Privacy Policy

Last updated: October 24, 2026

This policy explains what we collect, why we collect it, who receives it, how long we keep it and the choices you have.

Who we are and what this covers

Hilo is a mobile application published by Buffalo Dijital Hizmetler A.Ş. (also known as Buffalo Studio, “Buffalo”, “we”, “us”), a company incorporated in Türkiye.

This policy applies to the Hilo app for iOS and Android and to hiloai.app. It does not apply to the App Store, Google Play or any other service you reach from Hilo, each of which has its own policy.

For the purposes of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) we act as the data controller. Where the EU General Data Protection Regulation (“GDPR”) applies to you, we act as controller within the meaning of that regulation.

Contact: hilo@buffalostudio.co
Address: Cevizli Mah. Zuhal Cad. A Blok No: 46/50, 34846 Maltepe / İstanbul, Türkiye

The short version

• Hilo is an AI companion. What you say or type in a conversation goes to our servers and to AI providers so that a companion can reply.
• We do not keep recordings of your voice. We keep the text of your conversations in your account until you delete your account.
• Your camera picture stays on your phone. Selfies are only saved or shared when you choose to.
• We use analytics and advertising measurement partners: Google Firebase, Mixpanel, AppsFlyer and Meta. They never receive the content of your conversations. We do not sell your personal data.
• You can delete your account in the app at any time.
• Hilo is for adults. You must be 18 or older to use it.

What we collect and why

Your account

When you sign in with Google or Apple, Firebase Authentication (a Google service) receives your email address, a user ID, and the name and profile photo your Google or Apple account shares. If you use Apple’s “Hide My Email”, we receive a private relay address instead of your email. We use this to create your account, keep it secure and contact you about it. We do not use your profile photo.

Before you sign in, the app uses an anonymous ID so it works without an account.

Your answers during setup

During setup we ask for:

• the name you’d like your companion to use
• your birth year, to confirm you are 18 or older
• why you came to Hilo, how you feel today, how full your mind feels, what helps you wind down, how you like to be helped, what you’d like more of, how much time you have and when you’d like to check in
• your companion and room, reminder settings and memory setting
• your agreement to our terms and to AI processing

These answers stay on your phone until you sign in. After you sign in, we save them to your account on our servers. We use them to personalize your companion and your conversations.

If your birth year shows you are under 18, setup stops and the answers are deleted from your phone.

Conversations

• Voice. While you hold the microphone button, your voice is streamed to our server and passed to our speech-to-text provider, which turns it into text. We do not store recordings of your voice.
• Text. What you type, the text of what you say and your companion’s replies are saved with each conversation in your account. We also save details about the conversation, such as the emotion a reply was spoken with, whether you interrupted it, and actions like a breathing exercise or a step you added.
• Context for replies. To write a reply, we send the conversation, relevant memories and some of your setup answers (such as your name and how you like to be helped) to an AI provider. See “AI providers” below.
• Language and time zone. So your companion replies in your language and knows the time of day.

What you share in conversations, and your mood check-ins, may include information about your health or wellbeing. We use it only to provide Hilo to you.

Memory

After a conversation, an AI provider reads it to note things worth remembering, such as what you enjoy or what’s happening this week. These memories are saved in your account and help your companion pick up where you left off. Memories about a specific day expire automatically once that day has passed. Deleting your account deletes all memories. You can also email us to delete them.

Steps

Steps you add yourself or accept from a companion (their title, details and whether they are done) are saved in your account.

Check-ins

Your daily mood check-ins are stored on your phone. Your latest mood is also saved with your setup answers.

Purchases

Payments are handled by Google Play or the App Store. We never receive your card details. RevenueCat, our subscription provider, receives your purchase and subscription status, the product, price and transaction identifiers, together with our user ID and the identifiers described in “Analytics and advertising measurement”. We use this to unlock Hilo Pro, restore purchases and measure which campaigns lead to subscriptions.

Usage, device and diagnostics

• Usage time. Minutes you spend in conversations, to apply the free plan’s limits.
• App events. For example: screens viewed, setup steps completed, a conversation started or ended, a feature used, the paywall shown, a trial started or a purchase completed. App events never include conversation content, your name, your email or anything you typed.
• Device information. Device model, operating system and version, language, app version, and the IP address your connection uses. Analytics providers may use the IP address to estimate your country or city.
• Identifiers. App and installation IDs from Firebase, Mixpanel and AppsFlyer, an anonymous installation ID of our own, Meta’s anonymous ID, and your device’s advertising ID (see “Analytics and advertising measurement”).
• Crash reports. If the app crashes or hits an error, Firebase Crashlytics receives technical details such as the error, device state and app version.
• App integrity. Firebase App Check uses Google Play Integrity or Apple App Attest to confirm requests come from the real Hilo app, which protects our servers from abuse.

Reports

When you report a companion’s reply, we record the reason you choose.

What we don’t collect

• Camera. The camera view in a conversation and the selfie camera work on your phone only. Selfie cards are put together on your phone. They are saved to your photos or shared only when you choose, and only with the app you choose.
• Precise location, contacts, files and browsing history.
• Push notification tokens. Reminders are scheduled on your phone.
• Your invite link details are stored on your phone.

AI providers

These companies process data on our behalf to make conversations work.

