Privacy policy

1. In short

• We do not sell your personal data, and we do not use your conversations, photos or other content to train AI models, ours or anyone else's.
• When you send a message, a photo or an app request, it goes through OpenRouter to the AI model you chose or that Smart AI chose for you. The models on offer are developed by OpenAI, Google, DeepSeek, Meta, Anthropic, and SpaceXAI. In the iOS and Android apps, we ask your permission before the first request is sent.
• The app sees only the photos you pick in your device's photo picker. It does not read the rest of your photo library and does not use the camera or the microphone.
• Your conversations, the photos you upload and the content generated from them are stored in your account until you delete them. You control your media content: you can delete it in the app settings, and delete your whole account in Settings, on the website and in the apps.
• To measure and improve our advertising, we share a hashed (not readable) form of your email address and your account ID with Meta when you create an account and when you pay on our website. On iPhone and iPad we do this only if you allow tracking when the app asks. We never share the content of your conversations with advertisers, and we do not access your device's advertising identifier.
• Our analytics, session recordings, logs and error reports never contain the text of your messages or the answers you receive.
• Tarfion Ltd is the data controller for the personal data collected via trybest.ai. Our contact details are set out in the “Contact us” section below.

2. Who we are and what this policy covers

This policy explains what personal data Tarfion Ltd, Griva Digeni 59, Kaimakliotis Building, 5th Floor, 6043 Larnaca, Cyprus ("TryBest", "we", "us") collects when you use the TryBest website, web application and mobile apps for iOS and Android (together, the "Service"), what we use it for and on what legal basis, who receives it, how long we keep it, and what you can do about it. We are the controller of this data. It should be read together with the Terms of use and the Subscription policy. By using the Service, you confirm you have read this Policy.

The apps are distributed through the Apple App Store and Google Play. Apple and Google process data about your use of their stores, including your purchases, under their own privacy policies.

TryBest is intended for adults. We do not knowingly collect data from anyone under 18.

3. What we collect

Data you give us

• Account data. Your email address and the account ID we create for you. Sign-in is handled by Firebase Authentication, which stores your password credential; we never see your password. If you sign in with Google (on the website and in the apps) or with Sign in with Apple (in the app for iPhone and iPad), we receive your email address (with Apple, a private relay address if you choose to hide yours) and an identifier from that service, never your password for it. Google may also share the name and profile picture of your Google account, which our sign-in provider keeps with your sign-in record; we do not use them. If Apple shares your name, the app does not keep or send it. If you leave your email address on the payment screen before creating an account, we store it as a lead linked to your browser session.
• Chat content. The messages you send, the photos you attach to them (up to four per message), the text read from files you attach, the answers you receive, conversation titles, and which model produced each answer. We store them so you can come back to your conversations, and we send your messages and photos to the model you chose (or that Smart AI chose) so it can answer.
• Photos. A photo you attach to a message or give to an image app, such as the photo editor, is reduced in size on your device (at most 1280 pixels on the longer side) and then uploaded to our servers, where it is stored in your account with the message or the result it belongs to. It may show you or other people. We use it only to send it to the model that answers or edits it and to show it back to you, for example in your Gallery. We do not use your photos to recognise or identify people, and we do not create biometric data from them.
• App content. The text and settings you enter in an app, text extracted from files you add (the file itself is read on your device, in your browser or in the app, and is not uploaded), YouTube links you give to an app, and the results: text, documents such as slide decks, resumes and plans, and images that the apps generate or edit. Document and image results are saved in your account; images you made and photos you uploaded are listed in your Gallery.
• Learn AI course. Your answers in the lessons, the prompts you write and the feedback on them, the questions you ask the course's tutor and its answers, your progress and score, the completion of the course and the name you choose to put on its certificate. If you take lessons without an account, your progress is kept only on your device (in your browser or in the app) and is moved into your account when you sign up.
• Reports about answers and images. If you report an answer or an image an app generated, the reason you chose, the comment you add, if any, and which answer or image, model and app the report is about. A report does not copy the answer or the image; we read it in your account while it exists.
• Support correspondence and requests. What you write to [email protected], including cancellation and refund requests and requests about your rights under this policy.

