Privacy Policy

1. Scope and who we are

This Privacy Policy explains how Aether, operated by The AECE Studio (“Aether,” “we,” “us”), accesses, collects, uses, shares, retains, and protects information. It covers the Aether Android app and this website. Questions can be sent to support@theaecestudio.com.

2. Information we handle

Account, age state, and active installation

Aether creates an identity and binds its current authority to one server-recognized app installation and signed session at a time. This is an installation/session control, not a promise that one physical phone can run only one app instance. We process a device identifier, session identifier, custody version, platform label, revocation state, and activity time. A device transfer or account recovery moves authority to the new installation and revokes the previous installation's current custody.

We process the date of birth you declare and a private server-derived age-assurance state. A declared adult date is a claim, not proof of adulthood: an adult_claimed account may use ordinary declared-adult features but does not receive assured identity, guardian authority, mixed-age administration, or unrestricted access to protected minors. On eligible Google Play installations, Aether may receive Play Age Signals such as an age range, access status, source tier, and significant-change status. A current under-13, verification-required, conflicting, pending, or declined signal can restrict the account; a Play signal alone never grants verified adulthood, identity, guardianship, or trust. Aether keeps only the latest account-bound signal and does not send it to other users. Unknown and conflicting accounts remain restricted until the server has a current decision. We also process your display name, unique handle, public aliases, profile photo, public encryption key, privacy settings, and account activity. Your date of birth, age-assurance evidence, and device records are not public. A public alias changes presentation in Space and Live; it does not hide the underlying account from safety systems. Minor aliases are confined to the matching minor Space cohort and are labelled Minor · Alias; private-chat and throwaway aliases are unavailable to minors.

Optional face verification and biometric template

If you expressly opt in, the Aether app uses the front camera for randomized blink, smile, and head-turn prompts and creates a numerical face embedding for later comparison. The app processes camera frames and the temporary still image on your device and deletes the temporary image after processing; it does not intentionally upload those images for this feature. The app evaluates the gesture prompts locally, but Aether's server does not independently observe the camera capture or treat it as provider proof of liveness. The numerical embedding is biometric data. Before storage it is encrypted on-device with a key derived from your device-held message identity. Supabase stores the encrypted template, a client-reported ciphertext digest, model version, completion time, the identity-custody version that completed the check, and exact owner-scoped object metadata. A current face-verification badge is visible wherever another user is authorized to read the profile. The current server record unlocks Space publishing and, for a declared adult, Live hosting and stage access; removing it or transferring custody revokes those face-only capabilities. Declared adults may use Coins and watch or gift in Live without face or ID verification. The template is not used for advertising, model training, legal-identity decisions, age verification, guardian decisions, or face search across users. This check does not prove legal identity, verified age, account uniqueness, trustworthiness, safety, or permission to contact minors.

Identity assurance, guardian applications, and payment

When you request provider-backed identity or guardian identity assurance, Smile ID may process the identity document, face/liveness material, and identity attributes required by the selected workflow. Aether receives and stores the provider result, provider and job references, verified birth date, country, document type and expiry, decision times, and a keyed document-identity fingerprint used to detect reuse across Aether accounts. We do not treat Aether's separate on-device face verification as this provider verification.

Each Smile ID identity check consumes one successful purchase of the production Google Play product aether_verification_150. Aether intends a USD 1.50 base price; the actual localized price and tax are the amount Google Play displays before purchase. A current paid adult identity can later support a guardian application without a second guardian-only charge. Aether verifies the product identifier, account binding, and current purchase status, while the live price is controlled by the Play Console. We process the purchase token, order reference, time, status, and refund/void events; Google processes the payment instrument. ID verification and payment establish accountable evidence, not safety or a guardian-child relationship. A separately submitted relationship and its evidence must be reviewed before a verified adult has authority for a particular minor. Refunds, expired evidence, revocation, identity conflicts, or a safety hold can suspend that authority.

