Privacy Policy

1. Introduction

Welcome to SaiyamAI ("we," "our," "us," or the "Company"). We are a digital wellness company that helps you manage your screen time through an AI-powered application (the "App"). This Privacy Policy explains how we collect, use, disclose, store, and safeguard your personal data when you use our App.

This Privacy Policy applies to all users worldwide. Where specific regulations (such as the EU's GDPR, California's CCPA/CPRA, India's DPDPA 2023, or Brazil's LGPD) grant you additional rights, those rights are described in Section 11 below.

By installing, accessing, or using the App, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please uninstall the App and do not use our services.

2. Data Controller Information

The data controller responsible for your personal data is:

3. Information We Collect

We follow the principle of data minimization—we collect only what is necessary to deliver our digital wellness services.

3.1. Information You Provide

3.2. Information Collected Automatically

3.3. Information We Do NOT Collect

• ❌ User-typed text, messages, passwords, keystrokes, or screenshots (the optional Reels Blocker and Reel Cap features read Instagram's and YouTube's UI accessibility labels on-device solely for surface detection and scroll counting — never stored or transmitted)
• ❌ Keystrokes or typed text
• ❌ Notification content from other apps
• ❌ Contacts, call logs, SMS messages
• ❌ Photos, camera, or microphone data
• ❌ Precise GPS location
• ❌ Browsing history or URLs visited
• ❌ Advertising ID for ad targeting or cross-app tracking for commercial advertising purposes

3.4. What "Anonymised" Means — How We Protect Your Identity

SaiyamAI stores your data in your personal account (Firebase) linked to your account ID. This is necessary for backup, sync, and personal features like weekly progress reports. However:

• ✅ Your personal identity (name, email, or account ID) is never shared with the Google Gemini AI model, any analytics partner, any third-party company, or any aggregated dataset used for reporting or potential data sales.
• ✅ When we say "anonymised usage data": your personal identity is stripped before any external use. For example, we may internally know "User #A147 used Instagram for 2 hours," but any external report states only "a user in India used Instagram for 2 hours."
• ✅ The AI model receives your plans, usage patterns, chat history, memories, and timezone — but never your name, email, or any detail that identifies you to Google or any other party.
• ✅ If you have not opted into analytics (Checkbox 1 during onboarding), your data is excluded entirely from analytics, model improvement, and aggregated reporting.

"Anonymised" = externally de-identified, not internally unlinked. Our internal systems link data to your account to deliver the service. Externally, your identity is never exposed.

4. Android Permissions — Detailed Disclosure

Our App requires the following Android permissions. Each is used solely for the stated purpose:

5. How We Use Your Information

5.1. Lawful Bases for Processing (GDPR Article 6)

Analytics consent (Checkbox 1) can be withdrawn at any time via Settings → Privacy → Analytics Consent. Withdrawal does not affect the lawfulness of processing before withdrawal or the core App service.

5.2. Specific Uses

• Core Functionality: Enforcing app limits, blocking apps during strict times, displaying nudge overlays, respecting DND windows.
• AI Processing: Generating contextual responses. See Section 6.
• Backup & Sync: Storing your plans, chats, memories, usage snapshots, and session data in Google Firestore for device-switching and data recovery.
• Analytics (opted-in users only): Monitoring how the AI performs and whether nudges are effective using aggregated, de-identified usage data. Only users who opted into Checkbox 1 contribute to analytics.
• AI Model Improvement (opted-in users only): We may use aggregated, de-identified interaction signals — such as which AI responses users found helpful — to improve our own AI systems. We will never use the content of your chat messages or personal details for model training. This is always tied to your analytics consent.
• Notifications: Timer bubble, threshold alerts, and weekly usage reports.
• Subscriptions: Processing and verifying paid subscription purchases made through Google Play Billing, and managing your entitlement to premium features.

6. AI Data Processing

6.1. What We Send to the AI

When you interact with SaiyamAI (in Plan Mode or Nudge Mode), we send the following context to Google's Gemini API:

Your name, email address, and account identifier are never sent to the AI model. The AI receives only the contextual wellness data listed above.

6.2. How the AI Uses It

• The AI uses this data solely to:
  • Help you set or adjust screen time plans.
  • Evaluate snooze/extension requests (and push back when appropriate).
  • Provide personalized wellness insights.

