Privacy Policy
Last updated: 2026-10-03
The short version
Your conversations are stored on your device, not on our servers. We pass your messages to Anthropic's Claude API to get an answer — on the free plan, possibly to the same Claude model hosted by Amazon Web Services. On a paid plan, each answer mode has its own daily and weekly Claude allowance; once the mode you are using has spent its own allowance, that message goes instead to another model so the conversation can keep going — one hosted by Amazon Web Services, or one reached through OpenRouter. Either way, we do not store them afterwards. What we do keep is a count: which model was used, how many tokens, how long it took, and which country the request came from — never what you or the model actually wrote. The single exception is a reply you choose to report: see "Reports and support" below.
AI Chat is an independent third-party app and is not affiliated with Anthropic PBC or Microsoft Corporation.
Your chats
Conversations, including the messages you send and the replies you receive, are stored only on your PC, in a local database inside the app's own data folder. Deleting a conversation deletes it there; uninstalling the app removes the lot. We have no copy to hand over, search or restore.
Messages in transit
To answer a message, the app sends the relevant part of the conversation to our server over HTTPS, and our server sends it on to the Claude API operated by Anthropic PBC, which processes it under its own terms and privacy policy. Our server holds the message only for as long as it takes to stream the answer back to you. It is not written to any database, log or file.
On the free plan, Claude's answers may instead come from the same Claude model hosted by Amazon Web Services (Amazon Bedrock), which processes the message under its own terms and privacy policy and may be located outside your country. Paid-plan Claude messages always go to Anthropic's Claude API.
On a paid plan, each answer mode has its own daily and weekly allowance of Claude messages, and spending one does not spend the others: each mode is answered by Claude until its own allowance for the day or the week runs out. Once the mode you are using has run out, we keep answering on what we call "extended capacity".
In the Deep and Balanced modes, a limited number of those messages each day and week are answered by a model hosted by Amazon Web Services (Amazon Bedrock), which processes the message under its own terms and privacy policy and may be located outside your country.
After that — and in the Quick mode straight away — we send the message on to OpenRouter, Inc., which routes it to one of its third-party model providers to generate the reply. Those providers process the message under their own terms and privacy policies, and may be located outside your country. We ask OpenRouter to route these messages only to providers that declare zero data retention and that do not train on what is sent to them. That restriction travels with every request we make; what a provider then does is governed by its own policy, not ours.
When Claude itself is unavailable, a message may be answered on extended capacity in the same way. As with the Claude API, our server holds the message only for as long as the stream takes and does not write it to any database, log or file.
What we do record
For each request we write one anonymous analytics row containing:
- the model tier requested and the one actually used;
- input and output token counts (numbers, not text);
- response latency;
- the country the request came from, as reported by our CDN;
- a one-way hash of your app's random device identifier.
That row never contains message content, prompts, replies, file contents, names, email addresses or IP addresses. We use it to watch cost and reliability, and to decide where the limits should sit.
The app also sends anonymous usage events: which screens and buttons were used and what happened — for example that the plans screen was shown and closed, that a message was sent in a given answer mode and how long it was, that a purchase was cancelled, or that search returned results. Each event carries the app version, your plan, the country as reported by our CDN, a random identifier for that app session and the same one-way hash of your device identifier. Events never contain what you write or receive — no messages, chat titles, search terms or file contents — and the server refuses any event that could carry text. We use them only to improve the app, keep them for up to 180 days, and you can turn them off at any time in Settings → Privacy → "Share usage data".
Identifiers and accounts
There is no sign-up and no password. The app generates a random device identifier on first run and uses it to count your daily free messages. If you subscribe, the Microsoft Store gives the app a token that our server checks against Microsoft's entitlement service; we store a one-way hash of that token together with the expiry date, so we know your subscription is live without keeping the credential itself. We never see your Microsoft account details or your payment information.
Reports and support
Every reply has a Report button, and Settings has a Report an issue form for anything else. Reporting is entirely voluntary — nothing is sent unless you press Submit. When you do, we receive the reported reply (if you are reporting one), the reason you picked, the details you typed, your app's device identifier, the app version and, only if you enter it, your email address. We use this solely to review content-safety and other issues you raise, and to answer you, and for nothing else.
We may answer a report in the app: the next time it starts, it shows our reply to reports sent from that device. If you gave an email address, we may also answer by email from support@hayah.dev. We never use that address for marketing, and we never share it.
Reports from all HAYAH apps go to one support inbox, hosted by Cloudflare, so that we can answer them in one place.
This is the one exception to "we do not store your messages": a report cannot be reviewed without the text it is about, so that text is stored. The rest of the conversation is not sent.
Cloud backup (discontinued)
Earlier versions offered an optional encrypted cloud backup for Pro. It was removed in version 1.4.0, and no backups are stored.
Who else is involved
- Anthropic PBC — processes message content to generate replies.
- OpenRouter, Inc. — routes message content to a third-party model provider to generate a reply when you are on extended capacity.
- Amazon Web Services (Amazon Bedrock) — hosts Claude, which processes message content to generate replies on the free plan, and a model that does the same for some paid-plan messages on extended capacity.
- Cloudflare — hosts our server and the usage counters.
- Microsoft — sells and renews the subscription and tells us whether it is active.
We do not sell your data, and there are no advertising or tracking SDKs in the app.
Retention
Usage counters and the hashed entitlement record are kept while your installation is in use and are periodically cleared. Analytics rows expire automatically, and usage events are deleted after 180 days. Reports, any email you included and our replies are kept for as long as we need them to resolve the issue and to spot repeat problems; write to us and we will delete yours.
Children
The app is not directed at children under 13, and we do not knowingly collect their data.
Your choices
Because your chats never reach us and the data we hold is anonymous unless you put your email in a report, there is little for us to look up on request — but if you want a report you sent deleted, or have any privacy question, write to support@hayah.dev and we will act on it.
Changes
If this policy changes, the date at the top of the page changes with it. Material changes will also be noted in the app's release notes.