Aya Privacy Policy
Seori Arts ("we") handles and protects the personal information of people who use the Aya app ("the service").
- Effective: October 27, 2026
- Operator: Seori Arts (서리아트) · Representative: SeolHui Han · Business registration 824-41-01427 (Republic of Korea)
- Address: A-221, 480 Hoedong-gil, Paju-si, Gyeonggi-do, Republic of Korea
- Contact: help@seoriarts.com
This English version is a translation. If it differs from the Korean version, the Korean version applies.
Optional family notifications
If you enable family notifications, our Cloudflare server stores the delivery token, operating system, language and registration time. Apple APNs or Google Firebase Cloud Messaging receives the token and a generic update message, never names, health records, audio or encryption keys. Turning notifications off or removing a device deletes its server token and pending notifications when the request reaches the server. You can also block notifications in OS settings. Tokens not refreshed for 30 days are excluded from delivery. The Android notification SDK may process a per-installation identifier (FID) and basic OS, device model, installer and SDK version information. The app does not use the Google Analytics collection SDK or BigQuery notification metrics export.
1. No sign-up for solo use
Aya does not ask for your email, phone number, password or real name. Your notes stay only on your phone, and we don't receive them. Only when you turn on family connection is the information in 2-2 stored on our server, and only when you sign in with Apple or Google for a subscription or backup is the information in 2-3 stored.
2. What we handle and why
2-1. Information that stays on your phone (we don't receive it)
- Symptoms and visit notes: what you said (transcribed text), where, when, medicine, pain level, department, what the doctor said, medication changes, next visit, questions to ask
- Recordings, and the names and relationships of the people you care for (e.g. Mom, First child)
- Transcription and summaries happen on your phone. On iPhone, a speech model (Whisper) is downloaded once and used on the phone. Before the model is ready, or if it fails, Apple speech recognition is used; on devices without on-device recognition this may go through Apple's speech servers (under Apple's policy). On Android, only the on-device recognizer is used.
- The speech model is downloaded from Hugging Face (huggingface.co). No notes or recordings are sent; only connection information needed for the download (IP address) may be logged by that server.
This includes health information (sensitive data). We ask for your separate consent to process it on your phone when you first open the app.
2-2. Stored on our server when you turn on family connection
| Item | Purpose |
|---|---|
| Family notes as ciphertext (including note type and edit time) | Sharing notes between family phones. Notes are locked on your phone before sending, and the key is passed between family phones only by QR code. We have no key and can't read the content. |
| Family ID, phone ID (random), phone name (what your family calls you, e.g. Mom), time connected · last seen | Showing the list of family phones, removing a phone |
| Phone token (only a hash is stored) | Checking that a phone belongs to the family |
| Subscription: App Store / Google Play original transaction ID, expiry, plan (number of phones) | Checking the family plan and how many phones can connect |
| Daily request count per phone | Preventing abuse (deleted after 3 days) |
| Access logs (IP address, request time) — Cloudflare server logs | Troubleshooting · security |
We don't receive payment details (such as card numbers). Payments are handled by Apple and Google.
2-3. Stored on our server when you sign in with Apple or Google
You sign in only to use a subscription, family sharing or backup. We don't receive the name or email Apple or Google may share.
| Item | Purpose |
|---|---|
| Account ID: a hash of your Apple/Google user ID (the original ID isn't kept) | Recognizing the same person |
| Sign-in token (only a hash is stored), sign-in time · last seen | Checking that a phone is signed in |
| Subscription tied to the account (original transaction ID, expiry, plan), linked family ID | Keeping your subscription on other or new phones |
| Backup as ciphertext (notes, people you care for, family connection; original recordings are not included), backup time · size | Restoring after you change or lose a phone. Backups are locked on your phone before upload, and the key lives only in your iCloud Keychain or Google account storage and your recovery code. We have no key and can't read the content. |
3. How long we keep it
- Notes on your phone: until you delete them or the app (Settings → "Withdraw consent" deletes all notes on this phone)
- Family server data: deleted immediately when you tap Settings → "Delete all family notes from the server", or when the last phone leaves the family. Notes left on each phone stay.
- When a phone is removed from the family, its name and token are deleted immediately. Ciphertext of notes it left stays with the family.
- Account data and backup: deleted immediately when you tap Settings → Account → "Delete account". Uploading a new backup replaces the old one right away (only one is kept). Signing out deletes that phone's sign-in token.
- Daily request counts: 3 days · access logs: kept briefly under Cloudflare's log policy, then deleted automatically
- Server data of a family whose plan ended is kept until you delete it (so it can continue if you subscribe again). To delete it, use the method above or contact us.
4. Who can see it
With family connection on, phones in the same family can see the notes you leave and your phone name. No one outside the family can.
5. Processors and international transfer
| Recipient | Country | Items | Purpose | Period |
|---|---|---|---|---|
| Cloudflare, Inc. | USA (Cloudflare data centers) | Server items in 2-2 and 2-3 | Running the family sharing, account and backup server | As in section 3 |
| Apple Inc. | USA | Subscription payment info · speech audio (unsupported iPhones only) · Sign in with Apple · backup key (iCloud Keychain) | Payment, transcription, sign-in, keeping the backup key | Under Apple's policy |
| Hugging Face, Inc. | USA | Connection info (IP address) — only when downloading the speech model | Model download | Under Hugging Face's policy |
| Google LLC | USA | Subscription payment info (Android), ML Kit diagnostics (QR scanning), Sign in with Google, backup key (Google account storage) | Payment, QR recognition, sign-in, keeping the backup key | Under Google's policy |
Transfers happen over the network while you use the service. To refuse, simply don't turn on family connection (notes on your phone still work).
6. Notes for children and parents
Caregivers can keep notes about a child's or parent's health. Notes for children under 14 are kept and managed by the user who is their legal guardian. When keeping notes for another adult, such as your parents, please get their consent.
7. Your rights
You can view, edit and delete your notes anytime in the app. To withdraw consent, tap Settings → "Withdraw consent". You can ask us to view, delete or stop processing server data at the contact below. We have no key, so we can't show you note contents.
8. Security
- Family notes are locked on the phone with AES-GCM (256-bit) before sending · the key is never sent to the server
- Backups are also locked on the phone with AES-GCM (256-bit) before upload · the key is never sent to the server
- All traffic over https · phone and sign-in tokens stored only as hashes
- Request limits per phone
- No advertising or analytics tools
9. Privacy officer
SeolHui Han (Representative) · help@seoriarts.com
10. Changes
If this policy changes, we'll announce it on this page and in the app 7 days before it takes effect (30 days for changes that are unfavorable to you).