Privacy Policy
Version 2026-10-22 · Last updated 22 October 2026
This policy explains what personal data Cibeety ("we", "us") collects, why, who receives it and what rights you have. It applies to the website https://cibeety.com, the app at https://app.cibeety.com and the Cibeety Telegram Mini App. Cibeety is an AI wellness companion for self-reflection. It is not a medical device and not a healthcare service (see the AI & Wellness Notice).
1. Summary
- You must be 18 or older to use Cibeety.
- What you write about your mood, emotions and well-being can be sensitive information. We process it only with your explicit consent, which you give on the consent screen and can withdraw at any time in Settings → Privacy & data.
- To write a reply, each chat message is sent to an AI provider (currently OpenAI). Chat history stays on your device and is not stored on our servers. Diary entries, mood check-ins and reports are stored on our servers until you delete them.
- We do not sell your data, we do not use it for advertising, and we do not allow our AI provider to use it to train its models.
- Product analytics are off by default. Website analytics run only if you accept cookies.
- You can download or delete your data yourself in the app.
2. Who is responsible
The controller of your personal data is Daniil Agalakov, individual entrepreneur (Georgia), identification code 322783065, 5 Avto Varazi Street, Vake-Saburtalo, Tbilisi, Georgia. Privacy contact: yasenpsyco@gmail.com.
- Representative in the EU/UK (if applicable): Not appointed
- Data protection officer / encarregado (if applicable): Not appointed (not required at our size)
3. Data we collect
Account data. When you sign in with Google we receive your name and profile picture and use a verified Google identifier to create your account; your email address is used to verify the sign-in and is not stored in our database. When you sign in with Telegram (website or Mini App) we receive your Telegram ID, first and last name, username, profile picture URL and language. We also store your subscription plan.
Wellness data you enter. This may reveal information about your mental or emotional state and is treated as sensitive:
- mood check-ins (five-level scale with a timestamp);
- emotion diary entries (situation, emotions, intensity, thought, the AI's reflection and your own note);
- ABC-model exercises (event, beliefs, consequences and the AI's reflection);
- weekly reflection reports generated by AI from the entries above;
- chat messages, session diary and regular diary entries, which are stored only in your browser on your device.
Technical data. IP address, device and browser information and request logs processed by our hosting infrastructure for security and operation; a signed, HttpOnly session cookie (cibeety_session, valid for 5 days and renewed while you use the app); preferences stored in your browser (language, theme, viewed stories, chat history).
Approximate location. On the consent screen we derive your country from your IP address (or your network's country header) to show the legal wording that applies in your region. We store only the resulting region (for example "EU") with your consent record, not the IP address or the country.
Login and security records. Time and method of sign-in (Google or Telegram).
Usage analytics (only if you opt in). Which screens and features are used, timestamps, language, theme, plan and platform, plus a random anonymous device ID. Analytics never include the text of your messages, diary entries or reports.
Website analytics (only if you accept cookies). Google Analytics on cibeety.com; see the Cookie Policy.
Messages to us. If you contact us, we keep your message and our reply.
We do not knowingly collect biometric data, precise location, contacts or photos. Voice input, if offered, is transcribed and handled like a chat message.
4. How we use data and on what legal basis
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and secure your account, sign you in | Account data, technical data, login records | Contract (Art. 6(1)(b)); legitimate interests in security (Art. 6(1)(f)) |
| Provide chat, diary, mood and exercise features and AI replies | Wellness data | Contract (Art. 6(1)(b)) and your explicit consent (Art. 9(2)(a)) |
| Generate weekly reflection reports | Wellness data | Your explicit consent (Art. 9(2)(a)) |
| Route messages that may indicate a crisis to safety resources | Chat messages | Your explicit consent (Art. 9(2)(a)) |
| Product analytics and improvement | Usage analytics | Your consent (Art. 6(1)(a)); optional |
| Website analytics | Cookie data | Your consent (Art. 6(1)(a), ePrivacy) |
| Prevent abuse and fraud, enforce our Terms | Technical data, account data | Legitimate interests (Art. 6(1)(f)) |
| Comply with law, respond to legal requests | As needed | Legal obligation (Art. 6(1)(c)) |
| Answer your requests | Messages to us | Contract / legitimate interests |
Where we rely on consent, you can withdraw it at any time without affecting earlier processing. Outside the EEA/UK we rely on the equivalent bases in your local law (for example Art. 7 and Art. 11 LGPD in Brazil).
No automated decisions with legal effect. We do not make decisions about you that produce legal or similarly significant effects. We do not profile you for advertising.
5. How the AI works with your data
1. When you send a chat message, our server sends it, together with up to the 30 previous messages of that conversation, to our AI provider to generate a reply. 2. A safety check reads your recent messages to decide whether to show crisis resources instead of a normal reply. It uses the AI provider and simple keyword rules. It is not perfect and can miss things. 3. To find relevant self-help material, your message is converted into a numerical representation by the AI provider's embedding service and compared with our knowledge base. 4. Diary entries you submit and the weekly reflection are processed the same way.
