Privacy Policy

1. Who we are

This Privacy Policy covers two products run by the same company: the Skyzai app (wallet, social, business and events — Android, iOS, and web) and apu.bot, a separate AI note‑taking web app: you talk or type, and the AI organises what you said into notes, tasks and categories, with optional reminders. They share one account system, so signing in to one signs you in to the same underlying Skyzai account.

Skyzai and apu.bot are operated by Menexus GmbH, Schwerzenbach, Switzerland. If you have questions about this policy, see Contact us below.

2. What we collect, and why

This section lists what we actually collect, drawn directly from how the apps are built, not a generic template.

Account & identity

Notes, tasks and reminders (apu.bot)

When you talk or type to apu.bot, the AI organises what you said into structured notes and tasks: a title, status, category, due date, priority, people mentioned, place, a link, and a short one-line note the AI writes itself. If you set a reminder, its lead time is stored too. We do not store your original message, your voice recording, or a transcript of either — only that structured result. See §3 for exactly how your message is processed to get there.

Wallet & crypto

Your public wallet address and on-chain transaction history (these are inherently public on the Hedera and EVM networks your wallet uses — see §4). Your private keys never leave your device and are never sent to us; we build transactions for you to sign locally, we never sign on your behalf.

Business & identity verification

If you create a business account or go through identity verification (KYC/KYB): the documents you submit (stored privately, see §6), and a selfie used for a liveness/face-match check through our identity-verification provider (see §4).

Device & diagnostics

Crash reports (via Firebase Crashlytics) and a push-notification token (via Firebase Cloud Messaging), so we can fix bugs and notify you about your own account activity. Our server logs record event types, counts, timing and error codes for reliability — never your message text or AI output content. See §4 for what we collect through Firebase Analytics specifically.

3. How apu.bot's AI works with your data

When you send a message (typed or spoken) to apu.bot:

1. If you spoke, your audio is sent once to our AI provider, Groq, to be transcribed to text. The audio is processed in memory and is never written to any database or file storage by us.
2. Your message text, together with your existing open notes/tasks (so the AI has context) and basic profile info (your name and any links on your profile), is sent to Groq to generate a reply and decide what to organise it into.
3. Only the structured result — the note/task fields listed in §2 — is saved by us. The message text, the audio, and the AI's raw output are discarded on our side immediately after the request completes.

Optional account-data answers. In apu.bot settings, you can turn on "Let apu.bot use my Skyzai data" per category (profile, Nostr, connections, businesses, events, payments — on by default). When on, and only when your message needs it, apu.bot may look up that category of your own data to answer you (for example, "what's my Nostr bio?"). What it looks up is included, for that one request only, in what's sent to Groq. You can turn any category off at any time in apu.bot settings.

About Groq. Groq, Inc. processes what we send it (your message text, voice audio for transcription, and any account-data results for that turn) to produce apu.bot's reply, under its own privacy policy and terms — groq.com/privacy-policy. We do not control, and this policy does not claim anything about, how long Groq itself retains request content or whether it uses requests to improve its models; if that matters to you, please review Groq's own policy.

4. Who else sees your data

We use the following service providers ("processors") to run Skyzai and apu.bot. We do not sell your data to anyone.

Our identity-verification provider. Face verification runs through the Regula Face SDK, initialised with a license file bundled in the app rather than a server we operate ourselves. We describe it here as our identity-verification provider rather than making a specific claim about where processing happens, since that is set by the provider's own SDK configuration rather than something we can independently confirm.

Analytics. We use Firebase Analytics (Google Analytics for Firebase). What is actually true today, checked against our own app configuration: analytics collection is explicitly turned off on Android (firebase_analytics_collection_enabled is set to false). It is not explicitly turned off on iOS or on web — a measurement ID is configured for the web app, and neither platform has code that disables collection, so Firebase's own default automatic collection (such as app opens and sessions) can apply there. We do not send any custom analytics events of our own beyond that automatic collection.

5. Nostr: what you post is public

Your Skyzai profile and posts are also published to the Nostr network — a public, decentralized protocol operated by many independent relays we don't control (by default this includes relay.damus.io, nostr.wine and relay.primal.net, plus any relay you add yourself). Anything you publish there is public and can be copied by anyone the moment it's broadcast — deleting it in Skyzai removes it from our own systems but cannot force every relay, or anyone who already saw it, to delete their copy. Don't post anything to Nostr you wouldn't want to be permanently public.

6. How long we keep things

7. How we protect your data

• Your wallet and Nostr private keys never leave your device in plaintext; we build unsigned transactions for you to sign locally, and never sign on your behalf.
• Sensitive local data is stored using your device's secure storage, not plain preferences.
• Server-side, access to your data is scoped to your own account by default.
• You can delete your account at any time from inside either app — see the next section.

Deleting your account

In the Skyzai app: Settings → About → Delete Account. In apu.bot: Settings menu → Delete account. Either path permanently deletes your account across both apps — your profile, notes, tasks, reminders, wallet links, connections, businesses, events, bookings, and uploaded files. This cannot be undone. Content you already published to Nostr is not affected (see §5), and records we're legally required to keep (like KYB documents, per §6) are retained only for their required period.

8. Your rights and choices

Depending on where you live, you may have rights over your personal data, including to:

• access the data we hold about you;
• correct it if it's inaccurate;
• delete it;
• export it in a portable format;
• object to certain processing; and
• withdraw any consent you've given, at any time.

If you're in Switzerland, these rights come from the Swiss Federal Act on Data Protection (FADP). If you're in the EU/EEA, the General Data Protection Regulation (GDPR) gives you equivalent rights. Wherever you are, you can exercise the deletion right yourself right now with the in-app "Delete account" option described in §7 — nothing needs a request to us for that. For access, correction, export, objection, withdrawing consent, or anything delete-account doesn't cover, contact us (§12).

9. Children's privacy

Skyzai and apu.bot are not directed at children under 16, and we do not knowingly collect data from anyone under that age.

10. Where your data is processed

Our Cloud Functions (the backend code behind apu.bot's chat, voice and account-data features) run in Google Cloud's us-central1 region. The rest of our backend runs on Google Cloud / Firebase. apu.bot's AI processing is additionally sent to Groq, Inc. (see §3). Using Skyzai or apu.bot means your data may be processed in countries other than your own, including the United States, through these providers' own infrastructure and safeguards.

11. Changes to this policy

We'll update the "Last updated" date above when we make changes, and post the updated policy here. If a change is significant, we'll make a reasonable effort to let you know in-app before it takes effect.

12. Contact us

Questions about this policy or your data: ramesh@aureus.money.