ALLYK Privacy Policy

Last updated: November 12, 2026

ALLYK is operated by MAYAYAI. This policy explains how we handle information submitted through the ALLYK website, account setup, workspace, Connect, Integrations, and support flows. It is written for transparency and does not replace a customer contract or a data processing agreement where one is required.

Roles and Scope

MAYAYAI generally acts as the controller for website, account, trial, billing-contact, security, and product-administration information. When a business customer asks ALLYK to process its workspace content or a connected service on that customer's instructions, the customer normally decides the purpose and means of that processing and MAYAYAI may act as a processor or service provider/contractor. The applicable role depends on the contract, feature, and data flow.

Information We Collect

Depending on the feature, ALLYK may process account and contact information such as name, work email, normalized phone number, company, role, region, sign-in method, workspace membership, plan, and billing status. It may also process customer workspace content such as chats, projects, attachments, feedback, connector configuration metadata, action approvals, action outcomes, device metadata, and operational audit events.

Camera capture is optional. A live camera preview is processed locally in the browser only after an affirmative choice. ALLYK does not passively record the preview or upload preview frames. A still becomes workspace content only after you explicitly capture it and press Send; normal attachment, model-provider, retention, and privacy-request controls then apply.

Usage And Billing

To display plan allowances and operate the service, ALLYK records minimized usage metadata for completed logical product outcomes: workspace, time, client surface, outcome type, interaction units, and, for a BYOK request, the selected provider, model, and provider-reported numeric token totals. ALLYK does not place prompts, model responses, files, credentials, raw connector payloads, page loads, or failed attempts in this usage ledger. BYOK token totals are informational only; the selected model provider charges for BYOK usage directly.

ALLYK uses this metadata to show usage, apply the selected plan's allowance, prevent abuse, support security and billing inquiries, and maintain an audit trail. It does not sell this information or use it for cross-context behavioral advertising. Current plans do not automatically charge an overage; a future change to that policy will be disclosed before it takes effect.

Restricted Information

Do not submit passwords, API keys, payment-card numbers, government identifiers, medical records, bank-account secrets, regulated records, or confidential third-party data unless you have a separately reviewed agreement and a feature explicitly approved for that category. Do not paste provider service-role keys, gateway secrets, or production credentials into a chat.

Information Use

We use information to create and secure accounts, prevent repeated trial abuse, provide workspace access, maintain project context, run tasks submitted by the user within the connected Install and provider scopes, prepare governed external actions, respond to support and privacy requests, process subscription entitlements, protect the service, and maintain auditability. ALLYK is not designed to make a legal or similarly significant decision about a person without a responsible human determination.

Approvals And Services

ALLYK may read connected-service context, draft a proposed action, and record a human decision. Write actions require the configured connector policy and approval boundary. A connected provider receives only the data and scope authorized for that connection and action. Users can revoke a supported connection; ALLYK records the revocation as an operational event.

Linked Clients

During account registration, ALLYK records your one-time authorization for already linked ALLYK Installs and already configured Connects to reconnect automatically and run tasks you submit within their declared permissions. An active Install reuses its existing account identity and configured provider connections; task submission does not expand those scopes. We retain a versioned authorization event without the checkbox text, task content, or credentials. New provider sign-in or a material scope change uses that provider's authorization.

When an Install is linked, its label, client type, version, platform, link time, and last-use time are available to your other linked ALLYK Installs in the same workspace so submitted tasks can reach the right client. This never shares a raw key, device identifier, file, chat, local path, location, or workspace content by itself. You can pause task receipt, hide the Install, or revoke it in Devices at any time. You can stop a running task, and you can disconnect a Connect; those controls apply to future work.

Git and Repositories

ALLYK shows the Git state and files of your repositories by reading them on your own device through your linked VS Code Install. What we store: for a task run by that Install, up to 100 file handles, each a SHA-256 hash of a repository-relative path with no file name, removed when the task is archived and deleted with the task, the Install or the workspace; and for each repository folder you open, a repository handle linking your account, that Install, a digest of the folder (not its path) and the Install's permission generation. Repository handles are deleted when you revoke one, when the Install is paused, revoked or re-scoped, and with the Install or workspace.

What passes through without being kept: file names your Install sends back for display are held in server memory for at most 8 seconds and never stored or logged. Repository content you open (changes, status, history, file text) is read on your device and passed through ALLYK in memory until it is shown, for at most about 20 seconds and at most 1 MiB per answer, and is never stored or logged. Our logs record only the kind of read, its outcome, sizes and timing.

What goes to GitHub: ALLYK does not send your repository to GitHub. When you use the GitHub Connect, your Install calls GitHub through your own signed-in GitHub CLI on your device, only for the operation you choose: reading your account status, repository details, a CI run, a pull request or branch rules, and, with your approval, creating an issue or a draft pull request, or closing a draft pull request you choose.

Retention and your rights: the handles are kept only as long as described above. Account closure revokes your Installs, which deletes your repository handles; it does not by itself delete task file handles, which are removed when their tasks are archived or deleted. The in-app account summary download does not include these handles. You can ask for them, or for their deletion, through an access, export or deletion request in ALLYK Privacy; those requests are reviewed by hand.

To help you keep your account secure, ALLYK records each completed sign-in and each Install you link: whether it was the website in a browser or an installed ALLYK app (Desktop, the VS Code extension, the CLI, the Chrome extension side panel or the Android app), the app's version, the operating system, the browser family and major version for the website, the time to the minute, and when that session was signed out. The website's operating system and browser come from the basic browser details your browser already sends with every request; ALLYK keeps only the normalized names, never the raw browser string. A browser on Linux shows as Linux; a Linux distribution such as Ubuntu appears only when an installed ALLYK app reports it. ALLYK does not record your IP address, location, network, device identifiers or any fingerprinting signal for this history, and these entries never decide what you can access.

You can see your own sign-in history in Settings › Account › Sign-in history; other workspace members, including administrators, cannot see it. It is used only for account security and for support when you ask for help with your account, never for analytics, marketing, profiling or AI models. Entries are deleted 90 days after the sign-in, are erased when your account is deleted, and are included in the account download in Settings. Our basis is providing the service and keeping accounts secure; it is not sold or shared.

Diagnostics Plugins

When you connect ALLYK Diagnostics from a supported AI application, that host can send the context or scores you select, read active task titles and saved Diagnostics reviews, and save a review when you request it and grant write access. The host receives those inputs and results and may retain them under its own policies. This connection does not provide your full chat history, model keys or ALLYK's private calculation code.

Access is bound to your ALLYK account and workspace, expires after one hour, and can be revoked in Plugin connections. Revocation stops future access; it cannot erase copies already received by the host. We store hashed connection credentials, scope and expiry information, request-limit counters and minimized connection/review events. Preview content is not saved by this feature. Reviews you choose to save become task content under the same workspace rights and retention controls. Connecting does not authorize model training or execution of recommendations.

Buying and Selling

ALLYK users can sell offers from a public seller page. If you set up a seller page, its address, display name and country are public. Selling is for adults only. Before your first offer goes to review, India's Consumer Protection (E-Commerce) Rules 2020 require your seller details: your legal name (and GSTIN if registered), your full address, a customer care contact and a grievance officer's name and contact. They are public on your seller page while you have an offer listed there; ALLYK also records the version and time of the accuracy undertaking you give. They are erased with your account, except that each order keeps a copy of the details and undertaking version it relied on, so the buyer can bring a complaint: that copy is kept until two years after your last sale (India Consumer Protection Act 2019 s. 69), then deleted. A privacy access request includes your details, your undertakings and each order's copy; a buyer's request includes the copy for their own orders. The payment-account keys and file-storage keys you connect are stored encrypted and used only to create checkouts, confirm payments and create download links that expire after 5 minutes. Your files stay in your own storage and do not pass through ALLYK.

If you buy or get an offer from another ALLYK user's seller page, ALLYK records an order: your account reference, the offer and its version, the amount, currency and order status, the payment provider's order, payment and event IDs, and the times. It never records card details, your address or any delivered file. You pay the seller's own payment account (Razorpay or Stripe); the seller is the seller of record, issues invoices and handles tax, and ALLYK never holds your money. The seller sees their own orders (the offer, amount, status and payment IDs) but not your name or email; you see your own purchases; no other user sees either. If you close your ALLYK account, the orders you placed stay with the seller as their sales record, for their own records such as invoices and tax, with no link to your account. If a seller closes their account, their seller page, offers and connected keys are deleted; your purchase stays in your Purchases with a copy of the receipt (offer, seller name, amount and date), but a download from that seller stops working because the file was in the seller's storage. A privacy access request includes your seller page, your offers and the orders you placed or received.

If you sell an ALLY or an ALLIES roster, ALLYK stores a copy of each ALLY's name, role, instructions, capabilities, tags and the tools it asks for with the offer. A sold ALLY carries no knowledge files. After a paid or free order, a buyer can read the instructions and add a copy to their own project. A copy a buyer has received cannot be taken back or erased remotely. Your ALLY's history, memory, keys, access and routines are never included, and your own ALLY is not shared or changed. If you buy or get an ALLY, ALLYK records which of your projects you added it to. The copy is yours: it has new IDs, no access and its routines off, and it runs on your own model. Your record of the import is erased with your account. The copy stored with an offer is erased with the seller's account; copies already delivered stay with their buyers.

Spark Papers and Lore Pages

ALLYK Spark papers and ALLYK Lore pages are published to be read. When you publish a Spark paper, anyone without an account can see, at spark.allyk.app, each version's title, authors, field, your complete abstract and the start of the paper; the version is listed in that site's list of papers and in its sitemap, so search engines, including Google Scholar, can find it. When you publish a Lore page, anyone without an account can see its title, your author name, its topic, summary and its first statements and timeline entries, without sources. Anyone signed in to ALLYK can read published papers and pages in full, with their sources, History and earlier versions, and search Lore topics. Drafts are visible only to their authors. The public pages set no cookies and run no tracking or analytics.

Each published version is kept as it was, with a SHA-256 fingerprint, so it stays readable and citable; you correct a paper or page by publishing a new version or, for a paper, a notice. Files of a Spark paper stay in your own storage; ALLYK keeps only their fingerprints. A place on a paper or page is only what you add: typed, chosen, or read once from your device when you tap for it, rounded to the precision you choose. ALLYK does not record readers' locations. Text an AI agent proposed and you accepted carries a visible AI-generated mark.

Anyone signed in can report a paper, page or post by its display ID. ALLYK reviews reports under the timelines below; an item ALLYK hides is not shown to anyone, including on the public pages, its list and sitemap, and its author receives a notice with the reason and can appeal once. When you archive a paper or page it disappears from reading, search, the public pages, the list of papers and the sitemap at once; search engines may keep their own copy for a while. You can download your Lore data from ALLYK Lore, and a privacy access request includes your Spark papers, versions, feedback, votes and invites and your Lore pages, drafts and proposals.

ALLYK Say

ALLYK Say lets you post short texts and threads on your seller page. ALLYK stores what you post: the text of each post and reply and its earlier versions when you edit it, which post it replies to or quotes, its display ID, a place you choose to add (a region, "Remote" or an event venue, at the precision you pick; never your device's location) and, for gallery items you show, only their reference and SHA-256 fingerprint; the files stay in your own storage. It also stores your likes, reposts and follows, and the place you set for your page. When you share one of your offers on Say, the post keeps a reference to that offer and shows it as it is currently published (title, type, price and a link); it stops showing it once you archive, unpublish or delete the offer.

Who sees it: people signed in to ALLYK see your posts and replies. Where your seller page is public, people who are not signed in see a short preview of your first posts or of a thread (the text, date, Edited mark, display ID, the number of gallery items, the card of an offer you shared and your page name only, without likes, reposts or replies beyond the first few); ALLYK adds no tracking or structured data to that preview, but search engines may read and show the text of a public thread preview. Agents and other software read Say only through ALLYK's authenticated API, with the access of the person using them. You keep the copyright in what you post; the licence you give ALLYK to show it is in the Terms.

Reports and moderation: if you report an item, ALLYK keeps your account reference, the item's display ID, your reason and any details you write, and when it was received and is due; the author is not told who reported it. If ALLYK hides your item, it records who decided, when, why, the legal basis and the item's fingerprint, never a copy of it, tells you with the reason, and you can appeal once. See the Grievance Officer section for response times.

