Privacy Policy
Effective date
October 16, 2026
Cross-border processing: OpenAI
App generation and editing requests go first to the API of OpenAI, L.L.C. (United States). BYVE's servers send the request you enter and, for edits, the current app code over HTTPS to generate AI results, and may use OpenAI's web search with search terms taken from your request for design reference. Retention and specific processing conditions follow OpenAI's API terms and data processing terms, separately from BYVE retention. Do not enter personal or sensitive information. Reference: https://openai.com/policies/privacy-policy.
Cross-border processing: Alibaba Cloud Model Studio (Qwen)
Alibaba Cloud Model Studio (Qwen) is a fallback provider. If the providers before it cannot respond, app generation and editing requests go to its international endpoint dashscope-intl.aliyuncs.com (Singapore service scope). BYVE sends request content and, for edits, current app code over HTTPS to generate AI results. Retention and specific processing and transfer conditions follow applicable service terms and account settings, separately from BYVE retention. The endpoint alone does not guarantee all processing and storage stays in one country. Do not enter personal or sensitive information. Privacy contact: DPO_Intl@alibabacloud.com. Reference: https://www.alibabacloud.com/help/en/model-studio/privacy-notice.
Information we process
We process the content you enter when generating or editing an app and the current app, a random installation identifier, generation request status and token ledger, recovery copies of completed results, IP-based keys for rate limiting and abuse prevention, optional content reports, notification tokens and notification consent records. If you allow an online information feature in a generated app, we also process inputs needed for that feature, such as search terms, location or currency codes. Depending on your consent and regional settings, Google AdMob may process approximate location inferred from your IP address, advertising and device identifiers, app interactions such as launches, taps and ad views, and diagnostic information. In release builds, Firebase Crashlytics processes crash stacks, related app state, device metadata and a random installation identifier when the app crashes. If you allow a generated app's online features (map search and directions, weather), the needed inputs such as search terms or location are sent through BYVE's servers to Google Maps (places and routes) and the Norwegian Meteorological Institute (MET Norway, weather). Locations used for weather are sent with no more than four decimal places. The iOS app processes the same information and, like the Android app, registers its notification token (notification registration ID) with Firebase Cloud Messaging; notifications are delivered through the Apple Push Notification service (APNs). On iOS, the random installation identifier is stored in the device Keychain, so it stays the same on that device even if you delete and reinstall the app, but it does not move to another device. On iOS, Google AdMob processes the advertising identifier (IDFA) only if you allow it through App Tracking Transparency (ATT).
Device identifiers and integrity checks
To prevent repeated free-token grants through reinstallation, the app combines an Android device identifier (ANDROID_ID) with an app-specific value, hashes it with SHA-256 and sends the hash to the server. We do not store the original identifier; the hash is used to record the initial free-token grant per device. App generation, token checks and ad-reward requests also use Google Play Integrity API to check the authenticity of the app and device. Google processes app and device information for these checks. Our server uses the verification result without separately retaining it. The iOS app does not use Android device identifiers or Play Integrity. Instead, for requests such as app generation, token checks and ad rewards, Apple App Attest checks that the request comes from the genuine BYVE app on the device, and our server keeps the per-device public key and signature counter needed for this check together with the installation identifier. To grant the initial free tokens only once per device, we may use Apple DeviceCheck; in that case whether the grant was made is recorded as two flag bits that Apple keeps for each device, and they remain with Apple even after the app is deleted or the device is erased. BYVE does not receive hardware identifiers of the device in this process, and Apple processes app and device information for these checks.
Purposes
We use this information to generate and edit AI apps, retrieve online information you have allowed, manage tokens and prevent abuse, respond to errors, deliver notifications you have chosen, provide advertising and keep the service safe. The notification token is registered regardless of your notification setting so the device list stays accurate and removed devices can be cleaned up; notifications are only sent when you have agreed to them. To show notices and update messages in a suitable language, we use your app language setting and the country estimated from your IP address; these values are not stored.