Private messages and recipient metadata

For supported DMs, the sender's device encrypts the message body and attachments and creates a separately wrapped content key for every recipient in the server-authorized recipient manifest. The relay processes the participants, any required guardian recipients, delivery role, protected-user indicators, public keys, encrypted envelopes, delivery state, attachment references, and limited anti-abuse metadata. Ordinary message delivery is not designed to send plaintext bodies, attachment contents, or content keys to the service, but the protocol has not yet received independent cryptographic validation.

When a protected minor communicates with a participant who is not a confirmed compatible minor peer, an active approved guardian receives a separately wrapped encrypted envelope. The server commits all required participant and guardian envelopes in one transaction or refuses delivery; a sender cannot remove a required guardian from the manifest. Confirmed compatible-minor peer messages do not add a guardian solely because the participants are minors. Ordinary participant envelopes are removed after the intended device confirms authenticated decryption; required guardian safety envelopes may remain for up to seven days after guardian-device confirmation; undelivered participant and required guardian envelopes expire within seven days. Readable history is stored on recipient devices, including a guardian device when guardian visibility is required.

Public and shared content

We store content you intentionally publish or share beyond a DM, including Space posts, their immutable server-derived 13–15, 16–17, or adult audience cohort, ads, status updates, photos, videos, comments, likes, follows, reshares, view counts, Live titles and region, group/channel information, and reports. Status updates are limited to eligible contacts and expire after 12 hours. If you choose Current location in a chat, Aether requests one foreground device location, shows you the coordinates and accuracy, and sends them only after you confirm. The coordinates travel as part of the encrypted message to its intended recipients; the custom message protocol has not received independent cryptographic validation, as explained below.

Live and calls

LiveKit processes audio, video, participant identifiers, comments, reactions, and connection data to let declared adults watch Live rooms. Hosting and stage access require a current face check or provider-backed adult identity; voice calls are available to current declared-adult accounts and remain subject to server safety, block, and consent controls. Live audio and video are not recorded by default. If a host chooses to save a replay, Aether displays a recording notice to participants and stores the replay privately until the host publishes or deletes it. Voice calls are not recorded by Aether. Room, participant, safety, and call-routing metadata may be retained for service operation and abuse prevention. A safety-state change immediately blocks new media credentials and queues removal of connected rooms or participants, but an already-connected media session may persist until LiveKit accepts that asynchronous removal.

Backups, recovery, device data, permissions, and service measurements

If you enable cloud backup, Aether uploads a client-encrypted backup containing the limited fields described below, including the messaging identity seed required to keep the same encrypted-message identity after recovery. The recovery code derives separate encryption and authorization values; the service receives the authorization value during backup and recovery but is not designed to receive the backup decryption key. The recovery code is also authority to transfer custody of the same governed identity, revoke the previous active installation, and rotate to a new recovery code. Recovery does not reset age, guardian, moderation, block, report, or other safety state. The app may access camera, microphone, photos/videos or files you select, Bluetooth audio, network state, notifications, wake lock, and vibration only to provide the feature you choose. Local app settings and the active copy of encrypted identity material are stored on your device; an enabled cloud backup stores the messaging identity seed only inside recovery-code ciphertext.

To operate and improve Aether, we record account-linked daily events for app use, Space, Live, notifications, hides, push registration, and reliability. We also receive technical failure reports containing an account association, app/build or artifact details, an error category, and up to four packaged source locations. The reporting helper excludes raw exception text and full stack traces. These are pseudonymous or account-linked records, not anonymous data. Product-event rows are scheduled for deletion after 90 days; cleanup execution has not been verified. Repeated client-failure groups are scheduled for deletion after 90 days without a new occurrence, so a group can remain longer than 90 days from its first event.

Creator and campaign attribution records installs, opens, campaign interactions, and participation using a persistent random installation subject sent as a hash. If that subject is unavailable, the attribution service derives a hash from the request IP address and user agent together with the campaign and day. These hashes are pseudonymous, not anonymous. Attribution rows become eligible for scheduled cleanup after 90 days. Cleanup runs in bounded batches independently of new events; outages or a backlog can delay removal. The app does not use an advertising ID for this attribution.

