Privacy Policy
This policy explains how ThinkAsModel Limited (思模科技有限公司), a Hong Kong company (“we”, “us”), collects, uses, and protects your personal data when you use the alayo.ai website and the Alayo app. The principle up front: we collect the minimum data needed to operate. Ad measurement is off by default and enabled only with your permission. We never sell personal data.
1. What we collect
- Update list: the email address you provide when subscribing to updates, plus your answers to two optional questions and the time of sign-up. This is stored in key-value storage with our infrastructure provider, Cloudflare.
- Purchase information (once checkout opens): billing and card details are collected and processed directly by the payment provider (Paddle or Stripe) and never pass through our servers; we receive only the order records needed for fulfillment (order and customer identifiers, actual amount and currency, license status, and for AI credit purchases the pseudonymous license identity the credits are added to), stored in a Cloudflare database. After payment completes, we retrieve the email address you entered at checkout from the payment provider, solely to send you your license key. The email is sent through Cloudflare’s email service, which keeps delivery records (including the recipient address) under its own retention rules; we do not store this address in our own database.
- Email correspondence: whatever you write to [email protected].
- Site visits: this site measures traffic with Cloudflare Web Analytics, provided by our hosting provider Cloudflare. It uses no cookies or localStorage, does not identify or track individuals, and does no cross-site tracking; on each page view your browser sends Cloudflare an anonymous beacon (page URL, referrer, and performance metrics), and according to Cloudflare’s documentation, its analytics service discards the IP address at the nearest edge data center and does not store it in core databases or logs (the hosting provider’s standard access logs described below are a separate kind of processing). Cloudflare keeps raw beacon data for 7 days and only downsampled aggregate data after that; we look only at aggregate reports such as page views, referrers, and device types (available for the last six months). Google Ads measurement is a separate, optional feature described below. If you prefer not to be counted, block the script from static.cloudflareinsights.com; the site works without it. It is hosted on Cloudflare Pages, and Cloudflare, as the infrastructure provider, may keep standard access logs (such as IP addresses) for security and operations. Page fonts are loaded from Google Fonts (fonts.googleapis.com / fonts.gstatic.com), so Google receives standard request metadata such as your IP address.
- Ad measurement (optional): Workbench website pages load the Google Ads tag only after you choose “Allow measurement”. Ad click identifiers and cookies link ads to purchases. We send Google the transaction ID, order amount after discounts and excluding tax, and currency; Google also receives standard request information such as your IP address, browser information and page URL. We do not send email, payment details, licenses or files from the app, and do not enable enhanced conversions or personalized ads. Declining does not affect browsing, downloads, purchases or license delivery. Withdraw permission using “Ad measurement preferences” in the footer: this stops future sends and clears advertising cookies accessible to our site, but does not automatically delete data already sent to Google. Advertising cookies typically last up to 90 days; your consent choice expires after 180 days and purchase deduplication records after 30 days. Expired browser records are cleared on your next visit. See Google’s partner-site data explanation for its processing and retention practices. Our website does not receive or store card details.
2. The Alayo app itself
Alayo is local-first: your files stay on your device unless you explicitly invoke an AI feature that needs selected content. The app requires no account. Before the first request using included Alayo AI credits, the app explains the transfer and asks for your consent.
- Your own key (BYOK): relevant content is sent directly from the app to the model endpoint you configured, under that provider’s terms. Your key stays in the macOS Keychain.
- Included Alayo AI: relevant file content (including images you ask the AI to understand), filenames, and instructions are relayed through our Cloudflare Worker to third-party large language model providers for processing. Each model provider processes what you send under its own terms and privacy policy, which may include retaining that content or using inputs and outputs to train and improve its models and services; Alayo does not control how providers handle it. To the extent permitted by applicable law, Alayo is not responsible for a model provider's processing of data under its own policies. If you do not want these providers to process your content, do not use included Alayo AI, or use your own key (BYOK) in Settings to connect a provider you choose. We do not retain request bodies or model responses. We retain only metering, abuse-prevention, and service-reliability metadata: a pseudonymous installation or license identity, feature type, routed model, token counts, cost and credit totals, request status, error type, and latency, timestamps, and short-lived IP rate-limit counters. To keep trial credits from being claimed in bulk, trial registration also records a keyed hash of your IP address for the current month (the IP address itself is not stored for this purpose), used to limit how many trial gifts one network can claim per month. Included Alayo AI requires no account. Trial and license credits are promotional; license holders can also buy additional credits, and a purchase adds credits to the pseudonymous license identity only.
- Crash diagnostics (optional, off by default): on first launch the app asks whether to “Share Crash Diagnostics”; you can change this anytime in Settings › General › Privacy. When enabled, the diagnostic report that macOS generates after a crash is sent on the next launch to our own server (Cloudflare) — never to a third-party crash service. We use it only to locate and fix crashes. A report is the crash diagnostic that macOS itself produces (MetricKit): the call stack, the crash signal and exception type and code, the termination reason, the time window of the crash, plus the app version and build number, macOS version, and processor architecture. We do not add filenames, paths, space names, anything you typed, your IP address, or any installation or license identity, and we do not further analyze the raw diagnostic. Reports are deleted automatically after 365 days.
