AsanaAI Android application
Privacy Policy
This policy describes the data handling that is implemented in AsanaAI. It replaces broad statements in the previous policy that did not match the application.
1. Scope
This policy applies to the AsanaAI Android app, the AsanaAI gateway and these public privacy pages. A link that opens another app or the open web, such as Google Forms, Telegram or Instagram, is governed by that service's own policy.
2. Data we process
| Category | Examples | Purpose |
|---|---|---|
| Account and profile | Firebase user ID, name, email address, sign-in provider, email verification state, language, consent version, feature settings and request counters | Create and secure the account, sign you in, provide app features, enforce limits and process deletion |
| Photos and pose content | Photos captured or selected by you, video frames extracted on the device, custom pose names, reference pose images and pose-analysis results | Recognize and compare poses, return guidance and save custom poses when you ask |
| Voice recordings and transcripts | Short recordings used for voice controls and their transcriptions | Recognize commands such as taking a photo or stopping a session |
| App activity and diagnostics | Screen and feature interactions, analysis route and outcome, coarse timing and size metrics, app version, source commit, device model, Firebase app instance or installation ID, crash logs and error classes | Operate the app, prevent abuse, diagnose failures and improve reliability and performance |
| Support correspondence | The email and information you choose to send to support | Answer your request and, when requested, verify an external account-deletion request |
AsanaAI requests camera and microphone access only for capture and voice-control features. Media is processed only after you choose or capture it. The app does not request Android location or contacts permissions.
3. Where data is processed
- Google Firebase and Google Cloud: authentication, App Check, Firestore, object storage, Remote Config, Analytics and Crashlytics.
- OpenAI API: pose images or extracted video frames, generated instructions, voice recordings for transcription and generated responses. Image Responses requests use
store:false. Files created for video analysis are configured to expire after six hours and are also deleted when the associated account is deleted. - AsanaAI gateway: authenticated app requests, short-lived processing and diagnostic records in MongoDB and GridFS.
These providers may process data in countries other than yours. We send only the data needed for the selected feature and use encrypted HTTPS connections in transit.
Provider details: Firebase privacy and security, Google Cloud privacy, and OpenAI API data controls.
4. Retention
| Data | Retention |
|---|---|
| Account, profile and custom poses | Until you delete the item or your account, unless a shorter operational limit applies |
| Private analysis input, frames and result files on the device | Expired automatically after 24 hours; cleared after an accepted account-deletion request |
| Diagnostic copies of AI requests, responses, images, audio and transcriptions in AsanaAI-controlled storage | No more than 30 days |
| OpenAI Files created for video analysis | Configured for six-hour expiry and deleted earlier when practical or on account deletion |
| OpenAI provider records | Endpoint-specific. Responses with store:false do not retain application state, except background processing may keep it for roughly 10 minutes. OpenAI may retain abuse-monitoring logs for up to 30 days. Its current table lists no application-state or abuse-log retention for audio transcription. Rare safety-review or legal exceptions may apply. |
| Deletion work identifiers | UID and normalized email are encrypted with AES-256-GCM, removed on completion and never kept more than 63 days |
| Deletion fence, HMAC tombstone and technical result | 30 days after completion, without raw UID, email, media or content |
| Public deletion receipt | 70 days from the request; it contains only a random request ID, safe status and dates |
If you explicitly save a photo or result to the shared device gallery, that exported copy is controlled by your photo library and is not removed by clearing AsanaAI's private app storage.
5. Account and data deletion
You can start deletion in Profile - Delete your account. The app requires recent reauthentication and an irreversible confirmation. It does not sign you out or clear local data until the server accepts the request.
You can also request deletion without the app by following the account-deletion instructions. The request must be sent from the email address connected to the account and is verified with a one-time challenge valid for 24 hours.
AsanaAI aims to purge its first-party storage within seven days. Provider deletion is requested after the first-party purge and verification. Crashlytics says user reports are typically removed within 24 hours after its request. Google Analytics deletion processing can take up to 63 days, so the external completion deadline is 63 days.
6. Security and privacy controls
- Firebase ID tokens and App Check protect Android gateway requests.
- A deletion fence blocks old tokens, server writers and importers from recreating user data after acceptance.
- Deletion identifiers are encrypted at rest; public status tokens are stored only as hashes.
- Telemetry uses a lowercase SHA-256 representation of the Firebase UID instead of the raw UID.
- These privacy and status pages use no analytics, advertising, cookies or third-party scripts.
7. Your choices
You choose whether to capture or select photos, record voice commands, save custom poses, export results to the gallery, or contact support. You can delete individual custom poses in the app. You can delete the entire account and associated data through the app or the external process.
8. Data we do not collect for AsanaAI
AsanaAI does not request precise or approximate location, address-book contacts, passport or national ID details, bank account or payment-card data. It has no Facebook, Instagram, X/Twitter or LinkedIn authentication. It contains no advertising SDK and does not use data for targeted advertising.
9. Changes and contact
We may update this policy when application behavior or providers change. The effective date above identifies the current version. For privacy questions, correction requests or deletion help, email [email protected].