Privacy Policy — Aiza AI

Last updated: October 16, 2026

Aiza AI is operated by DilKiBaat (Taj Magsi, individual developer) ("we", "us", "the app"). Aiza is an AI companion for building habits and reaching goals, with simple CBT-style thinking tools — not a medical or mental-health service and not a substitute for professional care. This policy explains what data the app uses, who processes it, and your choices. Privacy questions: hello@dilkibaat.ca.

1. Data we use

Category	Source / processor	Why
Email address	Supabase Auth (sign-in)	Create and secure your account
Internal user ID	Supabase Auth (assigned automatically at sign-in)	Identify your account and associate your data with it
Name, email, profile photo	Google Sign-In (if you use it)	Sign you in
Voice audio + chat messages with Aiza, and Aiza's replies	ElevenLabs (Conversational AI; Zero Retention Mode — not stored)	Power your voice/text conversations
Your first name + the goal areas you chose at onboarding	ElevenLabs	Personalize how Aiza talks with you
Daily check-in ratings and journal entries	On your device, and backed up to your account on Supabase when signed in	Show your history and your "My Journey" / Progress views
Text of a journal entry	OpenRouter (and the AI model it routes to)	Generate Aiza's optional written reflection
App events, device identifiers, IP, approximate location (from IP)	PostHog, Firebase Analytics	Understand usage and improve the app
Crash logs, device and OS info, app version	Firebase Crashlytics	Diagnose and fix crashes

We do not collect precise GPS location, contacts, or your photo library.

2. How we use your data

Provide the core experience: conversations with Aiza, daily check-ins, journaling, thinking and goal tools, and progress views.
Personalize Aiza with your first name and chosen topics.
Keep your check-ins and journal available across sign-ins and devices.
Measure usage and fix crashes to improve the app.

We do not use your data for advertising, and we do not sell it.

3. Sharing — third-party processors

We do not sell your personal data. The services below process data on our behalf; each has its own privacy policy:

Supabase (Supabase, Inc.) — accounts + cloud backup of your check-ins and journal — supabase.com/privacy
Google Sign-In / Firebase (Google LLC) — sign-in, analytics, crash reporting — policies.google.com/privacy
ElevenLabs (ElevenLabs, Inc.) — processes your voice and chat with Aiza, plus your first name and chosen topics. Our agent runs in Zero Retention Mode: conversation audio, transcripts, and personal info are not stored by ElevenLabs — processed in memory only and never retained — elevenlabs.io/privacy
OpenRouter (OpenRouter, Inc.) and the AI model it routes to — used only to generate Aiza's reflection on a journal entry — openrouter.ai/privacy
PostHog (PostHog, Inc.) — product analytics — posthog.com/privacy

Because these providers operate globally, your data may be processed on servers outside Pakistan (for example in the United States or the EU). We rely on each provider's safeguards for those transfers.

4. Account & data deletion

You can permanently delete your Aiza account and associated data at any time, directly in the app:

Open Aiza and go to Settings.
Tap Delete account.
Confirm in the dialog. This permanently removes your account and all data — it cannot be undone.

What is deleted immediately: your account, profile (first name, chosen topics), check-ins, journal entries, and all locally stored data on your device. These are purged from our systems immediately.

What is retained briefly: residual encrypted cloud backups roll off within 30 days. Aggregated, anonymized analytics that cannot identify you may be retained.

Voice & conversation data: Aiza runs ElevenLabs in Zero Retention Mode, so conversation audio and transcripts are never stored. Nothing to delete.

If you cannot access the app, email hello@dilkibaat.ca from your registered address to request deletion.

5. Your other rights and choices

Delete some data without deleting your account: Settings → Data → Reset my data clears local check-ins and journal without removing your account.
Turn off analytics: Settings → Analytics.
Export your data: email hello@dilkibaat.ca.

6. Security

Data is encrypted in transit (HTTPS/TLS). Sensitive values stored on your device are encrypted at rest (AES-GCM via the Android Keystore). Your cloud check-ins and journal are protected by per-user Row Level Security so only your account can read them.

7. Children

Aiza is intended for users 13 and older. We do not knowingly collect data from children under 13. If you believe a child under 13 has used the app, contact us and we will delete the data.

8. Crisis note

Aiza does not diagnose or treat, and it is not for emergencies. If you are in crisis, contact your local emergency services or a crisis helpline.

9. Changes to this policy

We will update this page when our practices change; the "Last updated" date reflects the latest revision.

10. Contact

Privacy questions: hello@dilkibaat.ca — DilKiBaat (Taj Magsi), Pakistan.