Privacy Policy

This policy explains how the Aish app and the website aish-talk.com ("Aish", "we") handle your data. The data controller is SmartThings LLP, a company registered in the Republic of Kazakhstan (details at the end of this document). We process data in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Its Protection" and, for users in the European Union, the General Data Protection Regulation (GDPR).

By using the app you agree to this policy. If anything here does not suit you, do not use the app and contact us — we will delete your data.

1. What we collect

Account data

• A guest account is created automatically on first launch: a random user identifier and a device identifier. At that point we know neither your name, phone number, nor email.
• Phone number — if you choose to sign in so your dream journal survives a change of device. To sign in, we send a confirmation code through Telegram.
• Sign in with Apple or Google — if you choose it, we receive from Apple or Google a permanent account identifier, your email address (with Apple, possibly a private relay address that forwards to your inbox, and only on the first sign-in), and your name if you share it. With Apple we also keep a token that lets us revoke the sign-in when you delete your account. We do not receive your Apple or Google password.
• Preferences: language, time zone, and the options you pick.

Dream conversations

• Voice — audio of what you say is streamed in real time for speech recognition and Aish's reply.
• Conversation text — the transcript of your words and Aish's replies.
• Results — the pictures, comics, videos, and reflections created from your dream, and your dream journal.

Dreams can be deeply personal — about health, relationships, feelings. We process such content only to hold the conversation and create the result. We do not use it for advertising or profiling.

Technical data

• Device model, operating system and app version, app identifiers on the device, system language.
• IP address, request timestamps, error codes, and server logs.
• App usage events (screen opened, conversation started, format chosen) — never the content of your dreams.

Purchases

Purchases of Sparks and the Pro subscription go through the App Store, Google Play, or — on the website — Paddle, our Merchant of Record. From them we receive a transaction and subscription identifier, the item, the amount and currency, the status, and the email address you gave at checkout — never your card details. Paddle processes your payment and billing data as an independent controller under its own privacy policy.

Waitlist

If you join the waitlist on our website, we keep your email address to tell you once when Aish launches and to send a promo code for 2 weeks of Pro and bonus Sparks. You can ask us to remove it at any time through the contact form.

Support requests

What you write in the contact form, the email address you leave for a reply, and any details you attach.

2. Why we process data

3. Artificial intelligence

Aish runs on Google Gemini models. Your voice, conversation text, and dream description are sent to Google through its API for speech recognition, dialogue, Aish's voice synthesis, and the creation of pictures, comics, and videos. We use the paid Gemini API terms, under which Google does not use the data we send to train its models.

Aish's conversation and dream reflections are generated automatically. They are not medical, psychological, or any other professional advice, and any decisions based on them are your own.

4. Who receives your data

We do not sell data. Dream content, conversations, and results are never shared with advertising or analytics services. Data reaches only the services below:

• Google (Gemini API, Google Cloud) — processing voice and text and creating results.
• Langfuse — an observability service that stores conversation traces (text, request parameters, cost) so we can investigate errors and account for spending. Only the team has access.
• Apple and Google — processing in-app purchases and subscriptions, and Sign in with Apple and Google sign-in if you use them.
• Google Firebase (Google Analytics for the app and Crashlytics, United States) — app usage statistics and crash reports. Firebase receives service events (first launch, session start, sign-in and sign-out, account deletion and plan), the device model, OS and app version, approximate location derived from the IP address, and an installation identifier, and, when the app crashes, a technical description of the error. Advertising identifiers are not collected. Your phone number, email address, and the content of your dreams, conversations, and results never reach Firebase.
• Paddle (Paddle.com Market Ltd, United Kingdom) — the Merchant of Record for website purchases: payment, tax, receipts, subscription management, and refunds.
• Cloudflare — delivering the website and protecting it from attacks; it processes IP addresses and request data as our processor.
• Google Analytics on the website — only if you allow analytics cookies in the cookie banner (visitors from the EU, EEA, UK, and Switzerland are asked first; everyone can change the choice via “Cookie settings” at the bottom of any page). It records pages visited, the device and approximate location, and funnel events: joining the waitlist, signing in, starting and completing a purchase (amount and currency, no card details). We use it to see how visitors find and use the site and to measure our Google Ads campaigns. Google Analytics does not receive your phone number, email address, or anything about your dreams.
• Google reCAPTCHA — protecting the contact and sign-in forms on the website from bots; subject to Google's privacy policy and terms.
• Telegram (Telegram Gateway) — sending the sign-in confirmation code to your number.
• Hosting provider — running our servers and storing data.