6.3. AI Data Safeguards

• No model training: Your personal data is not used to train or fine-tune any AI model.
• No data retention by AI: Prompts and responses are processed in real-time. Google's Gemini API (when used with API key or service account) does not retain your prompt data for model improvement per Google's API Terms.
• No automated decisions with legal effect: The AI does not make decisions that produce legal effects or similarly significant effects on you. You always retain the ability to override the AI by opening the SaiyamAI app.

7. Data Sharing and Disclosure

7.1. Service Providers (Sub-Processors)

We share data with the following categories of service providers, who are contractually bound to protect your data:

Google's privacy policy governs how Firebase Analytics and Crashlytics handle data: https://policies.google.com/privacy. Google acts as a data processor on our behalf for these services.

7.2. Legal Obligations

We may disclose your data if required by law, regulation, legal process, or governmental request (e.g., court order, subpoena).

7.3. Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred. We will provide prior notice and, where required by law, obtain your consent or provide an opt-out mechanism before transferring data to a new entity with a different privacy policy.

7.4. Future Data Monetization

Should we decide to monetize data in the future, we commit to:

1. Updating this Privacy Policy with at least 30 days' advance notice.
2. Providing a separate, explicit opt-in consent mechanism — not buried in ToS acceptance.
3. Offering a "Do Not Sell or Share My Personal Information" opt-out (as required by CCPA/CPRA).
4. Anonymizing or aggregating data before any sale wherever possible.
5. Never selling raw chat logs, memories, or accessibility data.
6. Any data sharing will comply with applicable laws (GDPR, CCPA, DPDPA, LGPD, etc.).

Aggregated Regional Insights: We may share or sell aggregated, regional, non-personal statistical insights (for example: "Users in [region] spend an average of X minutes on social media apps during [time period]"). This data:

• Contains no personally identifiable information and cannot be traced back to any individual.
• Is derived only from data of users who have opted into analytics (Checkbox 1).
• Constitutes statistical data, not "personal data" under applicable privacy laws (GDPR Recital 26, DPDPA).

If you have declined analytics consent, your data is excluded entirely from these aggregations.

8. International Data Transfers

Your data is stored on Google Firebase servers, which may be located in the United States or other countries outside your jurisdiction.

Safeguards for international transfers:

• Standard Contractual Clauses (SCCs): Google has adopted EU-approved SCCs for transfers from the EEA/UK/Switzerland.
• EU-U.S. Data Privacy Framework: Google LLC is certified under the EU-U.S. DPF.
• Encryption: Data is encrypted in transit (TLS/HTTPS) and at rest (AES-256) on Google's infrastructure.

By using the App, you acknowledge that your data may be transferred internationally with the safeguards described above.

9. Data Retention

Upon account deletion, all your data is permanently deleted from our systems within 30 days, including from Firestore and any backups. See Section 10 for deletion procedures.

10. Account and Data Deletion

11. Your Rights by Jurisdiction

12. Children's Privacy

Our App is not intended for children under 13 (or under 16 in the EEA, or under 18 in India under DPDPA).

We do not knowingly collect personal data from children below these ages. If you are a parent or guardian and believe your child has used our App, please contact us immediately at support@saiyamai.com. We will promptly delete the child's data.

13. Data Security

We implement the following security measures:

• Encryption in transit (TLS/HTTPS for all API calls and data sync)
• Encryption at rest (AES-256 via Google Firebase)
• Firebase Authentication for secure user identity verification
• Server-side access controls restricting data access to authorized services only
• No local storage of raw data on third-party servers beyond Firebase

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

14. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours (as required by GDPR Article 33).
• Notify affected users without undue delay if the breach is likely to result in a high risk to your rights (GDPR Article 34).
• For users in Singapore: notify the Personal Data Protection Commission (PDPC) within 3 days of assessing that a notifiable data breach has occurred, in accordance with the PDPA 2020 Amendment.
• Comply with breach notification requirements under DPDPA, CCPA, POPIA, and other applicable laws.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last Updated" date at the top.
• We will notify you via in-app notification or email at least 15 days before material changes take effect.
• Continued use of the App after the effective date constitutes acceptance of the updated policy.

16. Contact Us

For any questions, concerns, or data rights requests: