Privacy Policy

Last Updated: October 7, 2026

Sanoy (“we”, “our”, or “the Service”) is an AI assistant application created by Ahmed Samir Hafez, an individual developer based in Egypt. This Privacy Policy explains how we collect, use, store, and protect your personal information.

Our core promise: Your conversations are YOURS. We don't sell your data. We don't share it with advertisers. We don't use it to train AI models.

By using Sanoy, you agree to this Privacy Policy.

1. Summary (Plain Language)

• We collect the minimum required to operate Sanoy: your name, email, country, and messages.
• Your messages are encrypted before leaving your device.
• We offer two privacy modes: Maximum Privacy (zero-knowledge) and Standard Backup.
• We use external AI providers (Mistral, Groq) to process your messages. They're contractually bound not to train on your data or sell it.
• We never sell your data.
• You can delete your account and all data at any time.

2. Information We Collect

2.1 Information you provide directly

• Name — used to personalize your experience
• Email address — used for account login and password recovery
• Country — used for timezone-aware features
• Password — stored only as a cryptographic hash (never in plaintext)

2.2 Information generated by your use

• Messages — your conversations with Sanoy
• Tasks and reminders — items you create
• Facts and preferences — things you ask Sanoy to remember
• Voice input — when you use the microphone (processed for speech recognition, not stored)

2.3 Automatically collected (anonymous)

• App usage events — via our self-hosted Umami analytics (e.g., “user logged in”, “message sent”)
• Device type and OS version — for compatibility purposes
• App version — for update notifications

We do NOT collect: your location (GPS), your contacts, your photos or files, your browsing history, or any data from other apps.

3. How We Use Your Information

We use your information to:

• Provide the Sanoy AI assistant service
• Authenticate your account
• Store your chats, tasks, and reminders
• Encrypt and back up your data
• Send you password reset codes
• Improve Sanoy's reliability

We do NOT use your information to: sell to advertisers, train AI models, track you across apps or websites, build a profile for marketing, or share with data brokers.

4. Two Privacy Modes Explained

Sanoy offers two backup encryption modes. You choose at signup and can switch anytime in Settings.

4.1 Maximum Privacy (Zero-Knowledge)

• Your backups are encrypted with a key derived from a 24-word recovery phrase that only you hold
• The recovery phrase never leaves your device
• Even Sanoy cannot read your backups — this is guaranteed by mathematics, not policy
• If you lose both your password and your recovery phrase, your backups cannot be recovered by anyone — including us

4.2 Standard Backup

• Your backups are encrypted with AES-256-GCM
• The encryption key is derived from account information (user ID + email) that we hold
• We can technically help you recover your backup if you forget your password
• We have never accessed a user's backup without their explicit request for recovery

Both modes: encrypt data before it leaves your device, use AES-256-GCM (authenticated encryption), and use PBKDF2-HMAC-SHA256 (100,000 iterations) for key derivation.

5. External AI Providers

Sanoy uses external AI providers to process your messages. Currently:

• Mistral AI (primary)
• Groq (fallback)

What we send to them: your message text, recent conversation context, and relevant facts you've told Sanoy to remember.

What we do NOT send: your name, email, user ID, country, backups, or password.

Contractual protections: We use Mistral's paid Scale plan, which contractually prohibits using your data to train AI models. Groq's API terms prohibit training on user data.

6. Data Storage and Security

6.1 Where your data lives

• Primary storage — on your own device (encrypted SQLite database)
• Backups — on our servers (Hetzner, Germany), encrypted before upload

6.2 Security measures

• Encryption at rest — AES-256-GCM
• Encryption in transit — TLS 1.3 (HTTPS)
• Password hashing — PBKDF2-HMAC-SHA256 (100,000 iterations)
• Recovery phrase storage — Android Keystore (device-only)
• Server access — SSH key authentication only, no password login

6.3 Data retention

• Active accounts — Data retained as long as you use Sanoy
• Deleted accounts — All data deleted immediately upon your request
• Backups — Overwritten on every new backup; only the latest is kept

7. Your Rights

You have the right to:

• Access your data — it's on your device; you can export it anytime
• Delete your data — via Settings → Account → Delete Account
• Change privacy mode — anytime in Settings
• Request data export — email us at sanoy.feedback@gmail.com
• Withdraw consent — delete your account

Response time: We respond to all requests within 7 days.

8. Children's Privacy

Sanoy is intended for users 13 years or older.

We do not knowingly collect data from children under 13. If you believe a child under 13 has used Sanoy, please contact us at sanoy.feedback@gmail.com and we'll delete the account.

9. Third-Party Services

Sanoy uses these third-party services:

• Google Play Billing — for subscription payments
• Hetzner Cloud — server hosting (Germany)
• Namecheap — domain registration
• Vercel — website hosting
• Google Cloud — for verifying subscription purchases
• Mistral AI — AI message processing
• Groq — AI message processing (fallback)

We do NOT use: Facebook SDK, Google Analytics, Firebase Analytics, advertising networks, or any SDK that tracks users across apps.

10. Data Transfers

Your data may be transferred to and processed in countries outside your own, including:

• Germany (server hosting)
• United States (Google, Mistral, Groq)

By using Sanoy, you consent to these transfers.

11. Changes to This Policy

We may update this Privacy Policy. When we do:

• We'll update the “Last Updated” date
• Material changes will be announced in the app
• Continued use means you accept the updated policy

12. Contact Us

For questions, concerns, or data requests:

• Email: sanoy.feedback@gmail.com
• Website: https://sanoy-ai.com
• Creator: Ahmed Samir Hafez, Egypt

13. Legal Compliance

Sanoy complies with:

• Google Play Store policies
• GDPR (for European users)
• Egyptian data protection regulations

If you're an EU resident and believe we haven't complied with GDPR, you have the right to lodge a complaint with your local data protection authority.