You can archive a post at any time, which hides it from everyone else; closing your account archives your posts and replies and removes your likes, reposts and follows. Your posts (with the offer each one shares), likes, reposts, the number of accounts you follow, reports, moderation notices and appeals are included when you request a copy of your data. You can also delete your own post: Delete moves it and its thread to Trash for 30 days, where you can restore it, and then deletes it permanently; Delete permanently does that at once. Your own replies in the thread go with it. If other people replied, the post stays in the thread as "Deleted by its author" with no content, so their replies stay theirs; your deletion log keeps a record that you deleted it, without its content. A deletion request in ALLYK Privacy is still reviewed by hand.

BYOK LLM Use

ALLYK offers deterministic assessment and bring-your-own-key model workflows. Before each model-backed chat query, the composer identifies the selected provider and model and lists what Send submits: the message and, where available, that chat's recent messages and a context summary (workspace and project names, linked project descriptions, up to eight other chat titles in those projects, the chat's Note, attachment names and saved decision summaries), text and images from files attached to that message, readable text from public links in the message, a Roadmap snapshot in review modes, and any context the user explicitly selects. When the user turns on the per-message option to include the project's chats, Send also submits up to five excerpts from that user's own messages in other chats of the same project, each with its chat's name. The option is off by default and is not available in workspaces with more than one member. In a project thread, when the project's owner presses Send with Ask set to the ALLYK Assistant or one of their ALLIES, Send submits that post, the thread's earlier posts and the names and captions of gallery items shared with the project, and nothing else: no other chats, memory, Connect results or file contents. The reply is written once by ALLYK, labelled AI generated with the provider and model. The answer is saved like any other answer and may quote them; ALLYK keeps only references to the source messages with it, not separate copies of the excerpts, and an archived, deleted or edited source then shows as unavailable. A customer-selected model provider receives that submitted context. The provider's own terms, region, retention, and model-data controls apply. A one-request key is request-scoped. Where saved models are enabled, a key you deliberately save is encrypted server-side and can be managed or revoked in LLM settings. Keys must not be stored in chat history, browser SQLite, settings events or product audit logs. Use dedicated model-key controls rather than ordinary chat messages.

Optional Product Improvement

Helping improve ALLYK is optional and off by default. A user may enable a narrowly scoped preference in ALLYK Privacy settings for de-identified product feedback and minimized operational signals to be considered in a human-reviewed product-improvement process. That preference does not permit use of raw chats, file or attachment contents, credentials, BYOK API keys, connector payloads, health or other regulated data, public case studies, research evidence, or model training. A user can withdraw the preference at any time; withdrawal applies to future improvement processing.

Learning And Research

Workspace content, feedback, and operational events do not become research evidence, training data, or a public case study automatically. Research use requires separate consent, anonymization, classification, claim-ledger mapping, evidence-strength review, and human approval. The optional product-improvement preference above is not research consent. Withdrawing research consent can be requested from the Privacy section inside ALLYK.

Sharing And Providers

We do not sell personal information or share it for cross-context behavioral advertising. We use selected service providers for infrastructure, database/authentication, payment processing, email, connected productivity services, and security operations. Provider use is limited to the configured service and subject to the applicable contract and provider terms. We do not disclose payment-card details because payment providers process those details in their own checkout environment.

Age and Children

ALLYK is for people 18 and older. When you create an account, or at your next sign-in for an older account, ALLYK asks your date of birth once and stores only an age range for the account (18 or older, 13 to 17, or under 13), when it was given, which prompt or review recorded it and that prompt's version; it never stores the date of birth. If the date shows you are under 18, ALLYK does not open the account, or, for an older account, closes its access at once, archives its posts, papers and pages, and sends the account and its records to a reviewed deletion. ALLYK does not knowingly keep personal data of children. If you believe someone under 18 has an account, report one of their posts, papers or pages with the reason "The account holder is under 18": ALLYK aims to review it within 2 hours and, if the review confirms it, records the finding (13 to 17, or under 13), closes the account the same way and tells you the outcome. An account holder who believes their account was closed by mistake can contact the grievance officer below before the deletion review ends; that review can restore access by hand, but activity removed with the account's content is not restored: likes, reposts and follows, the Say page place, Spark votes, confirmations and Reviewed marks, and pending Lore proposals. While an account's age is not confirmed as 18 or older, it cannot add places or event venues in ALLYK Say. Accounts for people under 18 with verifiable consent from a parent or guardian may be offered later; this policy will say so first.

