This policy explains how the operator of Ascendia AI (“we”, “us”) handles personal data when you use the Ascendia AI app, this website and related services (the “Service”). Our identity and contact details are in section 11. It should be read with the Terms of Service and the AI Disclosure.
1. Data we collect
| Category | Examples |
| Account | Email address, name, password (stored only in protected form), language, time zone, and the identity confirmed by Apple or Google if you sign in with them. Sign-up asks for your date of birth; we keep only the year and the resulting age band. |
| Your content | Plans, tasks, goals, habits, notes, calendar entries, Money entries, Library sources, Together posts, and photos you upload. |
| Health and wellbeing | Body measurements, workouts, steps, sleep and activity from a source you connect, meals, meal photos, nutrition estimates, allergies, mood check-ins, and health information you write in chat, notes or reminders. |
| AI interactions | Your messages to Cognito, its responses, memories derived from your use, and your feedback. |
| Connected services | Events from a calendar you connect or a calendar feed link you add, and the health data types you allow in Health Connect or Apple Health. |
| Purchases | Store, product, transaction identifier, subscription status and dates. Your payment details stay with Google Play or Apple. |
| Device and usage | Push notification token, IP address and security logs, app version, device model, product usage events, crash reports and, only if you agree, analytics events. |
| Location | Your location while the app is open, if you allow it, for weather and nearby suggestions. We do not keep a location history. |
| Voice | If you use voice input, your device's speech recognition converts speech to text. We receive only the transcript you send. |
Please do not enter sensitive information that you do not need to share.
2. How we use data and our legal bases
| Purpose | Legal basis |
| Providing the Service and the features you request: your account, planning, tracking, reminders, AI responses, sharing, purchases and support | Performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Processing health information | Your explicit consent where the law requires it, given in the app (GDPR Art. 9(2)(a); KVKK Art. 6). You can withdraw it at any time; this does not affect earlier processing. |
| Security, fraud and abuse prevention, crash diagnosis, product usage measurement and improving the Service | Our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Product analytics | Your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)) |
| Complying with law and establishing, exercising or defending legal claims | Legal obligation and legitimate interests (GDPR Art. 6(1)(c) and (f); KVKK Art. 5(2)(ç) and (e)) |
Health information you enter may be stored and used for the chat, tracking and reminders you request, and you can delete it.
Email. Email is sent only for the verification code, password reset, the magic sign-in link, account-deletion confirmation, security notices and, for partner accounts, partner invitation and approval messages. We do not send marketing email without your consent. Our emails come from noreply@ascendia.day, and replies go to info@ascendia.day. Google Play and Apple send their own billing notices.
Crash reports. We use Firebase Crashlytics to find and fix crashes. Crash reports are on by default and can be turned off in Settings → Privacy. A report contains technical details about the crash and your device, not your name, email address or account ID.
Product usage. We record which screens and features are used, with a timestamp and no free text, linked to your account. Product usage is on by default and can be turned off with Product usage in Settings → Privacy.
Product analytics. We use Google Analytics for Firebase to understand which features are used. Product analytics is off until you agree in Settings → Privacy, and you can withdraw your agreement there at any time. It leaves out health screens, does not use the advertising ID and is not used for advertising.
Automated decisions. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Changes that Cognito proposes are saved only when you confirm them or turn on the relevant automation.
We do not sell personal data and do not use it for targeted advertising.
3. AI processing
When you use Cognito or other AI features, your message and the relevant context, such as recent conversation, plans, entries and saved memories, are sent to third-party AI service providers that generate the response on our behalf. These providers currently include Google and may include OpenAI or Anthropic. Meal photos you submit are processed in the same way for a nutrition estimate, and spoken replies may be produced by a text-to-speech service. We do not authorise these providers to use your content to train their own models.
AI responses can be wrong; see the AI Disclosure. You can review and delete what Cognito remembers in Settings → AI Memory.
