Privacy Policy

Aylow is the service name and the controller of the account and product information described in this policy. Privacy requests and requests for the controller's current legal contact details can be sent to privacy@aylow.com.

Aylow stores the information needed to provide your account and productivity tools. This can include your profile, settings, tasks, notes, reminders, routines, plans, calendar events, memories, AI conversations and actions, direct messages, workspace content, uploaded files, and push-notification registrations.

For security and session management, Aylow may store device, browser, and platform details, sign-in activity, and an approximate city, region, and country derived from the request IP address. Aylow does not sell personal information.

Information is used to operate Aylow, synchronize signed-in devices, deliver notifications, provide AI-assisted features, support collaboration, protect accounts, and diagnose service problems. AI requests may be processed by the supported AI provider selected for the feature, including Gemini or Groq. User-content translation is disabled unless Aylow configures Google's supported Cloud Translation service; when enabled and requested, the selected text is sent to Google to return the translation.

Notification content can include task, reminder, event, workspace, or message details and may be visible on a device lock screen depending on that device's settings.

Depending on where you live and the feature involved, Aylow processes information to perform its agreement with you, pursue legitimate interests such as security and service improvement, comply with legal obligations, or act on consent that you can withdraw. Optional marketing requires a separate choice and is not a condition of using the service.

Aylow and its providers may process information in countries outside your own. Where required, Aylow uses contractual and organizational safeguards intended to protect information transferred internationally.

Google Calendar access is optional and begins only after you select Connect Google Calendar and approve Google's consent screen. Aylow requests access to identify the connected Google account, read the calendar list, and read and manage calendar events for the calendar you connect.

Aylow uses this access to import Google events into Aylow and to create, update, or delete the corresponding Google event when you change a synchronized Aylow event. OAuth tokens are encrypted at rest. Disconnecting Google Calendar asks Google to revoke the token and removes Aylow's stored connection. Aylow never receives your Google password.

Aylow relies on service providers to run the product, including Supabase for authentication, database, and file storage; Vercel for application hosting; Firebase Cloud Messaging for push delivery; Google services for optional Calendar and supported translation features; Paddle for current web billing and payment support; and supported AI providers for AI requests. If native store subscriptions are introduced, the applicable app store will process those purchases under its own terms.

Payment providers receive the identity, billing, transaction, device, and fraud-prevention information needed to process a purchase. Aylow stores provider customer and subscription identifiers, plan status, renewal dates, and limited billing-event metadata, but does not store complete card details.

Profile images may be publicly accessible when used on a public profile. Private message media and workspace data are limited by Aylow's access controls. Workspace information is shared with the members of that workspace according to their role and the workspace's features.

Most account content, device-session metadata, and notification registrations are kept until you remove them or delete your account. After paid access ends, paid-only records remain retained and available through the account export for at least 180 days. Resubscribing during that period restores the relevant paid entitlement without deleting those retained records. Workspace AI image cleanup is scheduled after 30 days. Billing, security, fraud-prevention, dispute, and legal records may be retained for the period required by Paddle, applicable law, or a legitimate unresolved claim.

You can delete your account from Aylow. Active Paddle web subscriptions are cancelled immediately before deletion. If you are the only owner of a shared workspace that still has other members, you must transfer ownership or delete that workspace first. Account deletion removes your uploaded files, account, and directly associated personal data. Shared text records that other members rely on may remain with your authorship removed where the data model supports that separation.

Aylow uses essential Supabase authentication cookies to keep you signed in and protect account requests. The app also uses browser local storage for interface preferences, onboarding state, notification settings, and a device identifier, and session storage for short-lived checkout or interface state.

Aylow does not currently use advertising cookies or third-party behavioral advertising analytics. Paddle checkout may use provider-required cookies or browser storage for payment security, fraud prevention, and checkout operation under Paddle's own privacy notice.

You can edit or delete content, control notification categories and optional product-email preferences, download a machine-readable account export, manage signed-in sessions, disconnect Google Calendar, and delete your account using Aylow's settings. Marketing emails also include an unsubscribe method. You are responsible for keeping your credentials and devices secure.

Aylow uses access controls and other safeguards designed to protect information, but no online service can guarantee absolute security. Contact Aylow promptly if you believe your account has been compromised.

Depending on applicable law, you may request access, correction, deletion, restriction, objection, or a portable copy of personal information. You may withdraw consent without affecting earlier lawful processing and may complain to your local data-protection authority.

Aylow may need to verify your identity before acting on a request. Authorized agents must also provide evidence of authority. Aylow will respond within the period required by applicable law and explain any lawful limitation or extension.

Aylow is not directed to children under 16 and does not knowingly allow them to create accounts. If you believe a child has provided personal information, contact the privacy address below so the account can be reviewed.