Privacy Policy
Last updated: June 13, 2026
AY is a platform that enables individuals to create and manage digital twins and autonomous agents. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our mobile app, web app, or any related services.
We process personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, for users in the European Union, the General Data Protection Regulation (“GDPR”).
By using AY, you agree to the practices described in this policy. If you do not agree, please discontinue use of our services.
Account Information
Name, email address, and gender — required to complete your profile. Collected during registration via our self-hosted authentication system, which runs entirely on our own EU infrastructure.
Machine Data
Information about physical machines you register to your account, including machine name, type, and identifiers. Stored to enable machine management features.
Location Data
In the mobile app we may collect precise GPS location to provide location-based features. You control the granularity (off, country, city, or exact) in the app and can disable location access at any time in your device settings.
Device & Sensor Data
With your permission, the mobile app reads device motion and sensors (e.g. accelerometer, pedometer, gyroscope, barometer) to power activity and context features. You can revoke this access at any time in your device settings.
Health Data (special category)
Only if you explicitly consent, the mobile app reads selected Apple Health / HealthKit data (e.g. heart rate, steps, sleep, workouts). Health data is special-category data under KVKK Article 6 and is processed solely on the basis of your explicit consent, which you can withdraw at any time.
Content You Create
Messages, twin configurations, agent settings, and other content you create within the app. Stored to provide the core functionality of AY.
Usage Data
Pseudonymous usage analytics — such as screens visited, features used, and session duration — used to improve the product. On the web app this is collected only if you accept analytics cookies (see “Cookies & Similar Technologies”).
Authentication Tokens
Session tokens issued by our self-hosted authentication system are stored securely on your device using the platform's secure storage. We do not store passwords.
Location, sensor, and health data are collected only in the mobile app and require your explicit permission. You can withdraw consent or revoke access at any time; this does not affect the lawfulness of processing carried out before withdrawal.
- To create and maintain your AY account
- To provide core features: digital twins, agent management, messaging, and machine control
- To personalize your experience based on your profile and preferences
- To improve our product via usage analytics
- To ensure the security and integrity of our services
- To communicate important service updates or support responses
We integrate the following third-party services, each governed by their own privacy practices:
PostHog (Product Analytics)
We use PostHog to understand how the product is used — such as pages viewed, features used, and session duration — so we can improve it. This data is pseudonymous (linked to a random identifier, not your name) and PostHog is hosted on EU servers (eu.i.posthog.com). On the web app, PostHog only loads after you accept analytics cookies and stores cookies and similar identifiers on your device for this purpose; you can decline or withdraw at any time. See posthog.com/privacy.
AI Chat Providers (Twin Chat)
Your Twin uses third-party AI language model providers to generate chat replies. During in-app onboarding you choose which provider receives your data — OpenAI, Anthropic, Google (Gemini), or xAI (Grok) — and you give explicit consent before anything is sent. What is sent: your chat messages and questions, relevant conversation history for context, and excerpts of your Twin profile (e.g. personality traits, language) needed to generate the reply. Even in “Only Twin Mode” (no external fact lookups), your Twin itself runs on OpenAI as its underlying engine, so your messages are processed by OpenAI to generate replies. If you enable the optional outage fallback, your message may be sent to OpenAI when your chosen provider is unavailable. Voice input is transcribed by OpenAI Whisper, which means your audio recording is sent to OpenAI. These providers process data on their own servers (typically in the USA) under their own privacy policies; transfers are carried out in accordance with KVKK Article 9 and applicable GDPR safeguards. You can switch providers or withdraw consent at any time in Settings → AI helper.
AI Image Processing (Twin Avatar)
When you create or regenerate your Twin avatar from a selfie, the photo is sent to the Google Gemini API to generate the avatar image. The photo is used solely for this purpose and is only processed when you actively trigger avatar creation.
AI Content Generation (Automatic Twin Posts)
When your Twin drafts content for you automatically (e.g. post suggestions or notifications based on photos, location, weather, or connected devices you have linked), summaries of that context are processed by AI inference providers (including Cerebras, Groq, Mistral, and Google) to generate the content. This only applies to data sources you have actively connected.
Infrastructure Providers
Our services — including our self-hosted authentication system — run exclusively on cloud infrastructure located in the EU (Germany and Finland). All infrastructure providers are bound by data processing agreements compliant with GDPR. As the operator is based in Türkiye, personal data may be transferred between Türkiye and the EU; such transfers are carried out in accordance with KVKK Article 9 and applicable GDPR safeguards.
All third parties with whom we share user data are contractually required to provide the same or equivalent level of data protection as described in this policy.
On the web app we use cookies and similar technologies (such as local storage) for two purposes. A cookie banner on your first visit lets you accept or decline the optional ones, and you can change your choice at any time in the cookie settings.
Strictly Necessary
Required for the service to function — keeping you signed in, securing your session, remembering your language, and storing your cookie choice. These are always active and do not require consent.
Analytics (optional)
Set only if you accept them. We use PostHog (third-party product analytics, described above) to understand product usage, and our own self-hosted error monitoring (Sentry), which runs on our EU infrastructure and may record technical details and a short replay of your session when an error occurs, to help us fix problems. Neither is active until you consent, and both are switched off again if you withdraw consent.
Declining analytics cookies does not affect your ability to use the service.
We retain your personal data for as long as your account is active or as needed to provide our services. Usage analytics data is retained for up to 24 months.
You may request deletion of your account and all associated personal data at any time by contacting us at [email protected]. We will fulfill deletion requests within 30 days.
Under the KVKK (Article 11) and, for EU users, the GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your personal data ("right to be forgotten")
- Revoke consent to data processing at any time
- Request a portable copy of your data
- Lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, for EU users, your local supervisory authority
To exercise any of these rights, contact us at the address below.
For privacy-related inquiries, data deletion requests, or to exercise your rights, please reach out to the data controller responsible for processing your personal data:
Adem Sahin · Operator of AY (aytwin.ai) — Gebze, Türkiye · [email protected]