Data we collect automatically

• Usage metadata. For each answer or app run: the model and app used, the length of your input in characters, token counts, the cost of processing, the status (for example completed, stopped or failed), error codes, whether web search or a file was used (its kind and size, not its contents), and times. We also keep your remaining usage budget. This metadata does not contain the text of your messages.
• Technical data. IP address, browser and device type, operating system, language and similar information your browser or the app sends with each request. We use it for security, abuse prevention, rate limits, showing prices in the right currency, and fixing problems.
• Approximate location. From your IP address we derive your country, region, city and postal code. We do not use GPS or ask for your precise location.
• Guest data. If a free use without an account is on offer, a signed cookie identifies your browser and we store a one-way hash of your IP address to limit free use. If you later sign up, your guest conversations are moved into your account.
• Product analytics. Events such as "page viewed", "message sent", "app run", "paywall opened" or "payment completed", recorded with your account ID once you are signed in, a random device identifier stored in your browser or created by the app, a session identifier, the model or app involved, the length of the message and the plan, together with the IP address and the approximate location derived from it, the browser or device type, the time zone and the screen size. Analytics events never contain the text of your messages, inputs or answers.
• Session recordings on the website. We use Microsoft Clarity to record how pages of the website are used (clicks, scrolling, mouse movement and the pages visited) and to build heatmaps. The text of conversations, app inputs and results and the content of form fields are masked before a recording leaves your browser, and Clarity is not loaded on pages opened from a password reset or unsubscribe link. A recording is tagged with your account ID when you are signed in, the random device identifier and, before sign-up, a visit identifier.
• Campaign data. If you arrive from an ad or a link with campaign parameters (such as utm_source, gclid or fbclid), we keep those parameters and the page you landed on to understand which campaigns bring visitors and to report conversions to the advertising platform the click came from (section 7).
• Email delivery. Our email provider records whether the emails it sends for us are delivered and opened.
• In the apps. Device brand and model, operating system and app version, language, time zone, screen size, a random identifier created by the app when it is installed, and the identifier of the app update you run. On iPhone and iPad, your answer to Apple's tracking prompt (section 7). We do not access the advertising identifier of your device (IDFA on iOS, advertising ID on Android). To attach a photo, the app opens your device's photo picker and receives only the photos you choose there; it does not read the rest of your photo library, and it does not use the camera or the microphone. On iPhone and iPad, saving a picture to your photo library through the share sheet asks for your permission to add photos. The apps do not ask for your location.
• Push token. If you allow notifications, the push token of your device, so that we can send you the notifications you have enabled.
• Crash and error reports. When the website, an app or our server fails, a report with the technical details of the error, the device or browser type, the operating system and the app version. Our error-reporting provider may receive the IP address the report is sent from. Reports are not linked to your account and never contain the text of your messages.
• Install attribution (apps). If you install an app after seeing one of our campaigns, our attribution provider records the install and app launches, an app-instance identifier, on iOS the vendor identifier (IDFV), the device model and operating system, and the IP address, which it converts into an approximate region (section 7).

Data from our payment provider and the app stores

• Payment data. On the website, card details are entered in the payment provider's form and processed by the payment provider. We receive the payment result, the amount, the currency, the subscription status, the dates of the paid period and reference numbers. We do not receive or store your full card number.
• App store purchases. If you subscribe in an app, Apple or Google processes the payment. When you buy, the app gives Apple or Google our internal identifier of your TryBest account (not your name or email address), so that the purchase can be linked to your account. We receive a signed record of the transaction: the product, price, currency, dates, renewal status and transaction identifiers, and notifications from Apple or Google when the subscription renews, is refunded or ends. We use it to give you access and to keep accounting records. We do not receive your card details or your Apple or Google account details.

Personal data of other people

Your messages, photos, files and app inputs may contain personal data about other people, for example a photo of a friend or a colleague's name in a document. You are responsible for having a lawful basis to share such data with us, including the consent of the people concerned where the law requires it. Please respect their privacy: do not upload other people's personal data without the right to do so, and do not upload photos of children (the Terms of use do not allow it). To the extent the law allows, you will indemnify us against claims that arise from your failure to do so.

