Privacy Policy

Last updated: October 9, 2026.

1. Overview

Sybo.ai ("Sybo", "we", "us") is an AI conversation app. You can talk to AI companions and Topic Agents by text, by voice, and through live video avatars. This policy explains what data we collect, how we use it, who we share it with, how long we keep it, and the choices you have. It covers the Sybo.ai iOS and Android apps, sybo.ai, app.sybo.ai, and related services.

Three features involve sensitive data about you. All three are optional, and each one needs your separate consent in the app:

Voice cloning: we build a private voice model from a recording of your voice.
Personal avatar ("AI Twin"): we build an avatar from a photo you upload.
Avatar video: live, AI-generated video of your avatar speaking.

You can delete a cloned voice, an avatar, or your whole account at any time.

2. Data we collect

We collect the following kinds of data.

Information you give us

Account details. Your name, your email address or phone number, and your profile photo. If you sign in with Apple, Google or Facebook, we also get your account ID from that service. If you use Sybo as a guest, we give you a temporary ID.
Conversations. The messages you send, the audio of your voice and avatar sessions, the Topic Agent you talked to, any messages you report, and transcripts you save.
Files. Documents and images you attach in chat, up to 25 MB each. Supported types are PDF, DOCX, XLSX, CSV, TXT, Markdown, PNG, JPEG and WebP.
Voice data, only if you clone a voice. The recording you make (about 30 seconds) or the audio file you upload (m4a, mp4, aac, mp3 or wav). Also the voice model we build from it, and the name, gender and language you give the voice.
Facial data, only if you create a personal avatar. The photos you upload, the avatar we build from them, and the results of our safety checks on each photo.
Consent records. The confirmations you tick before we clone a voice or create an avatar, which version of the consent you agreed to, and when.
Support messages. Anything you send our support team, including attachments.

Information created as you use Sybo

Memory. If Memory is on, notes Sybo learns from your conversations, such as your preferred language and tone and the topics you talk about most.
Generated content. Avatars made from a text description, avatar intro videos, and images and documents Sybo creates for you.
Purchases and credits. Your plan, subscription status, purchase and renewal history, invoices, top-ups, and your credit balance and how you use it. We get purchase records from Apple, Google and Stripe. We never see your full card number.

Information from your device

Device and technical data. Device ID, push notification token, device model, operating system and app version, language, time zone, country, screen size, IP address, crash logs, and app integrity tokens (Firebase App Check).
Location. Your device's location (latitude and longitude at reduced accuracy), only if you allow location access. The app sends it to our servers with its requests so we can personalise your experience and content. Sybo works without it, and you can turn it off at any time in your device settings.
Usage and analytics. The screens you view, the features you use, session length, app events, how you found Sybo (campaign links and install attribution), and recordings of how you move through the app (session replays).
Advertising identifiers. Apple's advertising ID (IDFA), only if you allow tracking, and the Android advertising ID.

We ask for device permissions only when a feature needs them: microphone (voice and avatar sessions, dictation, voice cloning), camera (profile photo only), photos (profile photo, avatar photo, saving media), location, notifications, and tracking on iOS. You can withdraw any permission in your device settings. Sybo does not use your camera during avatar sessions, and we do not access your contacts.

3. Voice and voice cloning

Live voice and avatar sessions. When you talk to Sybo, your audio is streamed in real time through LiveKit to our AI agents. They turn your speech into text and reply with a spoken response. We keep the conversation transcript in your history. We do not keep the raw audio of the session after it ends.

Dictation. When you use the microphone button to dictate a message, a short audio clip is sent from your device to OpenAI's speech-to-text service (Whisper), which returns the text. Under OpenAI's API terms, OpenAI does not use this audio to train its models and may keep it for up to 30 days to monitor for abuse.

Voice cloning (optional). You can record a sample of about 30 seconds in the app or upload an audio file. We use it to build a private voice model, so your avatar can speak in that voice in voice and avatar sessions.

We build a voice model only after you tick the consent box on the voice-cloning screen. We record which version of the consent you agreed to.
You may clone only your own voice, or a voice you have clear permission to use. You may not clone the voice of a child, a celebrity or public figure, or anyone who has not agreed.
Your voice model is linked to your account. It is not shown to other users and is not added to any public library. We do not use it to train general AI models.
The sample is processed by our voice-synthesis provider to create and run the model. That provider may not use it for any other purpose.
You can delete a cloned voice at any time from the avatar screen. When you do, we delete the voice model at our voice provider straight away, and remove the original sample from our systems within 30 days. Backup copies are overwritten within a further 30 days.

In some places, such as Illinois, Texas, Washington and the EU, a voice model may count as biometric data. Where that applies, your consent on the voice-cloning screen is your written consent. We keep the voice model only until you delete it or your account. In any case we delete it within 3 years of your last use of Sybo.

4. Avatars and facial data

You can choose a ready-made avatar from our library, create one from a text description, or build a personal avatar from your photo. Only the photo option involves data about your face.