4. Who receives data
- Service providers acting on our behalf: cloud hosting (Google Cloud), third-party AI service providers, email delivery (Google Workspace), push notifications (Firebase Cloud Messaging and Apple Push Notification service), crash reporting and, if you agree, analytics (Google Firebase). The current list is on the Service recipients page.
- Services you choose to use: Google Play or the App Store for purchases, Apple or Google for sign-in, a calendar service or feed host you connect, Open Food Facts when you scan a barcode, and a weather service for your saved location. These parties apply their own terms and privacy policies.
- People you share with in Together. Share links you create can be opened by anyone who has the link. They show only your first name or your day's progress, expire after 30 days (invites after 14), and you can revoke them at any time.
- Referral partners: if you join through a partner's link, the partner sees a pseudonym, your join date, plan type, subscription status and the end of its commission period.
- Authorities and professional advisers, where the law requires it or where needed to protect rights, safety and security or to establish, exercise or defend legal claims.
- A successor in a merger, acquisition, sale of assets or other transfer of the business, which will remain bound by this policy for the data it receives.
5. International transfers
Your data is stored in the United States (Google Cloud, Oregon), with encrypted backups in a second US region. Our service providers may process data in other countries. Where data protection law requires it, these transfers are made under the safeguards or exceptions that the law provides, such as standard contractual clauses.
6. Retention and deletion
We keep personal data while your account is active and for as long as needed for the purposes above. When you delete an item or your account, we delete it from our active systems, except where we must or may keep it longer to comply with law, resolve disputes, prevent fraud or abuse, or enforce our Terms.
| Account and content | Until you delete it or delete your account. |
| Meal photos | Deleted after the nutrition estimate, normally within about 2 hours. |
| Purchase records | Google Play or Apple is the merchant of record and keeps its own records. We keep the store transaction ID, product, status and dates while your account exists. When you delete your account, these are deleted with it. |
| Crash reports | 90 days. They are not linked to your account. |
| Product usage events | While your account exists. They are unlinked from you when you delete your account. |
| Analytics | 2 months of event data, only if you agreed. Not linked to your account. |
| Security logs | As long as needed for security. |
| Deletion record | A minimal record without your name or email address, kept to show that the deletion took place and to repeat it if a backup is ever restored. |
| Backups | Deleted data can remain in backups for about 4 weeks, until they rotate out. |
Settings → Export or delete lets you export your data or delete your account; you can also delete your account on the web. Deleting your account does not cancel an App Store subscription; cancel it in your Apple subscription settings. We ask Google Play to cancel a Google Play subscription when you delete your account, but please check it in Google Play.
7. Your rights
Depending on where you live, you may have the right to access your personal data, receive a copy, correct it, delete it, restrict or object to its processing, and withdraw your consent at any time without affecting earlier processing. Residents of Türkiye have the rights in Article 11 of the KVKK; see the KVKK notice. Residents of the EU, the UK and certain US states have the rights their local law gives them; see also the Consumer Health Data Privacy Policy.
Most rights can be exercised in the app, in Settings → Export or delete, Settings → AI Memory and Settings → Privacy. Otherwise, write to support@ascendia.day. We may ask you to verify your identity. We respond within the period that applicable law sets, for example one month under the GDPR and 30 days under the KVKK, and may decline requests that the law allows us to decline. You may also complain to your data protection authority; in Türkiye, to the Personal Data Protection Board after first applying to us.
8. Children
The Service is for people aged 16 or older. Sign-up asks for your date of birth, and we keep only the year. If we learn that a user is under 16, we may close the account and delete its data.
9. Security
We use technical and organisational measures appropriate to the risk, such as encrypted connections, access controls and monitoring. No system is completely secure, and we cannot guarantee the security of data sent over the internet. Please keep your device and sign-in details safe.
10. Changes
We may update this policy. We publish the new version here with its date and present changed Terms or Privacy Policy in a simple acceptance popup on the next app open. If you do not accept the change, you can stop using the Service and delete your account.
11. Data controller and contact
Data controller: , sole proprietor, . Email: support@ascendia.day.