Effective November 6, 2026. Hibira, the trade name of an individual business operator (sole trader) based in Taiwan ("Hibira", "we"; the operator's name is given without delay on request), runs Gaya (gaya.hibira.io, its apps and its MCP server) and is responsible for the personal data described here.
1. What we collect and why
| Data | Where it comes from | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| Email, name, profile picture, language, and the account ID of the Google, GitHub or Apple account you sign in with | You, or the sign-in provider with your permission | Create your account, sign you in, emails | Contract | While the account is open |
| Session cookie (we store only a hash of it) and one-time sign-in links | Set when you sign in | Keep you signed in | Contract, legitimate interest (security) | Sessions 30 days; links 15 minutes |
| The date you confirmed you are 18 or older | You | Keep Gaya for adults | Legal obligation, legitimate interest | While the account is open |
| Rooms: questions, messages, edits, reactions, polls, verdicts, the cast, room settings, who is in the room and their display names | You and the people in your rooms | Run the discussion and show it to the people who can read the room | Contract | Until the host deletes the room or the message is removed, or the host's account is deleted |
| Photos and videos you post, and still frames taken from videos in your browser | You | Show them in the room and let the personas see them | Contract | As for the room's messages |
| Persona notes: short lines the personas write about the host from the host's own messages | Your messages | Let personas remember you in your next room | Contract | Until you delete them on the Memory page or turn memory off |
| Your memory: what you import from other AI assistants, and the lines you save | You | Give personas your background | Consent, contract | The import is sent to the model to sum up and not kept; saved lines until you delete them |
| Your own personas and their photos, and for shared personas who added a copy | You | Use them in rooms, and show shared personas to others | Contract | Until you delete them; rooms and copies others added keep theirs |
| Voice input: the recording of what you say to Gaya | Your microphone, only when you press the mic button | Turn your words into text | Contract | Turned into text at once and not kept |
| That's What They Said: the chat or screenshots you upload, with names, phone numbers and emails masked, and the report | You | Write the report you asked for | Contract | Deleted 30 days after upload, at once when you delete the report, or with your account |
| Connected tools: the server address, tool names and an encrypted access token | You, and the tool's sign-in | Let personas call the tools you chose | Contract | Until you disconnect the tool |
| Assistants you connect to Gaya's MCP server: app name and hashed tokens | You and the assistant | Let your assistant use Gaya for you | Contract | Until you revoke them; refresh tokens last 60 days |
| Plan, Creem customer and subscription IDs, payments, receipts and your AI reply history | Creem and you | Billing, AI reply balance, support | Contract, legal obligation | While the account is open, then as long as tax and accounting law requires |
| Card details and billing address | You, directly to Creem | Payment | Contract | Held by Creem; we never see or store full card numbers |
| Notification settings, the push subscription linked to your account, and when you were last in a room | Your browser or app, only if you turn notifications on | Tell you about replies while you are away | Consent | Until you turn notifications off or delete the account |
| Reports and moderation: the report, a copy of the reported message, the decision | People who report, our moderators | Keep rooms safe, handle abuse | Legitimate interest, legal obligation | As long as needed to handle the report and to deal with repeat abuse |
| Results of the automatic photo check | Amazon Nova | Refuse illegal or harmful pictures before they are stored | Legitimate interest, legal obligation | Refused pictures are not kept; the check result is logged |
| IP address, country, browser and device, request logs, bot check | Your requests, Cloudflare and Turnstile | Security, rate limiting, choosing an AI model that may lawfully serve your region | Legitimate interest | Short-lived logs and counters |
| Sign-up checks: a keyed hash of the network address and of a browser cookie (gaya_device) you signed up from, and a keyed hash of a deleted account's email | Your browser when you sign in | Stop the same person collecting the free AI replies again with more accounts | Legitimate interest | Up to 3 years, also after the account is deleted; we never keep the address or cookie itself |
| Pages you visit, how you got there, device and approximate location, and a random browser ID (only with Google Analytics on, section 8) | Your browser, through Google Analytics | Learn which pages help people and improve Gaya | Consent where your region requires it, otherwise legitimate interest | Up to 14 months in Google Analytics |
| Emails we send (recipient, template, time, status) and support emails | Our email system and you | Deliver email, answer you | Contract, legitimate interest | Up to 2 years |
| Support chat: your messages with our support team | You, our support team | Answer you | Contract, legitimate interest | Signed-in users up to 2 years; chats started before sign-in 180 days |
We do not sell personal data, use it for advertising or profiling, use your content to train AI models, or make decisions about you with legal or similarly significant effects by automated means. Gaya has no advertising cookies, and uses analytics cookies only as section 8 describes.
When you sign in with Google, Apple or GitHub, we ask only for your account ID, verified email and name (and profile picture where offered). We do not keep their access tokens or read any other data. Gaya's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
2. Other people's data in rooms and imports
Messages, photos and imported chats can contain information about other people. You decide what to post or import, and you are responsible for having the right to share it (Terms section 5). We process it only to run Gaya for you, we keep only what Gaya needs as described in section 1, and an import is summed up into a few lines that you review before anything is saved. The same applies to group chats uploaded to That's What They Said: they are masked before they are stored or read by a model, used only for that one report and deleted after 30 days. If you appear in someone else's room, import or uploaded chat and want something removed, write to privacy@hibira.io.