Our website access logs record the request method, time, response status, response size, and duration without the client address, requested URL, referrer, or user agent. Error logs may contain request details, including an address or URL, when needed to diagnose a failure. Access to operational logs is restricted. Website logs use daily rotation with a 14-day retention setting; payout-service logs use a 30-day age limit and size limits. Rotation and removal can be delayed by outages. Older copies, provider logs, and backups may have separate retention rules.

When public search is enabled, Aether receives the search term to return eligible public results. Searching private message history happens on your device and does not upload that history automatically. The website sets no advertising cookies, but the app's campaign attribution can operate without cookies.

App progress analytics, push, and performance diagnostics

Firebase Analytics is enabled by default and its app-progress events can be disabled or enabled in Aether → Settings → Data & account → App progress analytics. The app sends fixed event names without custom content or account-ID parameters. This switch controls Firebase Analytics only. It does not disable Firebase Performance Monitoring, Firebase Cloud Messaging, or Aether's account-linked reliability events and failure reports described above. Firebase Analytics may process standard app, device, installation, and session metadata. Performance Monitoring separately measures app-start, screen-rendering, and HTTP request timing or failures. Firebase documents that Performance Monitoring uses IP addresses to infer the country where an event originated. That is an approximate network-derived location, not nationality. Firebase applies separate retention controls to these services; the Analytics switch is not a control for Performance Monitoring.

Safety reports

Reports may include the category, reported account/content identifiers, relevant public content, subject/account snapshots, and evidence you choose to submit. Selecting private-message evidence intentionally discloses that evidence for the report; it is then available only through the restricted case workflow and reason-bound staff access. We preserve the report and necessary evidence for investigation, enforcement, fraud prevention, legal compliance, and child-safety reporting even if an involved account is later deleted. A child may report any account, including a registered guardian. A report against a guardian is not automatically disclosed to that guardian and places the relationship under a non-public safety hold unless that hold is independently released after case review.

3. Why we use information

• Provide messaging, profiles, Space, Live, calls, encrypted backup, and support.
• Route encrypted communications and synchronize delivery and read state.
• Provide optional face verification and its limited social-feature capability when you give explicit consent.
• Protect users, investigate reports, block abuse, prevent fraud, and enforce our Terms.
• Maintain reliability, diagnose failures, comply with law, and defend legal rights.

Where applicable, these uses rely on performing our agreement with you, your consent and choices, our legitimate interests in operating a safe service, and legal obligations. You may withdraw face-verification consent by removing the check in the app.

4. Service providers and disclosure

We use providers to operate Aether: Supabase for authentication, database, message relay, functions, and storage, including private storage of encrypted face templates, relationship evidence, and report evidence; Firebase for push delivery, app-progress analytics, and performance diagnostics; Smile ID for provider-backed identity and document/liveness workflows; Google ML Kit and TensorFlow Lite for on-device face processing; Google Play for Android distribution, age signals, purchases, and purchase/refund validation; LiveKit for real-time calls and Live audio/video; Cloudflare R2 for private replay storage; Resend for transactional email; and Flutterwave for bank-account verification and creator payouts. Infrastructure hosting and network providers also process requests needed to deliver our website and services. The app does not intentionally send face photos from the separate on-device face check to Supabase; provider-backed identity verification is a different workflow and sends its required material to Smile ID. Providers process the information needed for their services under their own privacy terms and our service arrangements.

For a bank payout you request, Flutterwave receives the bank code and account number for verification and transfer, and processes beneficiary, transfer, and outcome details. Google Play processes the payment instrument for Play purchases; Aether receives purchase references, tokens, and status, not card numbers. Resend processes the destination email address, message content, and delivery information for transactional messages. Email providers and recipients may retain copies under their own rules.

We do not sell personal information or biometric templates. We may disclose information when you direct us, to providers acting for us, through a safety report you submit, to protect users or the service, in a business reorganization with safeguards, or when legally required. Confirmed child sexual abuse material may be reported to the appropriate regional authority or the National Center for Missing & Exploited Children where required. We do not use nationality alone to trigger additional private-message monitoring or moderation. Our Terms state that safety enforcement is based on conduct, evidence, and context regardless of nationality, religion, or political affiliation.

