Privacy Policy
Effective: September 29, 2026
Ahoy (master.ahoy.rs) is an AI assistant operated by Sparkcan ("we", "us") for invited users and their teams. This policy explains what data Ahoy handles, why, who it is shared with, and the choices you have. Contact: branko@sparkcan.com.
1. Data we collect
- Account data: your name, email address, and either a password (stored only as a salted scrypt hash) or, if you sign in with Google, your Google account identifier, name and verified email address.
- Content you provide: chat messages, files and images you attach, project files, personalities, reminders and scheduled tasks, and your settings.
- Memory: short notes Ahoy derives from what you write (for example your preferences or project decisions), together with the excerpts they came from, so it can remember context across conversations.
- Connected services (optional): if you link Telegram, your Telegram chat identifier and the messages you exchange with the Ahoy bot. If you connect Google Calendar or Gmail, the data described in section 4.
- Technical data: a session cookie, sign-in sessions (device/browser description and time), usage counters (number of requests and tokens per model) and server logs needed to run and secure the service.
2. How we use it
- To provide the service: answer your messages, run the tools you ask for, remember context, send reminders and deliver results to you (in the app or on Telegram).
- To keep the service secure and working: authentication, abuse prevention, debugging and capacity planning.
We do not sell your data, use it for advertising, or build advertising profiles. We do not use your content to train AI models.
3. Who processes your data
- AI model providers. To answer you, the relevant part of the conversation (and any files you attach) is sent to the AI model selected for the chat, for example Anthropic (Claude), OpenAI, Google (Gemini), xAI (Grok), Moonshot (Kimi), Meta or Z.ai (GLM). Each provider processes it under its own terms and privacy policy.
- Web tools. When Ahoy searches the web or opens a page for you, the search query or page address is sent to the search engine (DuckDuckGo) or the website.
- Telegram, if you link it, delivers messages between you and the Ahoy bot.
- Cloudflare provides DNS and network protection for master.ahoy.rs; traffic passes through it encrypted.
- Hosting. Ahoy runs on a server operated by Sparkcan in Serbia. Data is stored there (database, memory index, files) and in weekly server backups.
We may disclose data if required by law, or to protect the rights, safety and security of our users and the service.
4. Google user data
Signing in with Google gives Ahoy your basic profile (name, email address, Google account identifier) only to create and sign in to your account.
If you choose to connect Google Calendar or Gmail, Ahoy accesses that data only to do what you ask in the chat, for example read your upcoming events, create an event, or find and summarize an email. Access tokens are kept only on our server, and you can disconnect at any time (also at myaccount.google.com/permissions).
Ahoy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features you request, is not used for advertising, is not sold, is not used to train AI models, and is not read by humans except with your consent, for security purposes, or to comply with the law.
When you ask Ahoy about your calendar or email, the relevant content is sent to the AI model you use for that chat (section 3) only to answer that request.
5. Cookies and local storage
Ahoy uses one essential session cookie to keep you signed in, and a short-lived cookie during Google sign-in. Your browser's local storage keeps interface preferences (theme, selected model, project). There are no analytics or advertising cookies.
6. Retention and deletion
- Your content is kept until you delete it. Deleting a conversation deletes its messages, attached files and the memories derived from it.
- You can review, edit and delete what Ahoy remembers in “What Ahoy remembers about me” (Memory in the user menu), including deleting all memory at once.
- Uploaded files that are never sent are deleted after 24 hours.
- To delete your account and all its data, email us; we do so within 30 days. Removed data disappears from backups as they rotate (within a few weeks).
7. Security
Connections are encrypted (HTTPS). Passwords are stored as salted hashes, access to data is limited to your account, your team and the projects you are a member of, and files are served only to their owner. No system is perfectly secure, but we work to protect your data and will notify affected users of a breach as required by law.
8. Your rights
Under the Serbian Law on Personal Data Protection and, where it applies, the EU GDPR, you can request access to, correction, export or deletion of your personal data, object to or restrict its processing, and lodge a complaint with the supervisory authority (in Serbia: the Commissioner for Information of Public Importance and Personal Data Protection). Email branko@sparkcan.com.
9. Children
Ahoy is not intended for children under 16 and we do not knowingly collect their data.
10. Changes
We may update this policy. The date above shows the latest version; significant changes will be announced in the app.