Third-party processing
App generation and editing requests are sent through BYVE's Cloudflare backend to external AI services. The current processing order is OpenAI, then DeepSeek, Alibaba Cloud Model Studio Qwen and Z.ai GLM. We send the generation or editing request you enter; editing also includes the current app code. If a provider returns an error or is temporarily unavailable before it starts sending a result, the request automatically falls back to the next provider; depending on the app version or the country you connect from (for example, where OpenAI does not offer its API), a request may start at DeepSeek without going through OpenAI. When a fallback happens, the request content is delivered to that provider. Providers and processing order may change; updated recipients and processing conditions will be reflected in this policy, with notice and consent where required. If you allow a generated app to retrieve online information, the necessary inputs are sent through BYVE's backend to the approved information provider shown to you. Advertising uses Google AdMob, app stability diagnostics use Firebase Crashlytics, basic usage analytics use Firebase Analytics (GA4), and notification tokens are registered with Firebase Cloud Messaging regardless of your notification setting; notifications are only sent when you have agreed to them. Basic usage analytics are collected automatically without a separate setting, and custom analytics events never include prompt text, generated app code or notification titles or bodies. AI generation provider API keys are not included in the app. A Google Maps key restricted to BYVE's in-app map viewer (maps.byve.local) is included solely to display maps (Maps Embed and Maps JavaScript) inside generated apps, and it grants no access to other Google services or billing beyond map rendering. In the iOS app, basic usage analytics also use Firebase Analytics (GA4), configured not to collect the advertising identifier (IDFA) or the identifier for vendor (IDFV) and with ad personalization signals and ad network registration turned off; analytics data is not linked with other companies' data for tracking. Crash diagnostics in iOS release builds use Firebase Crashlytics, and advertising uses Google AdMob. Custom analytics events in the iOS app also never include the installation identifier.
Cross-border processing: Cloudflare
Our processor, Cloudflare, Inc. (United States and data centers worldwide; privacy contact: dpo@cloudflare.com), receives your inputs, the current app, installation and request identifiers, generated results and IP-based rate-limit keys over HTTPS when the app calls the BYVE API. It handles API forwarding, result recovery, storage, security and abuse prevention. Recovery copies of results are retained for up to 24 hours. Detailed generation request and token activity records are retained for 365 days before scheduled deletion. Minimal identifiers to prevent duplicate grants are retained separately from the details while the service operates; unsettled information is safely preserved until settlement is complete. IP-based rate-limit keys are retained for up to 2 days. Other processing follows our agreement with Cloudflare and applicable legal retention obligations.
Cross-border processing: Z.ai (GLM)
JINGSHENG HENGXING TECHNOLOGY PTE.LTD and its affiliates process request content and the current code of the app being edited, sent over HTTPS by BYVE's backend, to generate AI results. Z.ai API Services are governed by Z.ai's Terms, Additional Terms for API Services and Data Processing Addendum for API Services. Public policy text says API customer data is processed to provide and support the API Services, and return, deletion and cross-border transfer terms follow those agreements and account settings. Provider retention is separate from BYVE's own retention periods. Do not enter personal or sensitive information. Policy references: https://docs.z.ai/legal-agreement/privacy-policy and https://docs.z.ai/legal-agreement/terms-of-use.
Cross-border processing: DeepSeek
DeepSeek is the fallback provider after OpenAI. The following describes processing through that provider: BYVE sent request content and the current code of the app being edited over HTTPS to Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (China; api-service@deepseek.com) for AI generation and service safety processing. DeepSeek's public Privacy Policy specifies processing and storage in China (PRC). The particular use and retention conditions depend on applicable terms, agreements and account settings. That public policy alone does not guarantee a fixed retention period or no model-improvement use for BYVE requests. This BYVE policy describes the privacy rules for users of the BYVE app. Do not enter personal or sensitive information. Policy reference: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html (updated February 10, 2026).
