AiThao Privacy Policy

An account is created on first launch and needs no phone number, no email and no name. What it has is an opaque identifier, a randomly allocated AiThao Number and a username, which you can change. You may add a display name, a photo, a banner and a short status if you want to; all of them are optional and all can be removed.

None of these is required to use AiThao. Each exists so you can return to your account on a new phone:

• Apple or Google. We receive only a stable account identifier and, if the provider sends it, an email address. We ask for nothing else — no contacts, no calendar, no files — and we neither post nor read anything in your Apple or Google account. The identifier is stored so a later sign-in matches the same AiThao account.
• Email. You can attach an email address; we send a one-time code to it through our email delivery provider. We store a hashed form of the address and a short masked hint (so you can recognise it), not the address itself. It is never shown to your contacts and never used for marketing.
• Recovery code. A one-time code you save yourself. We store only a hash of it. Using it signs out every other device on the account and removes their keys, so a phone you no longer have cannot keep using the account.

Messages are end-to-end encrypted. What you write in a chat — text, reactions, edits, photos, files, voice messages, locations and contact cards — is encrypted on your phone for the phones of the person you are writing to, and for your own other devices, using the Signal Protocol. Only those phones can decrypt it. Our server stores and delivers encrypted copies it cannot read, and deletes each copy once the phone it was made for has it, or after 30 days.

What our server does see: who wrote to whom and when, how large a message is, whether it was delivered and read, and which message a reply points to.

Your conversation history is kept on your phone, protected by iOS Data Protection and excluded from iCloud and computer backups. You can compare a safety number with the person you are writing to, in person or by scanning a code, to check that nobody is in between.

Conversations that started before end-to-end encryption keep their earlier messages on our server as before, until you delete them.

If the person you are writing to has not finished setting up their phone, there are no keys to encrypt for, and the app sends nothing at all — it tells you to wait rather than falling back to sending in the clear. The keys come from our server, so this is the one moment where we could have made a chat unencrypted by answering that we had none; the app refuses instead of letting us.

If you turn on disappearing messages in a chat, each new message in it is deleted from our server when its timer runs out, for both of you. Deleting a message for everyone removes its content on our server. Deleting a conversation or your account is described under Your rights and choices.

Translation is the point of this app, and it is not done on your phone. In an end-to-end encrypted chat, a message is delivered encrypted. When it is in a language you do not read and Cloud translation is on (Settings → Translation; on unless you turn it off), your phone sends the decrypted text or voice recording to our translation service after decrypting it. The service passes it to a translation provider and returns the translation; we do not store what it translated. The app says this once, the first time it happens, and marks each message translated this way. Translated calls are not end-to-end encrypted: live speech has to reach the translation service, and translating on the phone instead would add more delay than a conversation can bear. Translation uses these providers:

• AI speech and translation provider — real-time call translation, voice-message transcription, and speech synthesis.
• Cloud AI translation provider — text translation, and a fallback for the same real-time and voice work when the first provider is unavailable.

Only the content being translated is sent — the message text or the call/voice audio, plus the source and target languages. Your name, your contacts, your AiThao Number and your other conversations are not. A translated call or voice message is therefore not private between the two of you alone: a provider processes the content in order to translate it. The app states this on the screen where you turn translation on. These providers process the content on their own infrastructure under their own terms; we do not control how long they keep it or whether they use it to improve their services, and we make no claim on their behalf.

On aithao.com you can try the translation yourself: what you type or say there is sent to a translation provider and comes back translated. We keep neither the recording nor the text, and the demo needs no account.

Calls are carried by media server software that runs on our own server — the company behind it receives nothing. Where a direct path between two phones cannot be established, audio and video are relayed through that server; a relay may also carry the media, and the operator of that relay is a third party.

Calls between two phones that support it are end-to-end encrypted: each call has its own key, sent to the other person's phone through your encrypted chat, and the media server relays audio and video it cannot decrypt. When translation is turned on during a call, the call's key is given to our translation worker so it can hear the call; from that moment the call is not end-to-end encrypted, and the lock on the call screen goes. Video is never sent to the translation provider. We store a call log — who called whom, when, and for how long — so you can see your own call history. We do not record calls.

During a translated call, either person can switch on a summary of it. The other person's call screen then shows a line saying so. When the call ends, the written transcript of the call — both people's recognised and translated speech, not the audio — is sent from the phone of the person who asked, through our server, to the cloud AI translation provider, which writes a short summary and returns it. We store neither the transcript nor the summary. You can refuse this for calls with you: Settings → Privacy and security → Allow summaries of calls with me. With it off, nobody can make a summary of a call with you.

How long a file is kept. A file sent in a message is kept for 180 days if it is a photo, and 90 days if it is a video, a voice message or any other file, counted from when it was sent. After that the file is deleted from our storage. The message itself stays in the conversation and says the file is no longer kept. Anything already downloaded to a phone stays on that phone; we cannot reach it and do not try.

In an end-to-end encrypted chat, each photo, file or voice message is encrypted on your phone with its own key before it is uploaded. Object storage (cloud storage and network provider) holds only the encrypted file; the key travels inside the encrypted message. A translated voice message is produced when the listener's phone asks for it and is not stored on our server. Attachments sent in conversations from before end-to-end encryption are stored as they were.