3. Who can see your content
- People in a room see its messages and the members' display names. To reply, personas see the room's messages and the host's notes and memory, so in a room with other people, what personas say may draw on the host's notes and memory where everyone in the room can read it. Turn memory off for a room if you do not want that.
- If the host shares a room by link, anyone with the link can read it without signing in; if the host lists it on Explore, anyone can find it and search engines may index it. People appear there by first name only; no email or account ID is shown.
- Our moderators see reported messages and rooms. We do not otherwise read private rooms, except where needed to fix a problem you report, to investigate abuse, or where the law requires.
4. Who we share data with
We share personal data only with the providers below, who act on our instructions, with the people you choose to share rooms with, and with authorities where the law requires.
| Recipient | What they do | Data | Where |
|---|---|---|---|
| Cloudflare | Hosting (Workers, D1 database, R2 file storage), DNS, network protection, bot check (Turnstile), turning voice input into text (Workers AI) | All Gaya data, voice recordings | Cloudflare's global network |
| Amazon Web Services: Amazon Bedrock | Runs the AI models (Claude from Anthropic, Amazon Nova) that write replies and check photos. The model makers do not receive your data, and it is not used for training | Room messages, photos and frames, notes, memory, tool results | Japan (Tokyo) |
| Amazon Web Services: Amazon SES | Sends email | Email address, message content | Singapore |
| Hibira realtime and Hibira Push (our own service) | Delivers room messages live and push notifications | Room events, your account ID for notifications | Hong Kong (AWS) |
| Creem (Armitage Labs OÜ) | Our merchant of record: sells you plans, packs and reports, and handles payments, receipts, subscriptions, refunds and sales tax. Creem also acts as a separate controller under its own privacy policy | Email, name, country, payment details, amounts | Estonia and Creem's payment partners |
| Google, GitHub, Apple | Sign-in, if you choose them | Account ID, email, name | United States |
| Google (Google Analytics) | Counts visits and shows which pages help, only as section 8 describes | Pages visited, device, approximate location, a random browser ID | United States and other Google locations |
| Your browser's or phone's push service (for example Google, Mozilla, Apple) | Delivers notifications, only if you turn them on | Push address, notification content | Usually the United States |
| Web search providers (Brave Search, Tavily, Parallel or Perplexity) | Web search and deep search for personas, when turned on | The search words a persona chooses, and pages it asks to read | United States and other locations |
| Tools you connect (for example GitHub or Notion) | Answer the personas' tool calls | What the persona asks the tool | Where that service runs |
| An email provider we may switch to (Resend or Google Workspace) | Sends email instead of Amazon SES | Email address, message content | United States |
If you use Gaya from an AI assistant through our MCP server, what you send and receive there is also handled by that assistant's provider under its own terms. If Gaya is transferred to a successor, data may pass to it, and it must honor this policy.
5. International transfers
We are based in Taiwan. Gaya runs on Cloudflare's global network, AI models run in Japan, email is sent from Singapore and realtime delivery runs in Hong Kong, so your data is processed outside the country you live in. We use providers that commit by contract to protect it at an equivalent level (for example with the EU Standard Contractual Clauses) and hold recognized security certifications.
6. Security
Traffic is encrypted with TLS. Sessions and access tokens are stored only as hashes, and secrets such as tool tokens are encrypted. Access to data is limited to the operator and people bound by confidentiality. No system is perfectly secure; if a breach is likely to harm you, we will tell you and the authorities as the law requires.
7. Your choices and rights
- On the Memory page you can see and delete persona notes and your memory; on your account page you can turn notifications off and disconnect tools; as host you can make rooms private or delete them.
- You can ask us for access to or a copy of your data, to correct or delete it, to stop or restrict our use of it, or to move it, and you can withdraw consent at any time. You can delete your account yourself on the account page (Delete account). Messages you wrote in other people's rooms stay in those rooms; privacy@hibira.io can remove them. Write to privacy@hibira.io for anything else. Deleted data leaves our backups within 30 days. We answer within 30 days, or sooner where the law requires, and may need to confirm it is you. We may keep what the law requires, such as payment records.
- You can complain to the data protection authority where you live.
8. Cookies and storage
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
gaya_session | Cookie, strictly necessary | Keeps you signed in | 30 days |
gaya_oauth | Cookie, strictly necessary | Protects sign-in with Google, GitHub or Apple | Minutes |
gaya_visitor | Cookie, strictly necessary | Keeps a support chat you started before signing in | 180 days |
| Language, theme, drafts, saved casts, read-aloud | Browser storage, strictly necessary | Remember your choices on this device | Until you clear the site's data |
| Turnstile | Strictly necessary | Bot check on email sign-in | Set by Cloudflare for the check |
_ga, _ga_<id> | Cookie, analytics (optional) | Google Analytics: count visits and see which pages help | Up to 2 years |
Analytics cookies are set only when you allow them or your region allows them by default: in the EEA, the UK, Switzerland, mainland China, Korea, Thailand and Vietnam (or if we cannot tell your country) only after you choose "Allow analytics"; in the United States until you turn them off, and a Global Privacy Control signal turns them off; elsewhere with a one-time notice. You can change your choice at any time with "Cookie settings" at the bottom of the page. We never allow advertising cookies or ad personalization.
