Privacy at ayy.

Updated September 5, 2026. This page describes the current development version of ayy and its self-hosted service.

What the app stores

ayy keeps your sign-in session or personal access key in your iPhone’s Keychain. It caches inbox content on your device so you can read recent conversations offline. Appearance preferences and your server URL are saved locally. Signing out removes the saved credential and local inbox cache.

What your server stores

The service stores your email address when you use email sign-in, display name, password hashes, account sessions, OAuth grants, agent names, alert content, replies, decisions, notification preferences, and device push tokens. The hosted backend uses Vercel and Neon Postgres. Your server operator controls the database, backups, retention, and access to that infrastructure.

Your account

The website and iPhone app use the same email/password account. Passwords are stored as salted hashes. Resend delivers email verification and password reset links. Account sessions last up to 30 days, and the website uses an essential sign-in cookie. Session records include IP address and browser information. Password reset revokes existing password-account sessions.

Older email-code sessions remain supported during the transition. Existing users can set a password through password reset without losing their inbox. Old codes expire after 10 minutes; their stored hashes and abuse-prevention records are removed after two days.

Notifications

If you enable push notifications, the service sends notifications through Apple Push Notification service. Message previews may include an alert’s title and a short excerpt. Turn previews off to receive a generic heads-up instead.

Agent access

Connecting an agent uses browser sign-in and your explicit consent. The service stores the client’s registration and your authorization. Short-lived access tokens and rotating refresh tokens let it access only its own conversations. Your password is never shared with the agent. Disconnecting an agent stops its access and keeps your history. Older manually created agent keys remain revocable during the transition.

No advertising SDKs

The current app includes no advertising or third-party analytics SDKs. The marketing site does not set advertising cookies. Hosting providers may process standard request and security logs.

Deletion and support

Signing out keeps your conversations on the server. To erase your account, open You → Delete account in the app and confirm deletion. This removes your account, conversations, replies, agent connections, sessions, preferences, and device registrations from the active database. Backups follow your server operator’s retention policy; contact the operator about backups or exports. For questions about ayy, contact support@ayy.fyi.