Our servers, database, and stored files (voice recordings, pictures, videos) are located in the Netherlands (European Union).

The website uses cookies; which ones and how to control them is described in the Cookie Policy.

Some of these companies are located outside your country, including in the United States and the United Kingdom. Transfers rely on contractual data-protection safeguards (EU standard contractual clauses and similar mechanisms) or on adequacy decisions where they exist.

5. How long we keep data

• Voice recordings — up to 7 days after the conversation; then the files are deleted automatically.
• Conversation text, dreams, and results — as long as your account exists or until you delete them.
• Account and purchase data — as long as the account exists; payment records for as long as tax and accounting law requires.
• Technical logs — a limited period, usually no longer than a few months.
• Guest accounts that have not been used for a long time may be deleted together with their data.

6. Your rights

At any time you can:

• find out what data we hold about you and receive a copy;
• correct inaccurate data;
• delete your account together with dreams, results, and conversation history;
• object to processing based on legitimate interest, including analytics;
• withdraw consent where processing relies on it;
• lodge a complaint with the data-protection authority of your country (in Kazakhstan — the Information Security Committee of the Ministry of Digital Development).

You can download a copy of your data in the app (Profile → Download my data) and delete the account yourself — see the next section. For anything else, contact us and quote the user ID from the Profile screen of the app or the phone number you signed in with, or write from the email address linked to your account or used to pay on the website. We reply within 30 days.

Account and data deletion

You can delete your account at any time: in the app (Profile → Delete account) or by sending a request through the contact form (topic “Account and sign-in”).

• Confirmation by email: we send a link to the email confirmed in your account. It works for 24 hours and only once; until you open it and confirm, nothing is deleted. If no email is confirmed in the account, add and confirm one in the app first.
• After you confirm: you are signed out on all devices right away and can no longer sign in to the account. We email you a link to an archive with your dreams, dream reflections, conversations with Aish, and the pictures, comics, and videos with the Aish watermark. The account is then deleted, usually within minutes; if a conversation or a generation is in progress, after it ends.
• The archive is kept for 7 days after the account is deleted so you can download it, and then deleted automatically. Until then we keep it together with the email address the link was sent to.
• Deleted: the account with your phone number, name, email, and Apple and Google sign-in identifiers (if you signed in with Apple, we also ask Apple to revoke the app's access); dreams, conversations with Aish, voice recordings, pictures, comics, videos, and dream reflections; feedback surveys, messages from the contact form, and the waitlist entry for your email.
• Kept without personal data: records of payments and Sparks (amounts, products, dates, and the payment provider's transaction numbers) — for as long as tax and accounting law requires. They are unlinked from the account and contain no phone number, name, or email.
• Data exports you requested in the app are deleted together with the account; otherwise the download link and the archive expire after 24 hours.
• Subscriptions: a subscription bought on the website is cancelled immediately when the account is deleted, with no further charges. Subscriptions bought in the App Store or Google Play are not cancelled by deleting the account — cancel them in the store.

Deletion is irreversible. Signing in again with the same email creates a new, empty account.

7. Children

The app is not intended for anyone under 16, and we do not knowingly collect their data. If you learn that a child is using Aish, contact us — we will delete the account.

8. Security

Data travels over encrypted connections (TLS); access to servers and services is limited to the team and protected by keys and authentication. Links to media files are temporary and expire. No storage method is absolutely secure, so please do not dictate passwords, card numbers, or document numbers to Aish.

9. Changes

We update this policy when the app or the law changes. The revision date is shown at the top of the page; we announce material changes in the app. Continuing to use Aish after a change means you accept the new version.

10. Contact

Questions about data and requests to exercise your rights are accepted through the contact form.