Privacy Policy

This Privacy Policy explains what information SAY collects, how it's used, and what choices you have. We've tried to write it to actually match what the product does, not just what a privacy policy is supposed to say — where something below is specific (like how images are handled), it's specific because that's literally how it works.

1. Information We Collect

Account information

When you first open SAY, we automatically create a lightweight account for you so you can start using it immediately — at this point we collect no email, password, or personal information at all, only what's needed to keep your sessions attached to that account. If you later choose to create a full account from the app's Profile screen, we collect the email address, optional display name, and password you provide at that point. Your password is hashed before storage — we never store it in plain text and can't see it.

What you share with SAY

Anything you provide to build a communication session: typed text, transcribed speech, screenshots, images, and documents, along with the understanding SAY builds from them (situation, audience, intent, and similar). This is the core of what the Service does, and it's necessarily sensitive — see Section 3 for exactly how each type is handled.

2. How We Use It

• To operate the Service — build and maintain your communication sessions, generate responses, and keep your session history available to you.
• To authenticate you and keep your account secure.
• To fix problems and improve reliability (e.g. diagnosing a failed request).
• To communicate with you about your account when necessary (e.g. a security notice).

We do not sell your information, and we do not use your content to serve you advertising — SAY doesn't currently run any advertising or ad-tracking at all.

3. How Each Type of Content Is Actually Handled

Text you type

Stored as part of your session so SAY can reference it going forward.

Voice

On the mobile app, speech is transcribed on your own device using your phone's built-in speech recognition — the audio itself is never uploaded to our servers. Only the resulting text is sent to SAY and stored as part of your session.

Screenshots & images

An image you upload is sent once to our AI provider to be read and understood (who's in a conversation, what was said, what a document is about). We keep the resulting text description as part of your session — we do not store the image file itself. Once that one analysis call completes, the image is gone from our systems.

Documents

Handled the same way as other context you provide: stored as part of your session so SAY can use it in future turns.

4. Third-Party Processing

To understand your content and generate responses, SAY sends relevant parts of your session to OpenAI, which processes it as our data processor under its own API data-use terms (OpenAI does not use API content to train its models). We use a third-party database provider (Neon, running on Postgres) to store your account and session data, and it's encrypted in transit. We don't share your content with any other third party, and we don't sell it.

5. Data Retention

We keep your account and session data for as long as your account is active, so your communication sessions stay available to you over time — that continuity is a core part of the product. If you delete your account (see Section 7), we delete your account and session data, other than what we're required to retain for legal or security reasons.

6. Security

Passwords are hashed, sessions are authenticated with a signed token in an httpOnly cookie (not accessible to page scripts), and data is encrypted in transit. No system is perfectly secure, but we design around minimizing what we store in the first place — for example, never storing your uploaded images — rather than only relying on access controls after the fact.

7. Your Rights & Choices

You can, at any time:

• Ask what personal data we hold about you.
• Ask us to correct inaccurate account information.
• Ask us to delete your account and associated data.

You can delete your account and all associated data at any time directly from the app's Profile screen — this is immediate and permanent. For anything else, email sayapp.support@gmail.com.

8. Children's Privacy

SAY is not directed at, and we do not knowingly collect information from, anyone under 16. If you believe a minor has created an account, contact us and we'll remove it.

9. International Users

SAY's initial market is Latin America, alongside English-speaking users elsewhere. Your data may be processed in countries other than your own by us or the service providers described above (Section 4) — wherever it's processed, we apply the same practices described in this policy.

10. Changes to This Policy

If we materially change how we handle your data, we'll update the date at the top of this page and, where appropriate, notify you directly.

11. Contact

Questions about this policy or your data? Reach us at sayapp.support@gmail.com.