offer a "limit" option. We will not discriminate against you for exercising any of these rights.

If you are in the European Economic Area or the United Kingdom, you have rights under the GDPR/UK GDPR, including the right of access, rectification, erasure, restriction, data portability, the right to object to processing, and the right to lodge a complaint with a supervisory authority. We rely on your consent for optional features (location, push notifications, AI features) and for processing health-related (special category) data, and on the necessity of contract performance for core account features. You may withdraw consent at any time.

To exercise any of these rights, contact us at hello@ayaveda.app. We will respond within the time required by applicable law.

9. Children's Privacy

AYA is not directed at children under 13. At signup we ask for your year of birth and will not create an account for anyone we know to be under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at hello@ayaveda.app.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes to how we handle your data, we will notify you through the app before the changes take effect. The date at the top of this policy indicates when it was last updated.

11. Contact

For privacy-related questions or to exercise your data rights, email us at hello@ayaveda.app. We will respond to all privacy requests within 30 days.