When you have allowed analytics, we also keep the Google Analytics browser ID from those cookies on your account and send Google Analytics a few events that happen on our servers rather than in the page (signing up, a payment, cancelling a plan), so they count with your visit. We stop and forget the ID as soon as you turn analytics off. These events carry no name, email or payment details, and ad signals are always turned off.
9. Country-specific information
Taiwan (Personal Data Protection Act). Taiwan's Act is our home law; the collector is the individual business operator trading as Hibira. We collect identification data (C001), financial identification data (C002), personal descriptions (C011) and the content you choose to post, for the purposes of contract and similar relationships (069), consumer and customer management and service (090), information and communications services (135), information, communications and database management (136), online shopping and other e-commerce services (148) and statistics and research analysis (157). We use it for the periods in section 1, in the regions in sections 4 and 5, by the recipients listed there. Under Article 3 you may ask to review your data or get copies of it, to have it corrected, to stop its collection, processing or use, and to have it deleted. If you do not give the data marked as needed for an account, we cannot provide Gaya.
Japan (Act on the Protection of Personal Information). The business operator handling personal information is the individual business operator trading as Hibira, based in Taiwan; the operator's name and address are given without delay on request. We use personal information only for the purposes in section 1 and provide it to third parties only as section 4 describes or as the law permits. Recipients are in the countries in sections 4 and 5; we take security measures with their personal data protection systems in mind (information on them is on the Personal Information Protection Commission website), and on request we tell you about the measures each recipient takes. Requests for disclosure, correction, suspension of use, deletion or stopping provision to third parties, and complaints, go to privacy@hibira.io, free of charge. You may also contact the Personal Information Protection Commission (ppc.go.jp).
Korea (Personal Information Protection Act). Items: email, name, profile picture, service usage records, access logs, IP address, payment records, and content you post. Retention follows section 1; on expiry we destroy files so they cannot be recovered. Overseas transfers: recipients, countries, items and purposes are in section 4; data is transferred over the network when you use Gaya and kept for the periods in section 1. You may refuse, but then we cannot provide Gaya. Personal information protection officer: the operator of Hibira, privacy@hibira.io. You can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118).
Hong Kong (Personal Data (Privacy) Ordinance). For Hong Kong residents this policy is our Personal Information Collection Statement. You may request access to and correction of your data at privacy@hibira.io; we may charge a reasonable fee for access where the Ordinance allows. We do not use your data for direct marketing. The regulator is the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk).
Singapore (Personal Data Protection Act). Our Data Protection Officer is reachable at privacy@hibira.io. You may withdraw consent by notice, and we will tell you the likely consequences before acting on it.
Thailand (Personal Data Protection Act B.E. 2562). We process your data on the bases in section 1. It is transferred to the countries in sections 4 and 5 under contracts that require an adequate level of protection. You may request access, a copy, portability, correction, deletion, restriction or objection, and withdraw consent, at privacy@hibira.io. We notify the Office of the Personal Data Protection Committee of a breach within 72 hours where required, and you may complain to it (pdpc.or.th).
Vietnam (Law on Personal Data Protection No. 91/2025/QH15). We process your data for the purposes in section 1; consent to notifications and memory imports is asked for separately and can be withdrawn at any time. Your data is transferred abroad to the countries in sections 4 and 5 for those purposes. You may request access, a copy, correction, deletion, restriction or objection at privacy@hibira.io. We notify the competent authority of a breach within 72 hours, and you may complain to the personal data protection authority of the Ministry of Public Security (A05).
European Economic Area, United Kingdom and Switzerland (GDPR). The legal bases are in section 1. Where we rely on legitimate interests, you may object. You may complain to your local supervisory authority.
United States (California and other state privacy laws). We do not sell personal information or share it for cross-context behavioral advertising, and we use no advertising cookies. You can turn off analytics cookies with "Cookie settings" at the bottom of the page, and we honor Global Privacy Control signals. You may ask to know, correct or delete your personal information at privacy@hibira.io, and we will not treat you differently for doing so.
Mainland China, Hong Kong and Macau. Where the AI models from Anthropic are not offered, rooms with someone from there use Amazon Nova, run in Japan. Using Gaya means your data is processed outside your region as described in section 5.
10. Children
Gaya is only for people who are 18 or older. If we learn that an account belongs to someone younger, we close it and delete its data.
11. Changes
We publish changes here with a new effective date, and tell you by email or in Gaya at least 30 days before material changes apply.
12. Contact
privacy@hibira.io · Hibira, Taiwan. The operator's name and address are given without delay on request.