Cross-border processing: Google
Google LLC and its affiliates (United States and data centers worldwide) process approximate location, advertising and device identifiers, app interactions and diagnostic information for ad display, rewards and consent handling. For crashes they process crash records and app, device and installation metadata through encrypted SDK communications; in release builds crash reporting is automatic and sanitized non-fatal diagnostics for failed push registration may also be sent. Basic usage analytics are processed automatically; the notification token is registered regardless of your notification setting so the device list stays accurate and removed devices can be cleaned up, and notifications are only sent when you have agreed to them. The installation identifiers and device or app metadata sent by the Firebase SDK are not anonymous. The purposes are advertising, analytics, abuse prevention, app stability and notification delivery. Under the public policy, deletion of Crashlytics data begins after 90 days. Other data follows Google's policies and your consent settings. For inquiries, use the privacy contact process at policies.google.com/privacy. In the iOS app, after Google's ad consent flow (UMP), we ask once for App Tracking Transparency (ATT) permission. If you allow it, Google AdMob receives the advertising identifier (IDFA) and may use it for personalized ads linked with information collected from other companies' apps and websites. If you do not allow it, the IDFA is not provided; ads are still shown in a less personalized form and ad rewards keep working. Even then, AdMob may process other device identifiers such as the identifier for vendor (IDFV), approximate location, ad interactions and diagnostic information.
Cross-border processing: Apple
Apple Inc. (United States and data centers worldwide) processes App Attest checks for the iOS app and, where used, DeviceCheck checks. On iOS, map display and place finding and routes inside maps in generated apps use Apple Maps, so map locations and place names are sent directly from your device to Apple. Other online information lookups are sent, as on Android, through BYVE's servers to the provider shown to you. Voice input in chat and in generated apps uses Apple speech recognition; it is processed on the device when possible, and for languages or devices without on-device recognition, audio may be sent to Apple's servers. Text recognition and translation (iOS 18 and later) in generated apps use Apple's on-device features and are not sent to BYVE's servers; translation language files are downloaded from Apple after the system asks you. Push notifications for the iOS app are passed from Firebase Cloud Messaging to the Apple Push Notification service (APNs), which delivers them to your device; for this, Apple processes the device's APNs token and the notification content, such as the title, body and link. Apple's processing follows Apple's Privacy Policy (https://www.apple.com/legal/privacy/).
Information kept on your device
Chats, generated apps, WebView localStorage, trash, run history and exported .byve files are stored on your device by default. Camera and microphone media used in generated apps are used on the device and are not automatically uploaded by BYVE's backend. Voice input in chat is handled by the speech-recognition service installed on your device; BYVE processes the recognized text only. When you submit it, the text is handled like any other generation request. Translation and text recognition in generated apps are processed on your device with Google ML Kit, and the text and images are not sent to BYVE's servers. Translation downloads a language model from Google the first time it is used, and ML Kit may process diagnostic information needed for the feature under Google's policies. On iOS, information stored on the device, such as chats and generated apps, may be included in iCloud or computer backups you have turned on; those backups follow Apple's policies and your settings and are not sent to BYVE's servers. On iOS, exported .byve files are saved where you choose (such as the Files app or iCloud Drive).
Public resources used by generated apps
Generated apps may load public libraries, fonts and images they need directly from servers BYVE has reviewed (jsDelivr, cdnjs, Google Fonts and the BYVE asset server) and from a few free public information APIs (exchange rates, books and earthquakes). As when opening any website, those servers receive your IP address and basic browser information, and public information APIs may receive the search terms needed for a lookup. BYVE does not include cookies or sign-in information in these requests. To add video or music to a generated app, only the official players of YouTube, Vimeo, Spotify and SoundCloud can be used, and YouTube's privacy-enhanced mode (youtube-nocookie.com) is preferred. When a player appears on screen, your device connects directly to that service, which may process your IP address, device and browser information and playback information under its own privacy policy. BYVE does not pass installation or sign-in information to the players and does not connect to any other external pages or file addresses.