Permissions. The App may ask for notification and other device permissions when you use a feature that needs them. Each is optional. If you decline, only that feature is unavailable.

4. Why we use it and our legal basis

Where the EU or UK GDPR applies, we rely on the following legal bases. "Contract" means that we need the data to provide the Service you signed up for under the Terms of use.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (section 11). Where we rely on your consent or permission, you can withdraw it at any time; withdrawal does not affect processing that already happened.

We do not use chat or app content for advertising, we do not share it with advertisers, and we do not use it to train AI models. We make no decisions about you based solely on automated processing that have legal or similarly significant effects; Smart AI's choice of a model and the limits applied to your account follow from your request, your plan and your usage, as described in the Subscription policy.

5. How your messages reach AI models and other services

When you send a message or run an app, your text is sent, together with the earlier messages of the conversation, any photos you attached, the text read from files you added and the app's instructions, to the model you selected or that Smart AI selected. Image apps send your description and, when you edit a photo, the photos you gave them to an image model, which returns a new or edited image; the photo editor may also send a template picture or a reference photo you chose. Prompts and questions you write in the Learn AI course are sent to models in the same way, to check your answers and to answer your questions. The request goes through OpenRouter, Inc. (OpenRouter), which passes it to the company that runs that model. The chat and image models currently on offer are developed by OpenAI, Google, DeepSeek, Meta, Anthropic, and SpaceXAI. OpenRouter sends each request either to the model's developer or, for models whose weights are published openly, to a hosting provider that it selects to run the same model. We attach an internal account or session identifier to the request, not your name or email address, and we never send your email address or payment details to model providers.

In the mobile apps, we ask for your permission before your first message, photo or app request is sent to a model. The permission screen says what is sent (what you type in a chat or an app, the photos and files you attach, and the earlier messages of that chat), that it goes through OpenRouter, and which companies' models answer. Of a file, only the text read from it on your device is sent. You can withdraw your permission at any time in the app's Settings; without it, the app does not send your messages, photos or app requests. Your permission is kept on your device for your account, so a new device or a reinstalled app asks again. On the website, by sending a message or running an app you ask us to process it as described in this section.

The model providers process requests to generate the answer or the image, under their API terms and privacy policies, which may allow them to keep requests for a limited time, for example to detect misuse, and to apply their own safety filters. Under the API terms of the major providers, API requests are not used to train their models. We encourage you to read the model providers' privacy policies. Please do not include sensitive personal data, such as information about your health, in your messages or photos unless you are comfortable with it being processed this way.

Some apps search the web as part of answering. In that case a search query derived from your input goes through OpenRouter to a web search provider, and the pages it returns are given to the model together with your input.

If you give a YouTube link to an app, our server requests the video's captions from YouTube; YouTube sees our server's request, not your identity. If the captions cannot be read, the link is passed through OpenRouter to a Google model that reads the public video itself.

Files you attach in a chat or add to an app (PDF, Word, Excel, CSV and text files) are read on your device: in your browser on the website, inside the app in the apps. Only the extracted text, cut to the size limit shown, is sent to us and then to the model; the file itself is not uploaded. Exports (PDF, PPTX, DOCX, TXT, CSV, PNG) and the course certificate are produced on your device or served from your own saved results. In the apps, they open your device's share sheet, and nothing leaves your device until you choose where to send or save it.

6. Who receives data

We use the following service providers. Each processes data only to provide its service to us and under a contract that protects your data.

Advertising platforms. Our server sends Meta Platforms (Meta) a hashed (not readable) form of your email address and your account ID when you leave your email address on the payment screen, create an account, or start a trial, subscribe or pay on our website, together with the event, its time and, for a purchase, the amount and currency; for a visit from a Facebook or Instagram ad, also the click identifier from the link. We do not send Meta your IP address, device identifiers, advertising cookies or the content of your conversations. Purchases made through Apple or Google in an app are not sent. On iPhone and iPad this happens only if you allow tracking (section 7). Meta matches the hashed address with its own users to tell us which ads led to sign-ups and purchases and to show our ads to people more likely to sign up, under its business terms and privacy policy.

We may also disclose data when the law requires it, to law enforcement or authorities when required by legal process or to protect the safety of people, to protect our rights, or to a buyer or successor if our business is transferred, merged or restructured; in that case the acquirer is bound by this policy.