5. Retention

• DM relay: ordinary participant envelopes are deleted after the intended device confirms authenticated decryption. A required guardian safety envelope may remain for up to seven days after guardian-device confirmation. Undelivered envelopes expire within seven days.
• Local DM history: until the device holder clears it, deletes the chat, restores/resets the device, or deletes app data. A participant or guardian recipient may retain their own copy.
• Face verification: camera frames are not retained by Aether; the temporary still is deleted after on-device processing. The encrypted template and custody-bound completion record remain until you remove the check or delete the account.
• Identity and guardian records: provider results, keyed identity-reuse markers, payment status, review records, and relationship evidence are preserved in restricted workflows while needed for safety, accountability, or legal duties. There is no fixed expiry schedule. We will periodically review continuing necessity and any legal or safety hold; review does not itself delete evidence. Some guardian evidence currently has no operational deletion path pending safe archival safeguards.
• Status: expires after 12 hours.
• Space media: media without viewing or engagement is scheduled for deletion after 180 days. The creator receives a 30-day warning and can choose Keep to restart the period.
• Support: resolved requests without reported message evidence are scheduled for deletion after seven days; inactive open requests without such evidence after 30 days. Requests containing reported message evidence are excluded from that cleanup. Deleted-contact report shortcuts remain visible for three days.
• Reports and enforcement records: these are preserved in restricted case workflows for safety, fraud prevention, enforcement, and legal duties. There is no fixed expiry schedule for every report or guardian-evidence record. We will periodically review continuing necessity and applicable holds; review does not itself delete evidence. Account deletion does not automatically delete a safety case.
• Inactive accounts: automatic account deletion and its warning process are paused from 22 September 2026 until a new policy is explicitly approved. The March 2027 review date is not an account-expiry date. You can still request account deletion yourself.
• Transient service data: relay envelopes, rate events, presence, invitations, and revoked-device records have separate cleanup rules. Scheduled cleanup can be delayed by failures or a backlog.
• Product analytics and diagnostics: account-linked product events have a 90-day cleanup rule; failure groups are scheduled for cleanup after 90 days without a new occurrence. A recurring failure group can remain more than 90 days after its first report. These rules concern Aether records; Firebase measurement data has separate provider retention controls.
• Campaign attribution: events become eligible for scheduled cleanup after 90 days, independently of new traffic. Cleanup processes bounded batches and may be delayed by failures or a backlog.
• Live replays and encrypted cloud backup: replays are host-requested and private unless published; backup remains until replaced or deletion is requested and recovery authorization is verified. Backups contain the handle, contacts, group/channel membership metadata, and messaging identity seed inside recovery-code ciphertext; they exclude chat messages, media, payment instruments, and general settings.

When Aether no longer needs information, we delete it or de-identify it where the record and system permit. Some case, payment, identity, or legal records may remain when needed for safety or legal obligations. Our account-deletion process does not guarantee immediate erasure from provider logs, backups, billing records, recipient inboxes, or copies retained on another user's device.

Firebase's published policy says Performance Monitoring keeps IP-associated events for 30 days and installation-associated or de-identified performance data for 60 days before removal begins. Firebase Installation IDs used by Cloud Messaging remain until a deletion request is sent; Google says removal from live and backup systems can take up to 180 days afterward. Updated app versions attempt to delete the current Firebase installation ID and messaging token and reset local Analytics data after Aether confirms account deletion. A failed or interrupted request may leave provider identifiers in place. This reset does not erase historical Analytics events, and enabled Firebase services can create fresh identifiers. Provider and backup copies follow their separate deletion and retention processes. Firebase's privacy and retention information describes these provider processes.

6. Security

We use TLS in transit, access controls, row-level database and object-storage protections, current-session custody checks, short-lived delivery storage, authenticated encryption for supported DM content and attachments, per-recipient key wrapping, secure device storage for private keys, authenticated encryption for local face templates, and recovery-code encryption for backups. The server independently authorizes message recipients and commits required guardian envelopes atomically. This is a custom messaging protocol without Signal-style forward secrecy or multi-device ratcheting and requires independent cryptographic validation before an unqualified end-to-end-encryption claim. A face embedding remains sensitive biometric data even when encrypted. No system is perfectly secure. Never send anyone your recovery code, authentication code, or device encryption key; Aether support will never ask for them.