We may also use these providers for the same tasks, for some conversations or if we switch providers: Google (Gemini on Vertex AI) for replies and memories, Microsoft (Azure AI) for speech to text and voice, and Cartesia for voice. We update this list when our providers change.

We do not use your conversations to train AI models.

Analytics and advertising measurement

None of these partners receive your conversations, memories, setup answers, name or email.

Advertising ID. On iOS, the app asks your permission before your device’s advertising identifier (IDFA) can be used. If you decline, it is not shared. On Android, partners may receive your device’s advertising ID. You can reset or delete it at any time in Android Settings (Privacy, then Ads).

Selling and sharing. We do not sell your personal data for money. We share limited identifiers and app events with AppsFlyer and Meta to measure our advertising. Some US state laws call this “sharing” for advertising. To opt out, decline tracking on iOS, delete your advertising ID on Android, or email us.

Other service providers

• Google Cloud and Firebase. Our servers (Cloud Run in the United States, us-central1), our database (Cloud Firestore in the United States), sign-in, app configuration, downloads of character files, crash reports and app integrity checks.
• RevenueCat. Subscriptions and purchase status.
• Google Play and Apple. Payments, sign-in and the rating prompt.

Legal bases

If you live in the European Economic Area, the United Kingdom or Türkiye, we rely on these legal bases:

• Providing Hilo to you (contract): your account, conversations, memories, steps, usage limits and purchases.
• Your explicit consent: having your conversations processed by AI providers, and information about your health or wellbeing that you share (such as your mood or how you feel). You give this consent during setup. You can withdraw it at any time by deleting your account.
• Our legitimate interests: keeping Hilo secure, preventing abuse, fixing crashes, understanding how Hilo is used and measuring our marketing.
• Your consent where the law requires it: for example, the iOS tracking permission for advertising identifiers.
• Legal obligations: keeping purchase and tax records.

Where your data is processed

Our servers and database are in the United States. Our providers may process data in the United States and other countries. Where the law requires it, these transfers are protected by safeguards such as standard contractual clauses.

How long we keep data

Deleting your data

In the app: go to You, then Settings, then Delete account.

When you delete your account:

• your account, setup answers, conversations, memories, steps and invite link are deleted from our servers right away, and your sign-in account is deleted
• a deletion marker without your data is kept for up to two hours, so old sign-in sessions cannot recreate the account
• data stored by the app on your phone is cleared

Deleting your account does not automatically remove:

• purchase records kept by Google Play, the App Store and RevenueCat
• analytics and attribution data held by Firebase, Mixpanel, AppsFlyer and Meta, which is linked to app and device identifiers rather than your name

Email us and we will ask these providers to delete records linked to your account.

Deleting your account does not cancel a subscription. Cancel it in Google Play or the App Store.

Without the app: see https://hiloai.app/delete-account

Your rights

Depending on where you live, you can ask us to:

• tell you what data we hold about you and give you a copy
• correct it
• delete it
• limit or object to how we use it
• send it to you or another service in a portable format
• stop sharing it for advertising

You can withdraw your consent at any time. If you live in Türkiye, you also have the rights in Article 11 of the Personal Data Protection Law (KVKK).

To use any of these rights, email hilo@buffalostudio.co. We reply within 30 days. To ask for a copy of your data, you can also tap Export my data in You, then Settings, then Your account. It opens an email to us with what we need to find your account. You can also complain to your local data protection authority (in Türkiye, the Personal Data Protection Authority).

Age requirement

Hilo is only for people aged 18 or older. Setup asks for your birth year and stops if you are under 18. If you believe someone under 18 is using Hilo, email us and we will delete their account.

Security

All traffic between the app and our servers is encrypted. Our database is encrypted at rest by Google Cloud. Only authorized team members can access user data, and only when needed to run Hilo. Our server logs never contain the content of your conversations.

Hilo is not a medical or emergency service

Hilo’s companions are fictional characters powered by AI. They are not therapists or doctors and cannot help in an emergency. If you are in danger, contact your local emergency number. If a conversation suggests you may be in crisis, the app shows crisis resources.

The website and waitlist

Joining the waitlist. With your consent, we collect your email address to send Hilo launch updates. We also store the signup time, the source of the signup and the privacy notice version you agreed to. Joining does not create an app account. Signups are stored in Google Cloud Firestore in the United States, and the signup service runs in us-central1. We delete waitlist email records no later than 90 days after Hilo’s public app launch, or earlier if you ask us to remove your address.

Keeping the form reliable. The waitlist endpoint limits repeated submissions. It stores a short-lived hash derived from your connection’s IP address and an hourly window to count requests. It does not store the raw IP address in the waitlist record.

Optional website analytics. Analytics stays off unless you select “Allow analytics”. If enabled, Google Analytics for Firebase helps us understand page visits, referral sources, approximate location, device and browser information, and interactions such as companion selections and waitlist submissions. We do not send your email address or form contents to analytics. Advertising consent is disabled. You can change your choice through “Cookie preferences” in the footer.

Previews. The conversations and notes on the website are illustrative. The website does not access your microphone or camera.

Changes to this policy

When we change this policy, we update the date at the top. If a change is important, we will also tell you in the app.

Contact

Buffalo Dijital Hizmetler A.Ş. (Buffalo Studio)
Cevizli Mah. Zuhal Cad. A Blok No: 46/50, 34846 Maltepe / İstanbul, Türkiye
hilo@buffalostudio.co

← Back to Hilo