Retention And Deletion

You can archive, delete or permanently delete your own items. Archive keeps an item out of your lists and of product analysis until you unarchive it. Delete moves a task to Trash: it leaves your task lists, search and the Archived view (other members of a shared workspace see it as archived), and ALLYK deletes it permanently 30 days later unless you restore it first. Delete permanently, in an item's menu or in Trash, erases the item at once, together with what ALLYK learned from it (feedback on answers and coding-attempt memory). Some records are kept where the law or security requires it, each for its own period: paid orders and payments (tax records), items under a legal order or an open report, and activity and security logs. Other people's replies stay theirs.

ALLYK keeps a deletion log for you. For each archive, restore, deletion and permanent deletion it records the kind of item, its ID, where you did it and when, and for a permanent deletion a SHA-256 fingerprint of the deleted record; it never keeps the content itself. You can read it and download it as CSV or JSON in Settings, under Privacy, and it is included when you request a copy of your data. It is kept for the life of your account.

Backups: as of November 5, 2026 the production database has no managed backups or point-in-time recovery. Database copies our operators make for maintenance are kept for at most 30 days, so a permanently deleted item is gone from them within 30 days of its permanent deletion. After any restore, ALLYK applies its permanent and 30-day deletions again before the service reopens, so permanently deleted items do not come back.

Account deletion revokes access and archives active workspace records; it does not automatically override legally required, security, billing, or contractual retention. A deletion you request through the authenticated privacy-request workflow is reviewed before any irreversible action is taken.

Offline Browser Storage

When offline context is available, ALLYK may keep a browser-origin-scoped SQLite copy of the current workspace's messages, attachment bytes, and synchronization queue on the device. Use Settings to clear that local copy, or clear ALLYK site data in the browser. Clearing the local copy does not erase the cloud workspace and does not replace an authenticated privacy request.

Your Privacy Choices

An authenticated user can open ALLYK Privacy to turn the optional product-improvement preference on or off, download the account summary currently loaded in the app, or submit an access, export, correction, deletion, processing-restriction, research-consent withdrawal, or opt-out request. We verify the requester and record the review outcome. You may also email mail@mayayai.com. Where a request concerns a customer workspace, we may need to involve the customer's workspace administrator or act under the customer's instructions.

Security

ALLYK uses scoped authentication, workspace checks, private storage paths, approval policies, audit records, and secret-redaction boundaries. No system is risk-free. Before a feature is represented as generally available for sensitive or regulated data, it must pass the product's privacy, security, vendor, and release-control gates. Read the Security & Trust page for the current assurance boundary.

International Processing

ALLYK and configured providers may process information in countries other than the user's location. Before enabling a provider or processing flow for a customer that requires international-transfer safeguards, MAYAYAI and the customer must review the applicable contract, location, and transfer mechanism.

Grievance Officer

Under India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the grievance officer for ALLYK is MAYAYAI, mail@mayayai.com, phone +91-7338710422. You can also report an item in Say, Spark, Lore or Discuss by its display ID with Report; if ALLYK hides your item, you are told why and can appeal once. Response times:

A complaint is acknowledged when you send it: the Report dialog shows when ALLYK received it and when it will be reviewed by.
A report asking ALLYK to remove an item is resolved within 36 hours of receipt, except an intellectual property claim, which is resolved within 7 days.
Any other complaint, and an appeal against a decision to hide your item, is resolved within 7 days of receipt.
Content that shows a person intimately without consent, impersonates someone or puts a child at risk is acted on within 2 hours of a report.
A court or government order is acted on within 3 hours of receipt.

Changes and Contact

We may update this policy as ALLYK changes. Material updates will carry a revised date. For privacy, security, or rights questions, contact mail@mayayai.com.