7. Advertising measurement and App Tracking Transparency

We advertise TryBest on Facebook, Instagram and other platforms, and we measure which ads bring people who sign up and subscribe. We do this with the data described in section 6, never with the content of your conversations, and we do not show third-party ads in the Service.

iPhone and iPad. Before you sign up or sign in in the app for the first time, it shows a screen that explains what we share with Meta and why, followed by Apple's App Tracking Transparency prompt. Either answer is fine, and the app works the same way.

• If you allow tracking, when your account is created in the app we send Meta the hashed email address and account ID described in section 6, and later events of that account, such as a subscription bought on our website.
• If you ask the app not to track, we keep a record that this account is not to be shared, and none of its events is sent to Meta or any other advertising platform, including purchases you make later on our website.
• In both cases, the app does not access your device's advertising identifier (IDFA).

You can change your choice at any time in Settings › Privacy & Security › Tracking. Our server applies the answer you gave when your account was created in the app; a later change in Settings, or an answer given in the app for an account created on the website or on Android, does not reach it by itself. To stop sharing in that case, write to [email protected] from the email address of your account and we will stop sharing your account's events with advertising platforms.

Website and Android. Apple's prompt exists only on iPhone and iPad. For accounts created on the website or in the Android app, we share the hashed email address and account ID with Meta as described in section 6. You can object at any time by writing to [email protected] from the email address of your account, and we will stop sharing your account's events with advertising platforms. The Android app does not have the permission to read the advertising ID.

Install attribution in the apps. In the apps we may use AppsFlyer to learn which campaigns lead to installs. On iOS we use the version of its software that does not access the advertising identifier, even if you allow tracking. Advertising networks receive only aggregated campaign results, through Apple's SKAdNetwork or AdAttributionKit on iOS and through the Google Play Install Referrer on Android, and never the text of your messages.

8. Cookies, browser storage and app storage

The website uses cookies and browser storage that it needs to work:

• a session kept by Firebase Authentication so you stay signed in;
• a lead_token cookie set when you leave your email address on the payment screen, so the payment can be linked to your account;
• a signed guest cookie, when free use without an account is on offer;
• browser storage for your colour theme, the random device identifier of our product analytics, the first campaign parameters you arrived with, whether the free limit was reached, your Learn AI progress while you have no account, and a message or app input kept while you sign up or pay, so it is not lost.

We use cookies and similar technologies. Some are strictly necessary to run the site, keep you signed in and keep it secure, and these are always active. The rest are optional and are used for analytics and for advertising: Google Tag Manager loads Microsoft Clarity and the tags of advertising platforms, which may set their own cookies to recognise your browser, record sessions and measure conversions.

When you first visit the site from a region where consent is required, we show a cookie banner. Optional cookies are not set until you accept them. You can accept or reject each category separately, and you can change your choice at any time through the cookie settings link in the site footer.

We also honour the Global Privacy Control (GPC) signal. If your browser or a browser extension sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information under the CCPA/CPRA and comparable US state laws, and we automatically disable advertising and measurement cookies for that browser without you needing to contact us.

The mobile apps do not use cookies. Your sign-in session is kept in the device's secure storage, and your settings, such as the colour theme and your permission to send messages to AI models (section 5), and your Learn AI progress while you have no account, in the app's storage on the device. Your answer to Apple's tracking prompt is kept by iOS. Files the app prepares for you to share or save, such as exports and certificates, are written to its temporary storage on the device. Deleting the app removes them.

9. International transfers

We operate from Cyprus. The Service is hosted on Google Cloud in the United States, and OpenRouter, the model providers, Meta, our email provider, our error-reporting, session-recording, app-update and install-attribution providers and the other advertising platforms also process data in the United States or other countries outside yours. Where the law requires it, these transfers are covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, including the EU-US Data Privacy Framework for providers certified under it, together with contractual confidentiality obligations. We transfer data only for the purposes described in this policy.

10. How long we keep data

Model providers and OpenRouter keep requests under their own policies, typically for a limited period for abuse detection. Meta and the other advertising platforms keep what they receive under their own policies.