Retention periods
Recovery copies of completed results are retained for up to 24 hours. Detailed generation request and token activity records (amounts, times and status of grants, revocations, generations, refunds and ad rewards) are retained for 365 days before scheduled deletion. Details updated later by a refund or revocation are also retained for 365 days from that update; unsettled requests and grant information are safely preserved until settlement is complete. Minimal identifiers to prevent duplicate grants, such as grant and reward transaction identifiers and hashed device identifiers recording the initial free-token grant, are retained separately from the details while the service operates. These records are not anonymous and are not deleted just by clearing device data or uninstalling the app. Deleting activity details does not expire your remaining tokens. IP-based rate-limit keys are retained for up to 2 days; unresolved safety reports for up to 180 days; resolved reports for up to 30 days; and inactive push registrations for up to 180 days before scheduled deletion. Inactive installation wallets are not deleted after 180 days if they still hold a balance or an unsettled charge. Because there are no accounts, an email address alone cannot identify these values or enable an individual deletion request. Under Firebase's public policy, deletion of Crashlytics crash stacks and related identifiers begins after 90 days. Other Google advertising and Firebase data follows the relevant service policies and your consent settings. Where the law requires retention, the required period applies. However, if you send a request with your installation ID through My Page > Support > Contact us, we will check and help delete the server records linked to that installation. Minimal records that prevent duplicate grants and information that must be kept by law may be excluded. On iOS, App Attest public keys and signature counters are minimal records for authenticity checks and duplicate-grant prevention and are retained while the service operates; the single-use challenges used for these checks are deleted once they expire. Where DeviceCheck is used, the server keeps a record of the initial free-token decision for each installation (Apple's result, whether tokens were granted and when) in the same way, and the flag bits kept by Apple remain until BYVE changes them.
Your choices and rights
If you do not consent to the external AI processing and cross-border transfers described in this policy, you cannot use app generation or editing, but you can continue using apps already saved on your device. You may allow or deny online information features through their individual notices; permission lasts only for that run session. You can reopen advertising privacy choices in the app's privacy options, and turn product-update notifications and marketing notifications on or off separately in My Page. Usage analytics are collected automatically and there is no in-app toggle to turn them off. An analytics opt-out stored with an explicit-choice marker is honored. Settings from older versions without that marker cannot be distinguished from defaults, so earlier opt-outs may not be preserved. Required stability diagnostics in release builds stop when you uninstall the app. You can clear app data on your device in Android settings. Because there are no accounts, server records cannot be identified and deleted using an email address. See Retention periods and the Data Deletion page for the retention periods and scope of automatic deletion for each type of server information. However, if you send a request with your installation ID through My Page > Support > Contact us, we will check and help delete the server records linked to that installation. Minimal records that prevent duplicate grants and information that must be kept by law may be excluded. On iOS, you can change whether BYVE AI is allowed to track at any time in Settings > Privacy & Security > Tracking, and every feature works even if you do not allow it. On iOS, you can erase app data on the device with My Page > "Delete all apps and chats" or Settings > General > iPhone Storage (iPad Storage) > BYVE AI > Delete App, and you can turn off device permissions at any time in Settings > Apps > BYVE AI (on iOS 17, Settings > BYVE AI).
Support inquiries
When you contact mark@bymysidelabs.com, we process your email address, subject and message, attachments, and any installation ID or request ID in the message to answer you. Inquiry emails pass through Cloudflare Email Routing and are forwarded to the operator's Gmail. If an installation ID is included, we look up that installation's token balance and notification registration status to help faster; this is a read-only lookup that changes nothing. Inquiries that include an installation ID receive an automatic confirmation email. Using My Page > Support > Contact us in the app fills in your installation ID automatically so we can help faster. Inquiry emails are kept as long as needed to answer and follow up, and you can ask us to delete them at the same address.
Contact
Privacy and service inquiries: mark@bymysidelabs.com