This Privacy Policy explains what information the ToastyAI mobile application and related services (together, the “Service”) collect, how that information is used, and the choices you have. The Service is provided by ToastyAI (“ToastyAI,” “we,” “us,” or “our”). By creating an account or using the Service, you agree to the practices described here. This Policy works alongside our Terms of Use & End User License Agreement.
1. Information We Collect
We collect only the information needed to run a messaging and calling service and to provide the in-app AI assistant.
Account information
- Your name and email address.
- An optional phone number.
- An auto-generated friend code that lets others add you.
- An optional profile picture.
Messages and shared media
The messages you send and the media you share (images, voice messages, and other files, as well as group icons and group backgrounds) are stored on our servers so they can be delivered to the people you are communicating with and synchronized across your own devices.
Push notification tokens
To notify you of new messages and incoming calls, the app registers device push tokens with the Apple Push Notification service (APNs) — one token for message notifications and one (PushKit/VoIP) for incoming calls. These tokens are stored per-device so that notifications and calls reach the right device.
Call signaling and connection data
To connect voice and video calls, the app exchanges signaling and connection (ICE) information between participants. Call media is sent peer-to-peer where possible and may be relayed through a TURN server when a direct connection cannot be established.
Personalization profile
If you complete the onboarding questionnaire, your answers (such as your interests and preferred tone) are stored locally on your device — they are not kept as a profile field on our servers. When you chat with the AI assistant, a short summary of these answers is included with your message so the assistant can respond in context. The choices you make for the Home page are different: they are stored with your account (see Home page below).
Home page
If you set up the Home page, the choices you make there are stored with your account so they follow you across your devices: the city you pick for weather, which gives us your approximate, city-level location (it is a place name — “Use my current location”, when you pick your city, only fills in that name on your phone and sends us no coordinates; the weather card’s “Use my location”, below, works differently), up to five other places you pin for the weather, your timezone and temperature unit, the teams you follow, your watchlist symbols, and the news topics, news sources, and phrases you follow (for example a person, band, country, or event). Our server uses these choices to fetch the weather, scores, prices, and news shown on your Home page; see section 3 for the providers involved. You can change or clear these choices at any time in Customize home (on the Home page) or in Profile → Personalization.
Weather where you are (optional)
If you turn on “Use my location” in the Home page’s weather card, the app reads your phone’s approximate location (iOS gives the app an area, not your precise position) each time you open the app, never in the background. It sends that location, rounded to about a kilometre, and the name of the city your phone found for it with the request for your Home page, so our server can fetch the weather there. The server passes the rounded location to the weather providers named below (Apple WeatherKit for the forecast, Open-Meteo to find the local time zone and as the backup forecast, and the U.S. National Weather Service for alerts) to answer that request. It keeps the rounded location and the place name in memory for at most five minutes, never writes them to disk or to our logs, and does not add them to your account. You can turn this off at any time in your device settings, under ToastyAI’s Location access.
Reminders (optional)
If you choose to show your reminders on the Home page, the app reads the Apple Reminders that are due today and tomorrow, or overdue, on your phone, and marks one done in Reminders when you check it off there. Your reminders stay on your phone: they are never sent to us, never shared with the AI assistant, and the app never creates reminders. You can turn this off in Customize home or remove Reminders access in your device settings.
Spotlight and Siri
So you can find your saved plans from your phone’s search, the app adds each plan’s title and one line from it to Spotlight, your phone’s own on-device search index, and lets Siri open a plan by its title (Siri opens it and reads nothing aloud). Nothing else from your plans is added, and none of it is sent to us. Signing out removes them from Spotlight and Siri.
Calendar (optional)
If you choose to connect your calendar, the app reads your upcoming events on your phone. When you message the AI assistant, a short summary of your upcoming events is included with your message, like the personalization summary; attendees, notes, locations, and your full calendar are never sent. The Home page’s “Your day” card reads your calendar on your phone only. You can disconnect your calendar in the app or remove calendar access in your device settings at any time.
WatchDogs
If you set a WatchDog (an agent offers one or you ask for one, and you tap to set it), we store it with your account so our server can keep checking while your phone is asleep: what it watches (a ticker symbol and the price you chose, a game, or a place name for severe weather warnings — a name, never your coordinates), its label, the conversation and agent it reports to, whether it is quiet, and when it was set, last alerted, and ends. Our server checks it with the same providers as the Home page (see section 3) and, when the condition is met, the agent posts an alert in that conversation. We keep a history of what each WatchDog did (set, alerted, renewed, ended) for 90 days so the WatchDogs page can show past alerts, a list of the weather warnings already sent to you for 30 days so you are not alerted twice, and a WatchDog itself for 30 days after it ends. A severe-weather WatchDog renews itself and ends if you have not opened the app for 90 days. If you turn down a WatchDog an agent offered, or call one off, we note what it watched so agents do not offer the same one again; these notes are kept until you delete your account.