- Anonymous usage statistics (optional, off by default): in the same prompt you can choose whether to “Share Anonymous Usage Statistics”, and you can turn it off anytime in Settings. We use it only to learn which features are used, how versions are distributed, and how many first launches complete onboarding, so we can decide what to improve; never for advertising, profiling, or linking to any identity. When enabled, the app records only five kinds of feature events: app launched (cold launch), onboarding completed (whether you chose “Start” or “Skip the guide”), space created, organize plan executed (plan type: apply, undo, or export; number of completed items bucketed by order of magnitude, never exact counts; outcome: completed, partial, or rolled back), and AI request completed (feature type and success or failure). Every event carries the app version and build number, macOS version, device model, processor architecture, system language and region, time zone, screen resolution, light/dark mode, the analytics SDK version, calendar information (such as quarter and weekday), and run-environment flags (debug build, TestFlight, App Store). Events are processed by TelemetryDeck (TelemetryDeck GmbH, Augsburg, Germany) and stored entirely within the EU. The user identifier is a random value generated locally by the app and hashed with a salt twice — on the device and again on the server; no hardware serial number or advertising identifier is used. We never collect filenames, paths, space or group names, anything you type, or actions on individual files. Turning the switch off stops sending, deletes the local unsent queue and the anonymous identifier, and re-enabling starts with a fresh anonymous identity.
- App updates (on by default, can be turned off): Alayo Workbench uses Sparkle for in-app updates. It requests the public update list at alayo.ai (/releases/workbench.xml), and release notes and update packages as needed. Older versions released before Sparkle continue requesting /releases/workbench.json. Automatic checks normally run once a day; you can also check manually. By default, new versions download in the background and install when you quit Alayo Workbench, ready for the next launch. In Settings › General › Updates, turn off “Download and install automatically” to be asked when an update is found, or turn off automatic checks. Update requests use the fixed User-Agent “Alayo-Workbench-UpdateCheck” and carry no account, device or installation identifiers, system profile, cookies or custom query parameters. Network infrastructure still receives generic request information such as your IP address. We do not write update requests to a database; Cloudflare, as the hosting provider, may keep standard access logs as described above.
3. How we use it
- To send the update list product releases and progress (you can unsubscribe anytime);
- To process orders, issue licenses and email them to you, and handle refunds;
- To answer your questions and support requests;
- If you opt in, to locate and fix crashes using crash diagnostics, and to learn feature adoption and version distribution from anonymous usage statistics so we can decide what to improve (see Section 2; you can turn either off anytime in the app’s settings);
- With your permission, to measure purchases resulting from ads;
- To meet legal and accounting obligations.
That’s it. We will not use your email for marketing beyond the above, and we will not hand it to any third party for marketing.
4. Who we share it with
Only with the providers we need to operate, and only to the minimum extent required: payment providers (Paddle / Stripe), infrastructure providers (Cloudflare), Google Ads when you consent to ad measurement, TelemetryDeck when you opt in to anonymous usage statistics (only the anonymous events described in Section 2), and, when you use AI, the model providers described in Section 2. BYOK requests go to your configured endpoint; included Alayo AI requests pass through our Cloudflare relay to the third-party large language model providers described in Section 2. Their terms and privacy policies apply to their processing. We may disclose data where the law requires it. We never sell personal data.
5. Data retention
Update-list emails are kept until you unsubscribe; order and license records are kept as required by applicable law and accounting rules. Included-AI quota ledgers, balances, and credit purchase and refund records are kept as needed to administer credits, prevent abuse, reconcile provider charges, and meet accounting rules; IP rate-limit counters are deleted after their short operational window; the monthly IP hashes used for trial registration are deleted after that month ends; per-request status, error, and latency records are kept for 90 days, and daily aggregates contain no identity and may be kept indefinitely. Request bodies and model responses are not retained by Alayo. Data past its retention period is deleted or anonymized.
6. International transfers
Our providers (Cloudflare, Paddle, Stripe, Google Fonts, Google Ads when you consent to measurement, and third-party large language model providers) operate globally, so your data may be processed outside Hong Kong. Anonymous usage statistics are processed by TelemetryDeck within the EU. A provider you configure through BYOK may likewise process content outside Hong Kong (see Section 2). We only use providers with industry-standard security safeguards.
7. Your rights
Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO), you have the right to access and correct your personal data, and you may leave the update list at any time (we will delete the corresponding list record). You may also request deletion of other personal data to the extent applicable law allows and it does not conflict with statutory retention duties such as accounting, dispute handling, or fraud prevention. Just email [email protected] and we will act promptly.
8. Changes to this policy
We may update this policy from time to time and will revise the “Last updated” date above; material changes will be announced on the Site or by email.
9. Language and contact
This policy is provided in English and Chinese; if the versions diverge, the English version prevails. Privacy questions: [email protected].