Privacy policy
Ayy Privacy Policy
Effective date: 7 November 2026
Applies to the invited closed beta when this policy is presented in the app.
1. Operator and scope
Ayy is an adults-only nearby communication service operated by Ayush Srivastava, an individual based in India, under the Kalaphos name. Privacy, support and safety contact: support@kalaphos.com.
This policy covers the core beta: device-account enrollment, profiles, nearby broadcasts, text conversations, notifications, reporting, support and deletion. General media sharing, cloud photo hosting, public profile search, optional verified email/phone attributes, payments, Compass and Wi-Fi Aware experiments are not features offered by this beta. A profile photo is supported separately from general media attachments.
2. Your account identity
The app creates a cryptographic identity for this installation and uses its public key to prove account control. Account services process a pseudonymous account identifier, authorized device binding, public verification material, authentication/security state, account timestamps and restriction/deletion state. Your private account key is not uploaded as a login credential.
Ordinary signup and Internet messaging do not require a phone number, email address, password or social login. We do not use your IMEI, hardware serial, Bluetooth MAC address or advertising ID as your Ayy account identity. The identity persists while its local key and valid account remain; losing the key, an explicit reset or permanent deletion can change it. There is no promise that a reinstall on every platform restores an account or local Chats.
3. Profile and photos
You choose a name, an optional introduction and an optional profile photo. The app prepares a compressed photo on your device and caches contact photos locally. A small rendition can accompany public-nearby material. Existing contacts may receive updated names, introductions and photos through protected profile-update traffic, including Relay. Updates can be delayed; recipients may continue displaying their last accepted cached revision.
Profile material is not a globally searchable server profile. Account services may retain profile-status/version metadata. Relay can temporarily store endpoint-protected profile-update ciphertext. We do not provide R2 or another general cloud-media upload service in this beta. Your gallery is not uploaded; the profile picker processes the image you choose. Cloud-only items may need to be available to the device before the picker can prepare them.
You can add up to two social handles to Your socials. They stay on your device until you choose to share them inside an existing chat; they are then sent to that person like a chat message, nearby or through Relay, and remain in that chat on both devices. Ayy does not check that a handle belongs to you.
If optional self-declared demographic fields are reachable and you deliberately disclose them, eligible peers can receive those fields. They do not verify your identity or age. Discovery preferences remain device-local.
4. Nearby and public broadcasts
Nearby is user-started and processes the radio/session information necessary for discovery and communication. We do not maintain a routine server history of precise geographic locations, raw Bluetooth/Wi-Fi observations or RSSI proximity readings. Permissions needed by a platform do not turn Ayy into a location-history service.
Choosing to show your profile makes the supported profile material available to eligible nearby participants. A broadcast you send includes your saved profile even in Broadcasts only mode. Normal profile-attached broadcasts use a persistent public signing persona for the same account/installation, so recipients can recognize the publisher across separate Nearby sessions. This public persona is not the private account key. Radio observers may also detect Nearby activity; Broadcasts only does not mean radio invisibility.
Broadcasts normally last five minutes, with a thirty-minute maximum, and are not a historical server feed. Recipients can copy or screenshot what they receive. We cannot force deletion of copies made outside the app.
5. Chats, local storage and Relay
Private histories, pending messages and session state are stored in encrypted local application storage. Local private-message history has a thirty-day retention window. This is not a cloud chat archive, and the beta does not provide cloud restoration of local chat history. Application storage is configured to exclude ordinary platform cloud backup where supported.
Direct-local text is authenticated but is not end-to-end encrypted by default. The chat shield offers optional E2EE after both participants agree. A pending request is not a completed change. Internet private messages are endpoint- protected even when the local E2EE preference is OFF. Account, Relay and Push do not ordinarily receive readable private-chat plaintext.
Eligible established relationships use Internet continuity automatically when needed. The provisional allowance is 1,000 Internet texts per account per UTC day, and shared socials count toward it; local messages do not consume that allowance. Relay holds protected encrypted objects for up to thirty days. It processes opaque mailbox/object identifiers, authorization, expiry, quota-spend and replay/delivery metadata needed to operate the service. The recipient’s mailbox ID is persistent; read/watch permissions are finite, renewable and revocable. Message expiry does not change the person’s contact identity or erase the recipient’s own copy.
Deleting a conversation removes its visible local history. Necessary identity, deduplication, receipt and cryptographic state may remain for safe delivery and relationship continuity; a new incoming message may make the relationship visible again. Conversation deletion is different from account deletion and does not remotely erase another participant’s history. No unsupported fixed age limit on this residual protocol state is promised.
6. Notifications and service providers
APNs on Apple devices and Firebase Cloud Messaging on Android provide notifications and permitted background wake hints. Push is not the private message transport. Push services process provider/installation tokens, endpoint identifiers and delivery information. Payloads do not intentionally include private-message text, profile photos, report evidence or mailbox secrets. Registrations have a thirty-day lifetime and are renewed/revoked as needed.
Android’s Firebase SDK also processes installation identifiers and technical application/SDK information necessary for messaging. Firebase Messaging does not mean we enabled Firebase Analytics. The beta does not enable behavioral analytics, advertising SDKs or a crash-reporting SDK.
Supabase and DigitalOcean provide application database/hosting services; the documented application hosting region is Frankfurt, Germany. Apple and Google provide device notifications. Cloudflare provides our domain name service, website hosting and forwarding of email sent to support@kalaphos.com. Their infrastructure can process technical and connection data in other countries. An EU hosting location does not mean all processing stays in the EU. Provider contracts and applicable transfer safeguards apply to their processing; contact us for information relevant to your location. Network/hosting providers receive IP addresses and request timing necessary to deliver and protect connections. We do not use them to build behavioral profiles.