We may keep account data, technical logs and support correspondence longer than shown above where we still need them to establish, exercise or defend legal claims; to handle a complaint, dispute, audit or investigation; to comply with a legal, regulatory or accounting obligation; or to prevent, detect and address fraud, abuse or a security incident. We keep them only as long as that purpose requires.

We may also keep aggregated statistics that do not identify you, for example the number of messages sent per day, to analyse and improve our products.

11. Your rights

EU and EEA (GDPR). You have the following rights:

United Kingdom. If you are in the UK, you have the same rights under the UK GDPR and the Data Protection Act 2018, including the right to be informed, and you can complain to the Information Commissioner's Office.

California and other US states. If you live in California, you have these rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

• Right to know the categories and specific pieces of personal information we collect, the purposes, the sources and the categories of recipients. They are described in sections 3 to 7.
• Right to delete your personal information, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of your personal information as defined under applicable law. We do not sell personal information.
• Right to non-discrimination. We will not treat you differently for using these rights.

Residents of Virginia, Colorado, Connecticut, Texas, Oregon and other US states with comparable privacy laws have similar rights to the extent their laws provide, including the right to appeal our decision on a request by replying to our answer.

How to use your rights. You can delete conversations and your whole account yourself (section 12), and withdraw your permission to send messages to AI models in the app's Settings (section 5). To use any other right, write to [email protected] from the email address of your account. An authorised agent may make a request for you with your written permission. We may ask you to confirm your identity before acting on a request. We answer within 30 days, or within 45 days where a US state law sets that term; in complex cases we may extend this, by up to two months under the GDPR or as US state laws allow, and will tell you why.

12. Deleting your data and your account

You can delete a conversation at any time: on the website from the chat history, or all your conversations at once in Settings; in the apps from the conversation. Deleting a conversation removes its messages and the photos attached to them; the per-answer usage record stays without the text. You can delete your chats, uploads, or your whole account at any time in the app settings.

You can delete your account yourself in the app, in Settings › Delete account. If you use only the website or cannot sign in, write to [email protected] from the email address of your account and we will delete it for you. Our account deletion page describes the steps and what happens to your data.

Deletion is immediate and cannot be undone. We erase your sign-in, profile, conversations, messages, attached and uploaded photos, documents, generated images, your Learn AI progress and certificate, and your reports at once. We keep only records without content that the law or abuse prevention requires: payment and subscription records, usage records without text (which model answered, token counts and cost), a pseudonymous record of the browser an account was created from, which stops repeated free sign-ups, and the record of your tracking choice (section 10). Product analytics, session recordings and error reports, which never contain the text of your messages, are not deleted with the account; they expire as described in section 10. Copies held by our email provider are deleted within 30 days, and backups are overwritten as described in section 10.

Deleting your account cancels a subscription bought on our website; the current period is not refunded. It cannot cancel a subscription bought in an app through Apple or Google: cancel it in your Apple Account or Google Play settings, as described in the Subscription policy.

Deleting your media content. You have full control over the media content you share with the App: you may delete your media content at any moment, in the app settings.

13. Emails and marketing choices

We send emails needed to run the Service: password reset links, notices about payments, renewals and cancellation, and important changes to these documents. We may also send emails about the Service and offers, including to a lead who left an address but did not finish a purchase. Every such email has an unsubscribe link; you can also opt out by writing to [email protected]. Opting out does not stop the emails needed to run the Service.

You can turn off push notifications at any time in your device settings. To stop advertising measurement of your account, see section 7.

14. Security

We use encryption in transit and at rest, access controls, and regular review of our systems. No service can guarantee absolute security, but if a breach is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant authority without undue delay.

15. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from minors. Please do not upload photos of children; the Terms of use do not allow it. If we learn that a minor has given us personal data, we delete it and close the account. If you believe this has happened, write to [email protected].

16. Changes to this policy

When we change this policy, we post the new version on this page. If a change is material, we will tell you by email or in the Service, on the website or in the apps, before it takes effect, and we will ask for your consent again where the law requires it.

17. Contact us

Tarfion Ltd, Griva Digeni 59, Kaimakliotis Building, 5th Floor, 6043 Larnaca, Cyprus. Email: [email protected].