Effective date: September 29, 2026
ClayType is an AI writing keyboard made by ClayByte LLC ("ClayByte", "we", "us"). This policy explains what information ClayType handles, why, who else is involved, and the choices you have.
The short version:
To use AI features, iOS asks you to turn on Allow Full Access for ClayType. Apple shows a general warning for this setting because it lets a keyboard connect to the internet. Here is what ClayType actually does with it:
Without Full Access, ClayType still works as a regular keyboard. It just can't use AI.
When you tap an AI action, we receive the text, process it and return a suggestion. The text and the suggestion are held only in memory while the request is being handled. They aren't saved to our database, and our logs are set up to remove them.
Before sending text to an AI provider, we automatically replace some parts, such as web links, email addresses, @mentions and words from your personal dictionary, with placeholders, and put them back afterwards. This reduces what the provider sees.
If you use ClayType without an account, we create a guest account tied to a random ID made for this app install. The ID isn't taken from your device's hardware, and we store it only in scrambled (hashed) form.
Your preferences, such as English variant, favorite actions and haptics, along with any custom instructions you write and the words you add to your personal dictionary. These are the only things you write that we store, because they are how the app follows your preferences. You can change or delete them at any time.
For every AI request we record details about the request, never its content, such as:
We also keep daily usage counts. We use this for plan limits, billing, reliability and preventing abuse.
We don't collect your contacts, location, photos, or advertising or device identifiers. We don't use analytics or advertising tools that track you across other companies' apps or websites.
We use information to:
We don't use your text to train AI models, and we don't let our AI providers use it for training.
We don't sell or rent personal information, and we don't share it for advertising. We share it only with service providers that help us run ClayType, and only as much as they need:
| Provider | Purpose | What they receive |
|---|---|---|
| OpenAI | Generates AI suggestions | Text you send for AI help, with sensitive parts replaced |
| Anthropic | Backup AI provider if the main one is unavailable | Same as above |
| Apple and Google | Sign-in | Handled under their own privacy policies when you choose them |
| Hetzner | Hosts our servers and database in Finland (EU) | All server-side data listed in section 2 |
Our application uses third-party artificial intelligence service providers, including OpenAI and Anthropic, to process user-submitted content and generate AI-powered responses.
OpenAI: When we use the OpenAI API, OpenAI may retain API inputs and outputs in abuse-monitoring logs for up to 30 days, unless a different retention arrangement, such as Zero Data Retention (ZDR), has been enabled for our account or a longer retention period is required by law. OpenAI states that data submitted through its API is not used to train or improve its models by default.
Anthropic: When we use the Anthropic API, Anthropic processes submitted content in accordance with its commercial data-handling terms. Anthropic automatically deletes API inputs and outputs within 30 days, unless a different retention arrangement, such as Zero Data Retention, has been agreed for our account, or a longer period is needed to enforce its usage policies or is required by law. Anthropic states that data submitted through its commercial products and API is not used to train its models by default. Anthropic also offers Zero Data Retention arrangements for approved customers.
We do not rely on AI providers to permanently store user content. However, limited temporary retention may occur as described above for security, abuse prevention, legal compliance, or operation of specific AI features.
Where Zero Data Retention has been contractually enabled for an AI provider, applicable prompts and responses are processed according to that provider's Zero Data Retention terms.
We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or acquisition. In that last case this policy would continue to apply to your information.
Server logs, which include IP addresses, are used for security, troubleshooting, fraud prevention and service reliability. They are rotated automatically by size, so older entries are overwritten as new ones are written.
Security records, such as sign-ins, account deletions and suspected misuse of sign-in tokens, store a hashed IP address rather than the address itself. We keep them as long as reasonably necessary to protect accounts, investigate security incidents, prevent abuse, comply with legal obligations, or establish, exercise, or defend legal claims.
Data we delete may remain in our backups until those backups expire.
When you delete your account, we delete your account information, settings, dictionary and usage counts straight away. We keep request and security records only with your identity removed, for billing reconciliation and security. Those records aren't linked to your account.
Depending on where you live, you may have more rights, such as the right to object to or restrict certain uses, to data portability, or to complain to your local data protection authority. We will respond to requests within the time the law requires.
If you are in the EEA, the UK or Switzerland, we rely on these legal grounds:
If you are in California, we don't sell or share personal information as the CCPA defines those terms, and we don't use sensitive personal information to infer characteristics about you.
Where applicable, we process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data and other applicable UAE data protection and privacy requirements.
Users may have rights regarding their personal data, including rights to access, correct, restrict, or request deletion of certain personal data, subject to applicable law. We also take appropriate measures when personal data is transferred across international borders.
We encrypt data in transit (HTTPS/TLS). Sign-in tokens are kept in the iOS Keychain on your device. On our servers we store only a hashed form of the refresh token, and access tokens aren't stored at all. Access to production systems is restricted. No system is perfectly secure, but we design ClayType so that the most sensitive thing, your writing, is never stored at all.
We're based in the United Arab Emirates. Our servers and database are hosted by Hetzner in Finland, in the European Union. Text you send for AI help is processed by our AI providers in the United States. We access and manage this data from the United Arab Emirates. When personal data is transferred from the EEA, the UK or Switzerland to a country that doesn't have an adequacy decision, we use appropriate safeguards such as Standard Contractual Clauses.
ClayType is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13.
If you are under 13, please do not create an account or provide personal information through ClayType.
If we learn that we have collected personal information from a child under 13 without appropriate authorization, we will take reasonable steps to delete it.
Additional age or parental-consent requirements may apply depending on the country in which you live.
If we make significant changes, we will update the effective date above and tell you in the app or by email before the changes take effect.
ClayByte LLC
Sharjah, United Arab Emirates
Email: contact@claybyte.com