Privacy Policy

1. Information We Collect

We collect only what is necessary to provide the service:

• Phone number — used for account registration and login (OTP verification).
• Display name — the name you choose to show to other users.
• Profile photo — optional; uploaded by you.
• Native language preference — used to determine your translation language.
• Messages and media — text messages, voice notes, images, and PDF files you send or receive. All message content is stored encrypted at rest.
• Device push token (FCM) — used to deliver push notifications to your device.
• Usage data — timestamps, message status (sent/delivered/read), and connection metadata.
• Contact phone numbers — only if you grant contacts access, and only to find which of your contacts already use Trilyo. Numbers are checked against our user list and are not stored. Contact names and all other contact details never leave your device. See section 4 below.

2. How We Use Your Information

• To create and manage your account.
• To deliver messages in real time between conversation participants.
• To automatically translate messages into each participant's preferred language using AI.
• To send push notifications when you receive new messages.
• To enable voice message transcription (speech-to-text).
• To provide an AI assistant that can answer questions about your conversations.
• To maintain service security and prevent abuse.

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

3. Third-Party Services

We use the following trusted third-party services to power the app:

• Anthropic (Claude API) — for AI-powered message translation and the in-app AI assistant. Messages may be processed by Anthropic's servers. See Anthropic Privacy Policy.
• Google Firebase (FCM) — for push notifications. See Firebase Privacy Policy.
• Google Play — for app distribution on Android.

Each third party is contractually bound to handle your data securely and in accordance with applicable privacy laws.

4. Contacts Access

Trilyo can show you which of the people already in your phone's contacts also use Trilyo, so you can start a conversation without typing a number. This is entirely optional.

• It is optional. Trilyo is fully usable without contacts access. If you decline, or later revoke it in your device settings, everything else continues to work — you can still start a conversation by entering a phone number manually.
• Nothing is read until you ask for it. We do not read your contacts when the app launches. It happens only when you open the Contacts screen or create a new group.
• Only phone numbers are sent. Numbers are normalised on your device and sent to our server over an encrypted connection. Contact names, email addresses, photos, and every other contact field stay on your device. Names you see next to a match are read from your own phone, not from us.
• We do not store them. The numbers you send are compared against our list of registered users and discarded when the request finishes. They are not written to our database, not written to our logs, and not retained in any form.
• Only matches come back. The response contains only people who are already Trilyo users. Numbers that do not match tell us nothing and are not kept.
• We never share or sell them. Contact data is not passed to any third party, and is not used for advertising, profiling, or building a social graph.

5. Data Storage and Security

• All message content is encrypted at rest using AES-256 encryption.
• All data is transmitted over HTTPS/TLS.
• Real-time message delivery uses encrypted WebSocket connections.
• Access to personal data is restricted to authorized personnel only.
• We regularly review our security practices to prevent unauthorized access, disclosure, or loss.

6. Data Retention

We retain your account data and messages for as long as your account is active. You may delete messages within the app at any time. To delete your entire account and all associated data, contact us at support@trilyo.app.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict certain processing.
• Export your data in a portable format.

To exercise any of these rights, contact us at support@trilyo.app. We will respond within 30 days.

8. Children's Privacy

Trilio is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

9. International Data Transfers

Your data may be processed on servers located outside your country of residence. By using Trilio, you consent to the transfer of your information to facilities in countries that may have different data protection laws than your country. We ensure appropriate safeguards are in place for all international transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you through the app or by email. Continued use of Trilio after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: support@trilyo.app
• Website: https://trilyo.app

12. Analytics Cookies and Usage Analysis (Trilyo Business)

Added 23.10.2026. On the Trilyo Business site (trilyo.app/business, its pages and the customer portal) we use two analytics tools, only if you accept in the cookie notice:

• Google Analytics 4 (Google LLC): counts visits and actions on the site, such as pages viewed, button clicks, plan selection, starting checkout, scroll depth and how you arrived (e.g. UTM parameters or the referring site). We do not send Google your name, e-mail, phone or card details.
• Microsoft Clarity (Microsoft Corporation): records how the page is used (mouse movement, scrolling, clicks) and builds heatmaps, so we can see where the site is unclear and why visitors leave. All form fields and the portal's content are masked in recordings, so what you type is not captured.

Not measured: the payment page is run by CardCom and has none of our tracking tools. Card details never pass through us and are never sent to analytics tools.

Purchases: if you accepted analytics, once a payment is confirmed we send Google Analytics a purchase event with the order ID, plan and amount, and no personal details.

How you arrived: on your first visit we store the source in your browser (localStorage), e.g. UTM parameters and the referring site. If you place an order, it is saved with the order so we know which channels bring customers.

Your choice: "Essential only" means none of these tools load. Your choice is saved in your browser. To change it, clear this site's data in your browser and the notice will appear again on your next visit, or contact us. You can also block Google Analytics with Google's official opt-out add-on: https://tools.google.com/dlpage/gaoptout

Retention: Google Analytics keeps data for a limited period as set in Google Analytics. Clarity keeps recordings for up to 30 days and aggregated data for up to 13 months, per Microsoft's policy.

International transfers: Google and Microsoft may process the data outside Israel, including in the US. Google's privacy policy: https://policies.google.com/privacy · Microsoft's privacy statement: https://privacy.microsoft.com/privacystatement