7. Your choices and rights

Where your current authoritative age and safety state permits it, you can change directory visibility, online status, typing indicators, read receipts, message requests, voice calls, group invitations, notifications, aliases, posts, Status, comments, follows, blocks, local chat history, active-installation settings, and cloud backup from the app. Short-lived typing and recording activity is delivered through the same server-authorized relay boundary rather than an unrestricted client broadcast. A client setting cannot relax a server safety rule.

Chat screenshots, chat screen recording, Live screenshots, and Live screen recording are off by default. In a direct chat, each person's control grants or withholds the other person's ability to capture that person's content; a group or channel owner controls the community policy. When Android reports an allowed screenshot or recording, Aether displays a participant disclosure. Aether cannot prevent someone from photographing or recording a screen with another physical device. Space creators separately choose whether each post's media may be downloaded; allowed downloads carry the creator's public alias and Aether as a watermark.

You may disable or enable app-progress Analytics from Settings → Data & account → App progress analytics. Face verification is optional. You can withdraw consent and delete its encrypted template from Aether → Profile → Verification → Face verification → Remove face check; this also removes its badge and face-only Space-publishing and Live-host/stage capabilities. It does not remove a declared adult's access to Coins or Live viewing. You can export profile, preference, and on-device history data in JSON format. Device permissions can be revoked in Android settings. Depending on your location, you may also request access, correction, portability, restriction, objection, or deletion by contacting us. We will verify requests to protect the account.

9. Children and child safety

Aether is not available to children under 13. A self-declared adult birthday does not prove adulthood or grant assured-adult status. It can enable ordinary declared-adult features, but it never bypasses the protections applied when the other participant is a minor. Unknown and conflicting age states remain restricted. Confirmed minors may privately message confirmed peers only within the compatible server age band. Their guardians do not receive those peer messages solely because the participants are minors.

Communication between a protected minor and someone outside that compatible-minor peer rule requires a separately wrapped encrypted envelope for each required active approved guardian recipient. If the current guardian relationship or recipient key cannot be verified, delivery fails. Guardian identity requires current provider-backed KYC and the production verification payment, but neither establishes trust or a relationship to a child. Authority for a particular child exists only after the protected child initiates a distinct evidence-backed relationship request and two independent reviewers agree; the authority remains revocable. Group access for a minor requires current approval tied to that minor, group, guardian relationship, and group-policy version.

For a minor whose age was independently reviewed, the server waits until 12:00 UTC on the reviewed eighteenth birthday, when that date has begun even in UTC-12. At that conservative boundary, guardian authority no longer authorizes access to new messages and the relationship is released by authoritative age refresh. A declared birthday alone does not grant that transition. Optional face verification unlocks Space publishing and, for declared adults, Live hosting/stage access. It is not verified age, legal identity, guardianship, trust, or permission to contact minors and never overrides protected delivery rules. Minors cannot use Live or Aether Coins.

We prohibit child sexual abuse and exploitation, grooming, sextortion, trafficking, sexualization of minors, solicitation of minors, and sharing or seeking child sexual abuse material. A child can report any adult, including a guardian, without automatically disclosing the report to the accused guardian. Report urgent concerns in-app and email our child-safety contact at help@theaecestudio.com. Aether is not an emergency service; if someone is in immediate danger, contact local emergency services.

10. International processing and changes

Service providers may process information outside your country, under their own terms and our service arrangements. Where required, we use appropriate safeguards. Some providers infer an approximate country from network IP for service telemetry; this is not a statement of a user's nationality. We do not use nationality alone to trigger additional private-message monitoring or moderation. Our Terms state that safety enforcement is based on conduct, evidence, and context regardless of nationality, religion, or political affiliation. We may update this policy as Aether changes or laws require. Material changes will be communicated in the app or service where appropriate.

11. Contact

The AECE Studio — Aether Privacy & Child Safety
Privacy and account requests: support@theaecestudio.com
Help and child safety: help@theaecestudio.com
aether.theaecestudio.com