Your people.
Your privacy.

This policy explains how Cogumi, the operator of Bya Chat (“Bya,” “we,” “us”), collects, uses and shares information when you visit our website or use the Bya application.

1. Information we collect

Account and profile: your account identifier, email address, sign-in provider information, username, display name, optional profile photo and bio, and authentication/session records. Supabase handles authentication. Passwords, when used, are handled through Supabase authentication rather than stored as readable passwords in Bya’s application database.

Conversations and workspace: messages, pictures, soundmoji choices, other message attachments, connection/invitation records, conversation participants, notes, files and canvas content that you provide. New private notes are visible only to their author through the app; shared workspace content is available to authorized conversation members.

Private assistance: your requests, returned assistant responses, drafts, and context you choose to connect or share. Where a supported AI host provides derived context, Bya may store those derived facts and their source descriptions. This does not give Bya automatic permission to read all your human conversations.

2. Google account information and permissions

Sign in with Google: we use basic identity information, including your Google account email, profile information and identifier, to authenticate your Bya account.

Google Contacts: if you choose to import contacts, Bya requests contacts.readonly. We retrieve and store contact names, email addresses and available phone numbers to help you find and invite people. Imported contact details are not made public in discovery or copied into product analytics. Basic account matching uses verified email information without revealing another person’s email or that an address book was imported.

Send invitations from Gmail: if you connect Gmail sending, Bya requests gmail.send to send invitations you explicitly review and authorize. This scope does not let Bya read your mailbox. We process the selected recipient addresses, invitation text and artwork, and keep delivery-attempt metadata such as the Gmail message identifier and outcome. A prepared invitation is not treated as sent.

These Google features are optional to ordinary Bya messaging. The current combined Google connection can request both Contacts read access and Gmail sending. A separate contact-import flow requests Contacts read access. You can decline access and use other available ways to find people or share an invitation link.

Google access and refresh tokens are encrypted in Bya’s storage. The Gmail connection retains a refresh token while connected so that authorized sending can work without repeated sign-in. Contact-import access tokens are temporary and cleared after completion, cancellation or expiry.

Bya’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, sell it, or use it to train generalized AI models. Google contact and Gmail data are used for the user-facing connection and invitation features described here.

3. How we use information

We use information to operate accounts and authorized conversations; import contacts when requested; prepare and send approved invitations; provide workspace and private-assistant features; maintain security and reliability; respond to support/privacy requests; and understand product use through limited metadata. We do not automatically send marketing email to imported contacts.

4. Who receives information

People you connect with can see the profile information and content you share with them. An email recipient receives an invitation only through the sending action you authorize. Sharing a private note creates a separate shared copy; it does not expose all private notes.

We use service providers to run Bya: Cloudflare for website/application hosting, databases, message infrastructure and file storage; Supabase for account authentication; Google for Google sign-in, contact import and Gmail sending when used; and Purelymail for Bya account emails. These providers process relevant information to deliver their services.

When you request AI help inside a supported host such as ChatGPT or Claude, the host processes your request and the context you choose to share under its own terms and privacy practices. Bya does not automatically forward your imported address book or Gmail mailbox to an AI host. Information you deliberately include in an assistant request can be processed by that host.

Information may also be disclosed when reasonably necessary to comply with legal obligations, respond to lawful requests, protect users or the service, or as part of a business transfer subject to applicable safeguards. Access by authorized personnel is limited to operating, securing and supporting the service and handling legitimate requests.

5. Analytics, cookies and technical records

The Bya application records first-party product metadata, including event identifiers, pseudonymous account/conversation identifiers, timestamps, platform/host, operation outcomes, message type, emoji usage and invitation-attribution information. We use these records to calculate activity, retention, reliability and connection metrics. The analytics dashboard is restricted to administrators.

Product analytics are designed to exclude message bodies, drafts, prompts, file contents, contact details and OAuth credentials. Pseudonymous identifiers can still be linked to an account; these records are not described as anonymous.

Authentication uses first-party session cookies and browser storage. Invitation links can use a first-party browser identifier/cookie to associate an invitation visit with signup. Hosting and security providers may also process IP addresses, request headers and technical access/security records. The marketing website offers optional first-party usage analytics. Collection starts only after you choose Allow analytics; declining leaves it off. We record a random browser-tab session identifier, page category (home or privacy), Open Bya link category and server timestamp, not full URLs, referrers, contact details or chat content. If you follow an Open Bya link after allowing analytics, a random session token can associate that website visit with a newly created Bya account for seven days. Browser sessions are not verified unique people. Browser Do Not Track and Global Privacy Control signals disable website collection. You can change your choice using Analytics preference; declining also requests deletion of the current tab’s website analytics. Previously attributed account records and other sessions can be addressed through support. We use no third-party advertising analytics.

6. How long information is kept

Seven-day content window: messages, message attachments and private assistant turns are subject to Bya’s rolling seven-day cleanup, run periodically. Content may remain between expiry and the next successful cleanup. Copies already downloaded, emailed or held by another participant or provider are outside that app cleanup.

Durable records: profiles, imported contacts, conversation workspace notes/files/canvases, connection records and some invitation/operational records are not governed by the message window. They remain until removed through available controls or a supported deletion process. Workspace deletion and account-wide deletion controls are not yet complete across all data stores in this beta.

Analytics: product metadata and aggregates are separate from message content and are not removed by the seven-day cleanup. Scheduled analytics cleanup retains raw metadata for up to 180 days and daily/cohort facts for up to 13 months, independently of message cleanup. Records can remain until the next successful scheduled cleanup. Website analytics follow the same periods. A minimal account-identifier suppression record may remain to prevent erased analytics from being recreated by delayed event retries. These controls cover analytics, not account-wide deletion of all product records.

Google credentials remain while the connection is active, subject to provider expiry or revocation. Relevant security, legal and support records may need to be kept for their applicable operational or legal purpose.

7. Your choices and requests

You can edit available profile fields, remove imported contacts through the app, disconnect Google, and inspect/correct/delete saved Bya context facts through available controls. Disconnecting Google deletes Bya’s stored sending credentials and attempts to revoke the Google token. Removing imported contacts is a separate action; disconnecting Gmail does not promise removal of all previously imported data.

You can also revoke Bya’s access from your Google account’s third-party connections. Revocation prevents future authorized access but does not itself delete previously imported contacts, already sent emails, or all records stored in Bya.

For access, correction, account deletion or removal of data not covered by an in-app control, email support@byachat.com. We may ask for information needed to verify account ownership. We will explain the supported process and any retention or deletion limitations; we do not represent this beta as having instant automated account-wide deletion.

Deleting a fact from Bya does not delete it from ChatGPT or Claude memory. Use that host’s own controls to remove information it holds. Recipients may retain content you have sent them.

8. Security

Bya uses HTTPS, participant access checks, private media access controls and encrypted Google-token storage. The current MVP does not use end-to-end encryption: Bya’s server can read stored content. “Private to you” describes the audience and application access controls, not a claim that the service or its infrastructure cannot process the content. No online service can guarantee absolute security.

9. International processing and children

Bya and its providers may process information outside your country. We do not promise storage limited to a particular country. Bya is not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and address the request.

10. Changes and contact

We will update this policy when data practices change and show the effective date here. Material changes will be communicated through appropriate available channels. Questions and requests: support@byachat.com.

Open Bya ↗

Your people.Your privacy.