7. Reports, moderation and support
When you report, services receive the report/case identifiers, reporter account reference, available reported account/content reference, reason, timestamps and evidence you deliberately select. The current consumer flow offers selected private-text excerpts; general screenshot/photo/audio attachments are not promised by this beta. A selected excerpt becomes server-held restricted safety content, even when its original chat was E2EE. Unselected history is not uploaded merely because you filed a report.
Authorized staff may use case data and accessible selected evidence to assess reports, apply policy, process appeals or meet legal obligations. Sensitive access/actions are role-restricted and audited. Reporter identity is not disclosed to the reported person through the ordinary report workflow. A report is not automatically proof of misconduct or an automatic suspension.
The in-app Support & Safety Inbox sends server-readable support text and account/case metadata. It is separate from ordinary private chat. If you email support@kalaphos.com we process the sender/contact information and text you choose to send. Do not include private keys or unnecessary sensitive histories. Optional support/evidence is not used for advertising or behavioral analytics.
Blocks are local policy and can synchronize online where supported. They remain until you change them, permanently delete your account or the relevant target account is permanently deleted. No contact-book upload is required.
8. Retention
| Category | Limit or purpose |
|---|---|
| Public nearby broadcasts | Five-minute default, thirty-minute maximum; no restored public feed |
| Raw nearby observations | Current runtime/session use, no routine historical server dataset |
| Local private-message history | Thirty days |
| Pending encrypted Relay objects | Up to thirty days, separate from device-held copies |
| Contact/session identity and necessary delivery/security state | While needed for relationship continuity, security and valid account operation; not expired merely by a message’s expiry |
| Opaque Relay address/reservation | Persistent independently of message objects; can remain reserved after revocation to prevent reassignment, without retaining ordinary message content |
| Push endpoint registration | Thirty-day authorization, renewable/revocable |
| Account challenge | Five-minute default, ten-minute maximum; expired physical cleanup may be maintenance-triggered |
| Signed offline authority/moderation assertion | Seven-day default, thirty-day maximum validity; not unlimited permission |
| Ordinary Account replay records | Twenty-four hours |
| Replaced/revoked device binding | Ninety days |
| Ordinary inactive/closed Support Inbox thread | Up to twelve calendar months, with review due at ninety days |
| Open safety case | While genuinely active, reviewed at least every ninety days |
| Closed case metadata | Two years after final closure |
| Deliberately submitted evidence | Case/appeal resolution plus twelve months |
| Moderation history / resolved appeals | Two years after action ends / final resolution |
| Staff/security audit | Three years |
| Coarse operational logs | No more than thirty days |
| Ordinary encrypted operational backup copies, where maintained | No more than a thirty-day rolling window; not a private-chat archive |
These periods do not authorize collecting a category that a feature does not use. Some expired rows are physically removed on bounded maintenance rather than at the exact millisecond their authorization expires. A valid scoped legal hold can preserve specifically identified records for as long as legally required; it does not preserve all accounts or invent private content we do not possess. Historical backup snapshots are not rewritten byte-for-byte; restoration must reapply current deletion/revocation state.
9. Delete your account
Use Request account deletion in Account & Safety. If you cannot access the app, visit https://ayy.kalaphos.com/account-deletion or email support@kalaphos.com with “Ayy account deletion request.” We must validate ownership without asking you to email a private key; inability to prove ownership can limit what we can safely do. Reinstallation is not a mandatory off-app request step.
Deletion starts a thirty-day deactivated grace period. New social publication, new conversations and Account-authorized Relay participation are disabled. Opening the app does not reactivate the account. Reactivation requires an explicit action with the still-valid original device identity.
After the grace period ordinary Account records, device bindings, active authority and Push registrations are permanently deleted/revoked. The app erases remaining local profile, chat/outbox, keys and account data when the device can next execute that process. We cannot physically erase an offline device that never runs again. Independent Relay ciphertext expiry, reserved opaque addresses, limited safety/legal/audit records, rotating backups and other users’ copies have the separate boundaries explained above. A deleted account is not resurrected simply by reopening an old installation.
10. Your choices, rights and security
You can edit your profile, stop Nearby, control permitted disclosures, revoke OS permissions, block/report and request deletion. Account & Safety provides an account-data export; this is not a promise of server-held private-chat history. Depending on applicable law, you may also have rights to access, correct, delete, object, restrict processing, obtain portability or complain to a regulator. Contact support@kalaphos.com so we can handle and authenticate the request.
We process necessary account/communication data to provide the service you request, optional disclosures/evidence when you choose to submit them, and limited security, abuse-prevention and legal data for those purposes. Where applicable law requires a particular consent or another lawful basis, that requirement applies; accepting the Terms is not blanket permission for new data uses. We may disclose information we lawfully hold when required by valid legal process. We cannot provide private plaintext we never possessed.
Device secure storage, encrypted persistence, access controls and endpoint protection reduce risk, but no system can guarantee absolute security. Cryptographic identity is not real-world identity verification. Do not use Ayy for emergency communication or rely on an always-on background-delivery guarantee.
11. Website and policy changes
The informational website has no account login, advertising tracker, behavioral analytics or contact form in its current source. Its host/network providers can process ordinary technical request metadata; emailing us supplies your email and the content you choose to send. App disclosures and website processing are separate from third-party pages you choose to visit.
Material changes will be reflected in updated policies and appropriate notice or consent before the affected new use. Contact the operator at support@kalaphos.com for privacy questions or required local correspondence details. No residential address is made public by this document.