Chat backup is optional (Settings → Chat backup). Your phone encrypts a copy of your conversation history with a random key before uploading it. That key is itself locked with a recovery key that is kept in your iCloud Keychain — which Apple encrypts end to end between your own devices — and never sent to us. Our server stores the encrypted backup and the locked key, and can open neither. A new iPhone signed in to the same Apple ID gets your chats back by itself. You can also write the recovery key down. If you lose your phone, your Apple ID and the recovery key, the history cannot be restored, by you or by us. Turning backup off, or deleting your account, deletes the backup from our server.

Moving chats to a new phone: the new phone shows a code, the old phone scans it and sends the history encrypted with a key that travels only in that code. Our server relays the encrypted data and deletes it within an hour.

A group chat works like a one-to-one chat with more people in it: everything this page says about messages, translation, calls and files applies to every member, and each member reads the group in their own language. In addition, our server stores the group's name and picture, who is in it, who created it and who can manage it. Leaving a group removes you from its member list; messages you already sent stay in the group, as they do in a one-to-one chat.

Contacts are people you added inside AiThao — by their AiThao Number, their username or their QR code. Anyone who knows your AiThao Number or username can find your profile; what they see of it is your setting. The version in the App Store can still offer to find people by phone number. If you open that screen and allow access to your contacts, numbers from your address book are sent to our server over an encrypted connection, where each becomes a keyed hash; the plain numbers are never stored and the names are never sent. It finds nobody, and it is being removed in the next version, along with the app's request for access, because we cannot verify that a number belongs to the person who gave it to us and would rather offer nothing than offer that. This page will be updated the day that version ships.

"Online" and "last seen" are a single expiring timestamp, never a log, and who may see them is your setting. Hiding looks exactly like being offline.

Push notifications are delivered by Apple (APNs). For an end-to-end encrypted message, our server sends "New message" together with a short preview that the sender's phone encrypted for your phone; your phone opens it and shows the words, according to your preview setting and iOS's. Neither Apple nor our server can read the preview. The key your phone uses for this is replaced every 30 days. To deliver notifications and calls we store a push token and a device identifier for each of your devices.

Ordinary chats and calls are free. Translated calls and translated voice messages use minutes. New accounts receive a one-time allowance of free minutes to get started. When you buy more minutes, Apple processes the payment; we receive a signed receipt from Apple and store a record of the purchase, your minute balance, and how minutes are used (call or voice message, languages, provider, cost) so we can meter the service and support the paid feature.

We keep operational data needed to run and secure the service: request logs (URL, status, error, timestamp), call-quality and latency metrics, and an opaque anti-abuse marker tied to a device rather than to you. The app itself contains no third-party analytics or tracking SDK. We do not build profiles of you and make no automated decisions about you.

We use the following providers to run AiThao. Each receives only what its role needs, and processes it under its own terms.

We will tell you the names of the providers we use on request: write to privacy@aithao.com.

• No advertising, and no data sold or shared for advertising.
• No third-party analytics or tracking SDKs in the app.
• No profiling, and no automated decisions about you.
• No access to your photo library, microphone or location except when you use the feature that needs it, and only for that.

• Access and export. Write to privacy@aithao.com and within 30 days we send you a file with the data our server holds about your account: your account, contacts and messages as you see them. The export contains what our server holds. For end-to-end encrypted chats that is who wrote to whom and when, not the words — those are only on your phones and in your chat backup.
• Correction. You can edit your profile in the app at any time.
• Deletion. Settings → Account → Delete account removes the account, its identities, devices, contacts, invites, blocks, call history and presence, and frees the username. Your profile picture, cover image and any upload that never reached a conversation are deleted from our storage at the same time. So are your chat backup and any chats in transit between your phones. Messages and files you already sent to another person stay in their conversation, because they are theirs too: there is one copy on the server and it is as much the recipient's record as yours. What goes is your name on them — the account is gone, the files stop recording who uploaded them, and you appear to the other person only as “Deleted account”. If you want a particular message and its file gone from both sides, delete it for everyone before you delete your account; that is a separate action and closing the account never does it for you. Deletion is irreversible.
• Automatic deletion. If you do not open AiThao for the period set in Settings → Privacy → Delete account if away for — six months unless you choose 1, 3 or 12 months — your account is deleted in the same way as above. A week before, we send a notification to your phone.
• Objection and restriction. You can turn off presence sharing, message previews and translation at any time in Settings.

If you are in the European Economic Area or the United Kingdom, you have the rights to access, correct, delete, port, and object to the processing of your personal data, and to complain to your data protection authority. Our legal bases are performance of our contract with you (running the messenger and the paid feature), your consent (optional features such as translation), and our legitimate interest in keeping the service secure and preventing abuse. If you are a California resident, you have the rights to know, delete, and correct your personal information and not to be discriminated against for exercising them; we do not sell or share personal information. To exercise any right, write to privacy@aithao.com.

Our servers and those of our providers may be in different countries, and where they are can change. Your data may therefore be processed outside your own country. To find out where your data is processed, write to privacy@aithao.com.

AiThao is not directed to children under 13, or under the age of digital consent in your country where that is higher. We do not knowingly collect data from them.

When this policy changes in a way that matters, we update the date above and, for a significant change, tell you in the app. Continuing to use AiThao after a change means the updated policy applies.

Questions, or a request about your data: privacy@aithao.com.