Avatars from a text description. Your description is checked for safety and then sent to OpenAI's image model to create a portrait. Prompts must describe a fictional adult. A generated avatar is not a real person's face, and we treat it as ordinary content. Each account can make a limited number of generations.

Personal avatar from a photo (optional).

Consent first. You must tick the consent box on the avatar screen before we process a photo. We record which version of the consent you agreed to.
Safety checks. We check each photo automatically before we use it. The checks look for a clear face, explicit or harmful content, image quality, and whether the photo appears to show a well-known public figure. If a photo fails, we tell you why and do not use it to create an avatar. We use these checks only to prevent misuse, never to identify you.
Your face, or one you may use. Upload only your own photo or one you have permission to use. Never upload a photo of a child.
Purpose limit. We use your photo and avatar only to show and animate your companion for you. We do not use them for identification, surveillance or advertising, and we do not use them to train general AI models.
No sale. We do not sell facial data. We share it only with the providers that create and stream your avatar (see section 8).
Deletion. Delete an avatar in the app and we remove the photo, the avatar and any videos made from it from our systems within 30 days.

Where facial geometry counts as biometric data, your consent on the avatar screen is your written consent. We keep it only until you delete the avatar or your account. In any case we delete it within 3 years of your last use of Sybo.

5. Avatar video

Avatar sessions are live video calls. Our provider generates the avatar's video frame by frame and streams it to your device through LiveKit. Your camera is not used.

Live sessions are not recorded. The video stream exists only during the session. We do not record it, and our providers do not keep it after the session ends. We keep the text transcript and session details (length, mode and credits used).
Intro and share videos. When you create an avatar, we may generate a short intro video. If you share it, we create a signed link that anyone who has it can open until it expires. We store these videos until you delete the avatar or your account.
Saved media. Videos and images you save to your phone or share outside Sybo are outside our control. Deleting them in Sybo does not remove copies others already have.

6. Topic Agents, Memory and files

Topic Agents. Topic Agents are AI personas that Sybo provides, each focused on a subject such as health, finance or law. You need to sign in to use them. An agent may search the web to answer you. When it does, it sends a search query based on your question to a search provider, not your account details. An agent may also hand your conversation to another agent that fits the topic better.

Memory. When Memory is on, Sybo saves short notes from your conversations, such as your preferred language, tone and frequent topics, so replies fit you better. In Settings › Memory you can see each item, remove one, clear them all, or turn Memory off. Guest accounts do not have Memory.

Files and Storage. Files you attach in chat go to our AI agent to read, summarise or answer questions about. Files Sybo creates for you, such as images and documents, are saved in Storage. You can preview, download or delete any item, or clear all of them. Storage space and document processing depend on your plan and credits.

Reports. If you report a message, we review it together with the conversation around it to improve safety.

7. How we use data, and our legal bases

If you are in the EEA, the UK or Switzerland, data protection law requires us to have a legal basis for each use. Below, each legal basis is followed by the uses that rely on it.

To provide the service you signed up for (contract)

Running conversations in text, voice and avatar modes, including Topic Agents and file tools.
Creating your account, signing you in, and supporting guest accounts.
Handling payments, subscriptions, credits and invoices.
Sending service messages and push notifications about your account.

With your consent (you can withdraw it at any time)

Building and using your cloned voice and personal avatar. This is explicit consent, given on the consent screen for each feature.
Personalising replies with Memory. You can turn Memory off at any time.
Analytics, session replay, install attribution and advertising measurement, where the law requires consent. On iOS you can also control this through the tracking prompt.
Marketing notifications.

For our legitimate interests

Keeping Sybo and other people safe. This covers safety checks on content, preventing fraud and impersonation, reviewing reports, and checking app integrity.
Diagnosing crashes and improving features.
Analytics, where consent is not required by law.
Enforcing our Terms.

To meet legal obligations

Keeping tax and accounting records.
Responding to lawful requests from authorities.

What we don't do: we do not sell your personal data. We do not use your conversations, voice model, photos or avatar to train general AI models. We do not make decisions with legal or similarly significant effects about you based only on automated processing. The one exception is the automatic safety checks on avatar photos, and you can ask for a person to review a rejection.

We share only the data each provider needs. Each provider works under a written contract.

Infrastructure and real-time media

Cloud hosting providers, including Amazon Web Services (AWS). Our servers, databases and file storage run with cloud hosting providers, and videos are delivered through Amazon CloudFront. These providers hold the data stored in your account.
LiveKit. Carries live audio, avatar video and chat attachments during voice and avatar sessions.
Google Firebase. Provides analytics, crash reports (Crashlytics), push notifications (Cloud Messaging) and app integrity checks (App Check). It receives device and usage data, crash logs with your user ID, name and email, and your push token.

