Privacy Policy

01Who we are

Tavy ("Tavy", "the app", "we", "us", "our") is published by j8n, s. r. o., a company registered in the Slovak Republic (the "Controller"). For the purposes of the EU General Data Protection Regulation (GDPR) we are the data controller for all personal data processed through the Tavy app and the tavy.sk website.

Registered office: j8n, s. r. o., Bezručova 5, 811 09 Bratislava, Slovakia
Company No.: 52258491 · VAT No.: SK2120970577
Contact for privacy matters: hello@j8n.sk

02The summary, in plain language

• Local by default. Tasks, captures, voice recordings, habit history and reset history live on your device. They are not uploaded anywhere unless you turn on optional cloud sync.
• No tracking. No advertising SDKs. No cross-site tracking pixels. No selling of data to anyone.
• Brain Sort is the only feature that sends text off-device. When you tap Sort, the text you typed is sent to an AI provider over HTTPS, the response comes back, and the call is not retained for model training.
• You can wipe everything. One tap in Settings, or via a request from tavy.sk/delete-account.

03What we collect, and where it lives

We do not collect: precise location, contact list, calendar contents, photos, identifiers for advertising (IDFA / GAID), or browsing history.

04Why we process data & the legal basis

Under GDPR Article 6 we rely on the following legal bases:

• Performance of a contract — to operate the app, deliver Brain Sort responses, restore your purchase. (Art. 6(1)(b))
• Legitimate interest — minimal, anonymous crash diagnostics to keep the app stable. (Art. 6(1)(f))
• Consent — optional cloud sync, optional analytics opt-in, marketing email if you ever subscribe. (Art. 6(1)(a))
• Legal obligation — keeping purchase records for tax and consumer-protection law. (Art. 6(1)(c))

05Brain Sort & AI processing

When you tap Sort it, the text you typed (and nothing else) is sent over a TLS-encrypted connection to our AI provider's API. The provider returns a structured breakdown — "Start here" plus suggested next steps — which Tavy renders inside the app.

What the provider receives

• The exact text you chose to sort.
• A system prompt that tells the model how to behave (tone, output shape).
• No account ID, no device ID, no name, no email.

What the provider does with it

We use a business / API tier with the contractual guarantee that your input and the model's output are not used to train any model. The provider retains the request only briefly for abuse detection (typically up to 30 days) and then deletes it. Their full data processing terms are linked from § 07.

What you should not paste

Please do not paste passwords, medical record numbers, full payment card numbers, or other sensitive identifiers into Brain Sort. Treat it like you would treat any AI chatbot.

06Voice & microphone

Tavy uses the microphone only while you are actively recording a Quick Capture. Transcription happens on-device using the system speech recognition API. The audio file is saved in the app's private sandbox and is deleted when you delete the capture.

The voice file is never uploaded to our servers and is never sent to the AI provider. If you later tap Brain Sort on a transcribed capture, only the transcript text is sent.

07Third-party processors

We use the minimum number of processors to operate the service. Each is bound by a Data Processing Agreement compliant with GDPR Art. 28.

Where data is transferred outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses and the processor's published Data Privacy Framework certification where applicable.

08How long we keep things

• On-device data — for as long as you have the app installed. Uninstalling the app removes the local database.
• Cloud sync data (if enabled) — kept until you turn sync off or delete the data. Encrypted at rest in your iCloud / Google account.
• Brain Sort requests — held only transiently by the AI provider (typically ≤ 30 days for abuse review), then deleted.
• Crash diagnostics — anonymised, retained up to 90 days.
• Support email — up to 24 months after the conversation closes, then deleted.
• Purchase records — 10 years, where required by Slovak tax law.

09Your rights under the GDPR

If you are in the EEA, UK or Switzerland, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to stop processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Object — to processing based on legitimate interest.
• Withdraw consent — at any time, where consent is the legal basis.
• Lodge a complaint — with your supervisory authority. In Slovakia: Úrad na ochranu osobných údajov SR.

To exercise any of these rights, email hello@j8n.sk or use our data-deletion form. We respond within 30 days.

10Children

Tavy is intended for adults. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided data to us, contact hello@j8n.sk and we will delete it.

11Changes to this policy

When we make material changes to this policy, we will notify users inside the app at least 14 days before the change takes effect, and update the "Last updated" date at the top. Continued use of Tavy after a change means you accept the updated policy.

12Contact & data protection officer

For any privacy question, complaint, or rights request:
Email: hello@j8n.sk
Post: j8n, s. r. o., Bezručova 5, 811 09 Bratislava, Slovakia.

We have appointed an internal data protection coordinator. For complex matters, we will route your message to them within 5 working days.