The current AI provider is OpenAI (OpenAI, L.L.C., United States), acting as our processor. Under its API terms, data sent through the API is not used to train its models and may be retained for a limited period (currently up to 30 days) for abuse monitoring. We may change providers; the current list is available on request and we will update this policy and, where required, ask for your consent again.
Our staff do not routinely read your content. Access is limited to what is needed for security, a support request from you, or legal obligations.
6. Who receives your data
| Recipient | Role | Why |
|---|---|---|
| Contabo GmbH (server in France) | Processor | Hosting, database, logs |
| OpenAI, L.L.C. | Processor | AI replies, safety classification, embeddings |
| Google LLC | Independent provider / processor | Sign in with Google; Google Analytics (only with consent) |
| Telegram | Independent provider | Sign in with Telegram; Mini App. We also use a private Telegram bot for service alerts; these alerts never contain your messages, diary entries or moods |
| Paddle.com Market Limited and its affiliates (merchant of record) | Independent controller | Payments, taxes, invoices, refunds and fraud checks. Paddle collects your payment and billing details; we never receive your card number. We receive your plan, subscription status, country and a Paddle customer ID |
| Authorities, courts, advisers | Recipients | Where the law requires or to protect rights |
| Acquirer | Recipient | In a merger or sale, under this policy's protections |
We do not sell personal data and do not share it for cross-context behavioural advertising.
7. International transfers
Our providers are located in or may access data from the United States and other countries. When personal data leaves the EEA, the UK or Switzerland, we rely on adequacy decisions (such as the EU-US Data Privacy Framework where the recipient is certified) or standard contractual clauses. For Brazil we rely on the transfer mechanisms of Art. 33 LGPD and ANPD rules, including standard contractual clauses. For other countries we use contractual safeguards required by local law. You can ask us for a copy of the safeguards.
8. How long we keep data
| Data | Retention |
|---|---|
| Account, diary entries, mood check-ins, reports, consent records | Until you delete them or your account |
| Chat history, session and regular diaries | On your device until you clear them. Deleting your account also clears them from the browser you delete it in |
| Product analytics and login/security records | 14 months, then deleted automatically |
| Server and security logs | Short rolling period, no longer than needed for security |
| Backups | Deleted data may remain in backups for up to 30 days |
| Messages to us | As long as needed to answer and keep records |
If a legal claim or obligation requires it, we may keep limited data longer.
9. Your rights
Everywhere: you can download your data and delete your account in Settings → Privacy & data, withdraw consent, and switch analytics on or off there. You can also write to yasenpsyco@gmail.com.
EEA, UK and Switzerland. You have the right to access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests) and to withdraw consent, and to complain to your supervisory authority (for example the data protection authority where you live or work). We reply within one month.
California (CCPA/CPRA) and other US states. See the Health Data Notice for state-specific disclosures, including Washington's My Health My Data Act and your rights to know, delete, correct and appeal.
Brazil (LGPD). You may confirm processing, access, correct, anonymise or delete data, request portability, information about sharing, revoke consent and complain to the ANPD. Our legal bases are your specific and highlighted consent for sensitive data (Art. 11) and the other bases in Art. 7. Contact our encarregado: Not appointed (not required at our size).
Mexico. You have the ARCO rights (access, rectification, cancellation, opposition). This policy serves as our privacy notice (aviso de privacidad); send requests to yasenpsyco@gmail.com.
Argentina. The Agencia de Acceso a la Información Pública, as the control body of Law 25.326, handles complaints about breaches of data protection rules.
Colombia, Chile, Peru, Uruguay and other Latin American countries. You have the rights recognised by your national law (access, update, rectification, deletion, revocation of consent, opposition). Sensitive data is processed only with your consent, and you are never required to provide it, although some features need it. Contact yasenpsyco@gmail.com; you may also contact your national authority (for example the Superintendencia de Industria y Comercio in Colombia).
10. Children
Cibeety is for adults only (18+). We do not knowingly collect data from anyone under 18. If you believe a minor uses Cibeety, write to yasenpsyco@gmail.com and we will delete the account.
11. Security
We use HTTPS for data in transit, signed HttpOnly session cookies, access controls and the principle of least privilege. No system is perfectly secure. If a breach affects your rights, we will notify you and the authorities as the law requires (for example within 72 hours to supervisory authorities under the GDPR where applicable).
12. Cookies and local storage
See the Cookie Policy.
13. Changes
When we change this policy materially we will update the version and date above, tell you in the app, and ask for consent again where the law requires. Earlier versions are available on request.
14. Contact
Daniil Agalakov, individual entrepreneur (Georgia), identification code 322783065 · 5 Avto Varazi Street, Vake-Saburtalo, Tbilisi, Georgia · yasenpsyco@gmail.com
Translations are provided for convenience. If they differ, the English version is the reference, without limiting any mandatory rights you have under local law.