Device and app information
So the assistant can answer in your frame (for example, what “tonight” means where you are, or which language to use), the app stores your timezone, language and region setting, operating system and version, and app version in your account settings. For each device you use, it also records the app version and build together with a random ID that the app creates for that installation (not an advertising identifier), so we know which versions of the app are in use. The same device ID lets calls reach the right device and identifies that device’s encryption keys.
Crash reports and diagnostics
When the app crashes or runs into an error, it can send a report to a crash-reporting service that we run ourselves (it is not a third-party service). A report contains technical details such as your device model, operating system, app version, and the error’s stack trace. The app does not attach your name, email address, account ID, IP address, device identifiers, or message content, and it removes conversation and user IDs from reports. The app also forwards Apple’s MetricKit performance reports (for example, when iOS closes the app for using too much memory, or the app stops responding) to the same service. You can turn crash reports off at any time in Settings.
AI assistant interactions
When you send a message to the in-app AI assistant (“Kira”), that message is processed by our AI backend to generate a reply. If you send an image or a document to the assistant, it may be downloaded to the assistant’s processing workspace so it can be read. If you send it a voice message, our own speech-to-text service (not a third party) turns it into text for the assistant. These working copies are deleted within minutes.
Email connection (optional)
You can connect an email account so the assistant can help with your mail (Profile → Connections → Email, or during setup). You give us the email address and an app password that you create with your email provider. The app sends them over an encrypted connection to our server, which checks that they work, encrypts the password (AES-256-GCM, with a key held only by our backend), and stores it; the app itself does not keep the password. The assistant then uses the connection only in your one-on-one chats with it, never in group chats, in two ways:
- when you ask about your email, it searches your mailbox and reads the matching messages (sender, subject, date, and the start of each message) to answer you;
- with your messages to it, it receives a short note of how many unread emails you have and the senders and subjects of a few recent ones, so it can tell you what’s new. This note is cached on our server so replies stay fast, refreshed about every five minutes while you chat, and deleted within an hour of your last chat.
Your mailbox is accessed read-only: we never send, delete, move, or mark email as read. The connection itself does not store search results or email contents; they are passed to the assistant to answer you and become part of your conversation with it, like anything else you discuss with the assistant. You can disconnect at any time in Profile → Connections → Email, which deletes the stored password, and it is also deleted with your account.
2. How We Use Information
We use the information described above to:
- create and maintain your account and your friend connections;
- deliver your messages and shared media, and sync them across your devices;
- connect and relay your voice and video calls;
- send push notifications for new messages and incoming calls;
- generate responses from the AI assistant, informed by the personalization and calendar summaries you choose to share with it and by your timezone and language;
- show your Home page: weather, scores, prices, and news for the choices you made;
- run the WatchDogs you set and send their alerts;
- find and fix crashes and performance problems;
- maintain the security and integrity of the Service and respond to support requests;
- comply with applicable law.
3. How Information Is Shared
We do not sell your personal information, and we do not share it with third-party advertisers. We do not use your data to track you across other companies’ apps or websites, and we do not use it for advertising or marketing. The app contains no third-party advertising SDK and no third-party analytics SDK; crash reports go to a service we run ourselves. Your information is shared only in these limited ways:
- With people you communicate with. Messages, media, and call content are shared with the participants of your conversations and calls, which is the point of the Service.
- With infrastructure and processors we rely on. We use Apple for authentication (Sign in with Apple) and for push notifications (APNs). Call media that cannot connect directly may pass through a TURN relay server. These providers process the data solely to help us deliver the Service.
- With data providers for the Home page and WatchDogs. To fill in your Home page and check your WatchDogs, our server (not your phone) requests weather from Apple WeatherKit, place and time-zone lookups and backup weather from Open-Meteo, and weather alerts from the U.S. National Weather Service; scores from ESPN; prices from Yahoo Finance and CoinGecko, and company logos from Financial Modeling Prep; and news from publishers’ public news feeds and from Google News, which receives your city name for local news and the phrases you follow. These requests contain only what the lookup needs — a place or a rough location, a team, a ticker symbol, or a search phrase — and never your name, email address, account, or device. Images on the Home page are served from our own servers, so your device does not contact these providers.
