Effective and last updated: August 24, 2026
Where this policy is translated, the English version governs.
This document explains what information Afrilingua (“Afrilingua”, “we”, “us”), operated by Afrilingua AI, collects from you, how we use it, and the controls you have over it. It applies to every Afrilingua surface — mobile, web, desktop, the Aura Companion browser extension, the Aura VS Code extension, the Aura Code sandbox, and Gist (the social network inside Afrilingua).
Three names appear throughout this policy and they refer to different things:
@you.afrilingua.ai) and the associated portable identity ID, if you set up your Gist profile.When you connect a service (Google Calendar, Gmail, GitHub, Plaid, Spotify, Home Assistant, Slack, Microsoft Teams, etc.), Afrilingua stores the access tokens and refresh tokens needed to call that service on your behalf. We request provider permissions through the provider's consent screen and use the resulting credentials only for the capabilities you authorized.
Connected-service tokens are encrypted at rest using Fernet symmetric encryption with a server-side key derived using PBKDF2-HMAC-SHA256. Afrilingua session refresh tokens are stored as one-way hashes. Credentials are isolated by account, are not included in model prompts, and are decrypted only by server-side services when an authorized operation requires them. Network traffic is protected with HTTPS/TLS. You can disconnect a service at any time; we remove its stored credentials, and you can also revoke access directly with the provider.
Afrilingua builds a personal knowledge graph from the information you connect or share so that Aura can act for you. This may include calendar events, emails, messages, contacts, files, locations, browsing context (when you opt in via the Aura Companion browser extension), health metrics (when you opt in on iOS), and the conversations you have with Aura.
We log request IDs, tool names, durations, error types, and a truncated user identifier. We do not log message bodies, email contents, contact details, or other personally-identifying content in our application logs.
To understand how Afrilingua is used and to find where it breaks, we record product analytics — which screens are opened, which controls are pressed, how long screens are used — and masked session replays: a reconstruction of how the interface was used, showing layout, taps, scrolling and pointer movement. This applies in the app and on our own websites.
Most of this policy is about people who sign in. This section is about the other half: people who buy a ticket or place an order here without ever making an account, and the people they buy from.
You can buy a ticket, a plate, a vendor booth or an item from a shop using only an email address. When you do, we store the email you gave, the name you gave for the door if the seller asked for one, what you bought and how many, and the payment record returned by Stripe.
That email is encrypted at rest, with the same Fernet encryption used for connected-service credentials in section 1. It is decrypted only when it is actually needed — to send you your ticket, and to show the seller their door list. A copy of the database on its own does not yield a list of everyone who has ever bought something here.
Buyers are keyed internally by a one-way hash of the address, so the same person is recognised across devices and visits without the address itself needing to be searchable. That hash is a lookup key and not a secret: an address you already suspect can be confirmed against it. The protection is on the stored address, not on the key.
The person running the event, shop or circle can see the name, email and purchase of everyone who bought from them. They need it to run the door, fulfil an order and answer a question about it. Once they have it, they hold it independently of us, and what they do with it is governed by their own conduct and their own obligations, not by this policy. We do not control it on their behalf and we do not sell or share it with anyone else.
A ticket sold in person to someone who gives no email is recorded against a single-use identifier with no personal information attached to it at all.
Card details are collected and processed by Stripe and never reach our servers. Money for a sale is routed to the seller's own connected Stripe account. Stripe processes payment data under its own terms as an independent controller of that data.
Everything in section 6 applies to you as well. If you bought something as a guest and want a copy of what we hold, or want it deleted, email taiwo.raji@afrilingua.ai from the address you bought with. You do not need an account to ask, and we will not make you create one.
We do not sell your personal data, share it with advertisers, or use it to train foundation models without your explicit, separate consent.
Our primary production systems are currently operated in the United States. Cloudflare provides edge delivery and connectivity, so requests may pass through a nearby Cloudflare location. External services and model providers may process data in other regions under their own privacy terms. If we make a material change to where or how personal data is processed, we will update this policy.
To deliver the product we use carefully chosen processors, including:
Model availability may change as providers and product capabilities evolve. We will keep this disclosure current and will identify the selected provider in-product where practical. When you use Bring Your Own Key, requests flow under your account with that provider and are also governed by your agreement with that provider.
Afrilingua is not intended for children under 13 (or under 16 in jurisdictions where that’s the relevant threshold). Do not create an account if you are under that age.
We will update this page when our practices change. Material changes will be announced in-product before they take effect.
Questions, requests, complaints: taiwo.raji@afrilingua.ai.