Ania Privacy Policy

Ania is a family assistant for technology and digital safety. Your family's information is stored on Ania's hosted server. Each family can access only its own account and records; this is an online service, not a separate physical server for each family. This policy describes what is stored, how it is used, and who can see it.

What we collect

• The messages, links, phone numbers, and screenshots you send to Ania for checking. They are stored so you can see your history and the service can work across visits. Text and other data may be processed by the service's hosting, email, SMS, or AI providers as described in this policy.
• The phone number your family organizer entered for you, which may be used for Ania service messages when SMS is available and the recipient has given the required permission.
• Basic household setup (names, roles, privacy choices) entered by your organizer.

What we never do

• We never sell or share your data with third parties for advertising or marketing. Ania does use service providers to host the service, deliver email and text messages, and—when enabled for your plan—analyze messages with AI. Those providers process information to provide services to Ania. The product does not use advertising or analytics trackers.
• SMS opt-in data and consent records are not shared with any third party for marketing. Twilio processes phone numbers and message content to deliver service messages. Ania keeps an append-only consent record for each phone number: the current state (asked, agreed, or stopped), a timestamp for every change, how it was captured (the member's own checkbox, a YES reply to Ania, the family portal, or a guardian's recorded attestation for another person's number), the scope agreed (safety alerts, weekly summaries, and follow-ups — never marketing), and the exact disclosure text shown at the time. Ania-initiated texts go only to numbers whose latest recorded state is agreed; a number still in the asked state receives at most the confirmation ask, never message content. Phone-number entry by an organizer is not consent and records nothing. Consent records are kept as the evidence of what was agreed, and are removed with the household's records when the household is deleted. The approved disclosure text ships as version sms-consent-v1. Rows recorded under the earlier draft version (sms-consent-draft.1) keep their recorded history, and the review's recorded ruling governs whether those numbers are re-asked under the shipped text.
• If an AI provider is enabled for your plan, message text and screenshots may be sent to Claude (by Anthropic) or GPT (by OpenAI) to analyze them — never both at once. If AI analysis is unavailable, Ania uses its non-AI checks instead. Other providers may still process information to host the service or deliver email and SMS. Messages sent through these AI APIs are not used to train models under the providers' applicable API terms.

Who can see what

Member and guardian history access described here is the current portal behavior. Privacy settings, retention, and product features may change; this policy will be updated when that behavior changes.

• You can read your own full conversation history when signed in to your member account.
• Your privacy dial controls which event summaries a signed-in household guardian sees: Private shares no events, Suspicious shares non-safe events, and Share all shares all event summaries. A signed-in household guardian can open that member's history page regardless of the dial, but the rows it shows are the event summaries above — Private shows none. Guardian history responses include event fields such as the headline, kind, mode, verdict, and date, but omit the stored submitted-message text and full assistant replies or analysis details. Separately from event summaries, a signed-in guardian can see how many questions each member has asked (counted by kind) whenever the dial is not on Private — a member on Private shares no counts either — and never what those questions were. Other household members do not receive another member's history. A configured operator API token can access full history, including submitted-message text. The portal also keeps an append-only record of who has viewed a member's activity summaries; the family can see these records, and members can see who has viewed their own. Do not use Ania for conversations you expect to be hidden from your household guardian or service operator.
• Incident and alert records can include a screenshot thumbnail. Thumbnails are removed from the active incident or alert when it is resolved or handled, but existing service backups may retain earlier copies until those backups are pruned. Rotating service backups default to at most seven snapshots and a 30-day expiry threshold; operators can configure both limits. Expired copies are pruned at service boot, daily while the service runs, and after a snapshot request against a non-empty store, even when its content is unchanged. A daily sweep can leave an expired copy until the next sweep; if the service is stopped, pruning waits until it starts again. New snapshots are created at service boot or on operator request. Separate pre-migration recovery snapshots may also contain earlier copies and have no fixed expiry. Deleting active records, a login account, or a family does not immediately erase backup copies. Contact hello@getania.com with backup-erasure questions.

SMS program details

• Message frequency varies. Most replies are responses to messages you send; recurring texts are at most one weekly summary and occasional safety alerts.
• Message and data rates may apply.
• Reply STOP to stop receiving texts from Ania at any time. Reply HELP for help.
• Your carrier's standard messaging rates apply to both inbound and outbound messages.

Deleting your data

• Your organizer can delete your member record, which removes associated messages, incidents, alerts, and phone number from the active service store. Account credentials are separate: account deletion and household deletion are separate actions. Existing rotating service backups may retain copies until pruned under the configurable limits and sweep timing described above (defaults: seven snapshots and a 30-day expiry threshold), and separate pre-migration recovery snapshots may have no fixed expiry.
• Message history is retained for 90 days by an automatic sweep; incident records are kept 30 days after resolution.
• Your organizer can delete the household's records from the active service store. This does not necessarily delete login accounts linked to the household, and existing rotating backups may retain copies until pruned under the configurable limits and sweep timing described above (defaults: seven snapshots and a 30-day expiry threshold); separate pre-migration recovery snapshots may have no fixed expiry.

Contact

• Questions about this policy: contact your family organizer first, or email hello@getania.com.
• Security issues: /.well-known/security.txt (RFC 9116). We treat security reports as confidential and give them priority over feature work.