- As legally required. We may disclose information if we are required to do so by law, or in response to a valid legal request, or to protect the rights, safety, or security of our users, the public, or the Service.
4. Data Storage & Security
The Service runs on a self-hosted backend operated by ToastyAI (its public edge is api.toastyai.net). Your data is not handed to a third-party data broker; it lives on infrastructure we operate.
- Data is encrypted in transit using TLS/HTTPS.
- Access to stored data is restricted by database access controls (row-level security), so accounts can only reach the data they are permitted to see.
- Messages in your personal conversations are end-to-end encrypted: they are encrypted on your device and can only be read on the devices of the people in the conversation — not by ToastyAI’s servers. When you chat with an AI agent, or add one to a conversation, the agent is a participant, so the service that runs it can read what is sent to it in order to reply.
No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
5. Push Notifications
The app uses Apple’s Push Notification service (APNs) directly to deliver message alerts and to ring your device for incoming calls; it does not use Firebase or any Google push service. To do this, we store the push tokens your device provides, associated with your account and device. You can turn off notifications at any time in your device settings, though doing so may prevent you from being alerted to new messages or incoming calls.
6. The AI Assistant
ToastyAI includes an in-app AI assistant (“Kira”) that can take part in a conversation as a participant. When you send it a message, the content of that message is processed by our AI backend to produce a reply. If you have completed the personalization questionnaire, a short summary of your on-device answers is included with your message so the assistant can tailor its response; if you have connected your calendar, a short summary of your upcoming events is included in the same way. These answers stay on your device except for the summary sent along with a given message. The assistant can also see your timezone and language setting (see Device and app information). Images you send to the assistant may be downloaded to its processing workspace to be analyzed. If you prefer not to share personal context with the assistant, you can leave the personalization answers blank or clear them from your Profile.
How long the assistant keeps your chats. The assistant keeps its own working copy of each conversation with it on our servers, including anything it looked up for you (such as email search results). That copy is deleted 30 days after the last message in the conversation. So that it can remember context over time, the assistant also keeps short summaries of your conversations with it and brief notes about you (for example, a preference you told it); these are kept until you delete your account. When you delete your account, your one-on-one conversations with the assistant are deleted from our servers within a day, along with its working copies, summaries, and notes; a few temporary working files expire on their own within 30 days. Group conversations stay with the group.
7. Your Choices & Rights
- Edit your personalization. You can review, update, or clear your personalization answers at any time from your Profile.
- Change your Home page. You can change or clear the city, teams, symbols, topics, sources, and phrases on your Home page at any time in Customize home or Profile → Personalization.
- Calendar. Connecting your calendar is optional; you can disconnect it in the app or remove calendar access in your device settings.
- Location and reminders. Weather where you are and reminders on the Home page are both optional and off until you turn them on. You can turn either off in your device settings, and reminders also in Customize home.
- WatchDogs. You can call off a WatchDog at any time in WatchDogs, and stop agents offering them with WatchDog suggestions in Settings.
- Email. You can disconnect a connected email account at any time in Profile → Connections → Email.
- Crash reports. You can turn crash reports off in Settings.
- Update your account. You can change your account details, including your profile picture, from your Profile.
- Delete your account. The app provides self-service account deletion at Profile → Delete Account. Deleting your account removes from our servers your profile, your friend connections, blocks, call records, and conversation memberships, your connected email accounts, your Home page choices, your WatchDogs and their history, your device and app-version records, your profile picture, and your authentication record. Messages you already sent stay in the conversations you sent them to, so the other people there keep their history, but they are no longer linked to your account; messages in personal conversations remain end-to-end encrypted. Your one-on-one conversations with the assistant are deleted entirely (see section 6).
- Manage notifications. You can control push notifications through your device settings.
8. Children’s Privacy
The Service is not directed to children under 13, and you must be at least 13 years old to use it. If you are under the age of majority where you live, you may use the Service only with the involvement and consent of a parent or legal guardian. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can remove it.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated through the Service where practicable. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.
10. Governing Law
This Policy and any dispute relating to it are governed by the laws of the State of Texas, USA, without regard to its conflict-of-laws rules, except where prohibited by applicable law.
11. Contact
Questions about this Privacy Policy or your data? Contact us at support@toastyai.net.