AI providers

OpenAI. Provides dictation (Whisper), safety checks on avatar descriptions (GPT-4o mini) and avatar image generation (GPT Image). It receives dictation audio and avatar descriptions.
Voice synthesis provider. Builds and runs cloned voices and turns reply text into speech. It receives voice samples, voice models and reply text.
Avatar video provider. Builds personal avatars and renders avatar video in real time. It receives avatar photos, avatar models and reply audio.
Image safety provider. Checks uploaded avatar photos for a clear face, explicit content and public figures. It receives the photos you upload.
Web search provider. Runs web searches for Topic Agents. It receives the search query only, not your account details.

Sign-in and payments

Apple, Google and Meta (Facebook). Handle sign-in. We exchange your sign-in ID, name, email and profile photo with them.
Apple App Store and Google Play. Handle in-app purchases and subscriptions. They hold the purchase records.
Stripe. Processes card payments on Android. You enter your card details straight into Stripe, which acts as an independent controller for them. Stripe also receives your billing email and purchase amounts.

Analytics and advertising

AppsFlyer. Measures which campaigns lead to installs and handles deep links. It receives device and advertising IDs, app events, your user ID and a hashed version of your email.
Meta (Facebook) App Events. Measures our ads and where users come from. It receives device and advertising IDs, app events and purchases.
Smartlook. Provides product analytics and session replay, which we use to find bugs and improve the app. It receives recordings of how you move through the app's screens, app events, and your name, email and user ID.

We may also share data:

when the law requires it;
to protect people, or to enforce our Terms (for example, when someone reports that their face or voice was misused);
in a merger or acquisition, in which case we will tell you before your data falls under a different policy.

California (CCPA/CPRA). We do not sell personal data. Using Meta App Events and AppsFlyer for cross-app advertising may count as "sharing" under California law. You can opt out by declining tracking on iOS, resetting or deleting your advertising ID on Android, or emailing privacy@sybo.ai.

9. Storage, retention and transfers

Your data is stored on servers run by our cloud hosting providers, including Amazon Web Services and Google Firebase. These servers may be in the United States or other countries. Data is encrypted in transit (TLS) and at rest. Voice models and avatars are kept in access-controlled storage linked to your account.

We keep your data only as long as we need it.

Until you delete it (or close your account)

Account details, while your account is open.
Conversations and transcripts, until you delete the conversation.
Memory, until you remove items, clear Memory, or turn it off and clear it.
Files in Storage, until you delete them.
Voice samples and voice models, until you delete the voice. We delete them in any case 3 years after your last use of Sybo.
Avatar photos, avatars and intro videos, until you delete the avatar. We delete them in any case 3 years after your last use of Sybo.

For a fixed period

Analytics, attribution and session replays: up to 14 months.
Campaign (UTM) data stored on your device: 30 days.
Backups: overwritten within 30 days.
Consent records: as long as the law requires us to prove consent, typically 3 years after deletion.
Purchase and invoice records: as long as tax law requires, typically 7 years.

Not kept at all

Live audio and video from voice and avatar sessions. These are processed in real time and are not recorded.

When you delete your account, we remove your data from our live systems within 30 days. Backups are overwritten within a further 30 days.

International transfers. We and our providers may process data outside your country, including in the United States. Where the law requires it, we use Standard Contractual Clauses, the UK Addendum, or another approved transfer safeguard.

10. Your choices and rights

In the app you can:

delete individual conversations;
view, remove or clear Memory, or turn it off;
delete files in Storage, or clear all of them;
delete a cloned voice or an avatar;
change permissions (microphone, photos, location, notifications, tracking) in your device settings;
delete your account in Settings › Delete Account.

Deleting your account does not cancel a subscription you bought through Apple, Google or Stripe. Cancel it first, as explained in our Terms.

Your legal rights. Depending on where you live, you may have the right to:

access your data, correct it, or get a copy (export);
delete it, or restrict how we use it;
object to certain processing;
withdraw consent at any time (including for voice cloning, facial data, Memory and tracking), without affecting processing before you withdrew it;
complain to your data protection authority.

California residents can also ask what categories of data we collect and opt out of "sharing". We will not treat you differently for using these rights. Email privacy@sybo.ai from your account email. We will reply within the time the law requires, usually 30 or 45 days.

11. Security

We protect your data with:

TLS encryption in transit and encryption at rest;
Firebase App Check, which helps make sure requests come from the genuine Sybo app;
token-based authentication;
access controls that limit which staff can see voice and facial data.

No system is completely secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires.

12. Children

Sybo is for people aged 18 and over. We do not knowingly collect data from children. Never use a child's photo or voice to create an avatar or a voice clone. If you think a child has given us data, email privacy@sybo.ai and we will delete it.

13. Changes to this policy

We will update this policy as Sybo changes. If a change is significant, we will tell you in the app or by email before it takes effect. Where the law requires, we will ask for your consent again.

14. Contact

For privacy questions, or to use any of your rights, email privacy@sybo.ai. For legal matters, email legal@sybo.ai. For help with the app, email support@sybo.ai.