Privacy Policy — Ayant

Effective date: 30 June 2026 · Updated: 16 October 2026 · Русская версия · Terms of Use (in Russian)

The Ayant app (“we”, “the app”) respects your privacy. This document describes what data we collect, why, whom we share it with, how long we keep it and how to delete it. If this translation differs from the Russian version, the Russian version prevails.

The data controller is Individual Entrepreneur Ibraimova Kulbara Kalievna (ИП Ибраимова Кулбара Калиевна), operator of the Ayant service, Bishkek, Kyrgyz Republic. Contact details are in section 11.

1. Data we collect

• Account: name, email and user identifier. You can sign in with Apple, Google, email and password, or as a guest (an anonymous account without a name or email). With Sign in with Apple you may hide your email — we then receive an Apple relay address. We never see your password: it is held by Google Firebase Authentication. For email sign-in we send a message to verify the address.
• Location: approximate location — only to show how far venues are. The distance is calculated on the device; coordinates are not sent to our servers and are not linked to your account. The app works without location access, just without distances.
• Bonuses, games and coupons: your bonus balance and the history of credits and debits (for example, “Snake game, +3”), coupons you bought or received as a gift and their redemption, and loyalty points and stamps at venues. This data is linked to your account — the wallet cannot work without it.
• In-app activity: which offers were shown in the feed and which were opened, saves and searches — to rank the feed and to compute anonymised statistics for venues.
• Personal library: saved venues, favourite offers, likes and the list of authors whose reviews you hid — stored in your account so they survive a device change.
• Reports: if you report a review or a photo, we keep the report, its reason and your identifier in order to review it. Neither the author nor the venue sees the report.
• Content you publish: reviews, ratings, venue replies and photos.
• Device push token: to send notifications. Venue news and offers arrive only if you allowed notifications and did not switch off “Venue news and offers” in your profile.
• Diagnostics: crash reports and technical data (device model, iOS version, app version) through Firebase Crashlytics — without your name or email.
• For businesses: business profile data (name, taxpayer number (INN), contact phone), and the venues, offers and menus you publish.
• Instagram data (businesses only, on explicit connection): the username and identifier of the connected professional account, and your posts — caption, image, post link and date. See section 5.

We do not collect data to track you across other companies’ apps and websites, and we do not show personalised third-party advertising.

2. How we use data

• to show the feed of discounts, promotions and new items, and the distance to venues;
• so you can save places, leave reviews, earn and spend bonuses, and receive coupons, points and stamps;
• to protect the bonus programme from abuse (earning limits, email verification);
• to send notifications (with your consent);
• to find and fix crashes and improve the app through anonymised analytics;
• to moderate content and handle reports.

3. Sharing with third parties

We do not sell your data. The service relies on these providers:

• Google Firebase / Google Cloud — authentication, database, server functions, analytics (Google Analytics for Firebase), crash reports (Crashlytics), push notifications, App Check;
• Apple and Google — if you sign in with Apple or Google;
• Cloudinary — image storage: photos for reviews, venues and offers, including photos imported from Instagram;
• Telegram and Groq — if you write to the support bot @bonus_kg_bot: the text of your question is sent to Groq so the AI assistant can prepare an answer. Do not send the bot passwords, card numbers or other personal data.

They process data solely to provide their services. Reviews and photos you publish are visible to other users and to the venue together with your name.

Requests from public authorities. We disclose user data to public authorities only in response to a lawful request. We review every such request for legality and validity, and where there are grounds we challenge requests we consider unlawful. We disclose only the minimum data necessary and document every request: who asked, on what legal basis, what was disclosed and when. Where the law allows, we notify the affected user.

4. Coupons and venues

When you show a QR code at a venue, the venue’s staff see that the coupon is valid, or credit you points and stamps. The venue sees anonymised statistics and reviews, but not your email.

5. Instagram connection (for businesses)

A venue owner may connect their own Instagram professional account so they do not have to retype content they have already published: a selected post becomes a draft promotion in Ayant.

• What we receive: the account username and identifier, and your posts — caption, image, post link, timestamp and media type. Only for the account that granted access.
• What we do not do: we do not read other people’s accounts, we do not publish anything to Instagram, and we do not access messages, comments or insights.
• Images: the photo of the selected post is copied to our storage (Cloudinary), because Instagram media links stop working after a few hours. The copy is used as the promotion’s image.
• The access token is stored on our server only. It is never sent to the app and never disclosed to third parties.
• Disconnecting: in the business cabinet (“Disconnect account”) or in Instagram under Settings → Apps and websites. Disconnecting deletes the token. Promotions you already created remain yours and are deleted separately.

6. Account deletion

You can delete your account right in the app: Profile → Delete account. We delete the account record and the data linked to it: reviews, the bonus wallet and its history, coupons, points and stamps, push tokens, your personal library and the reports you sent. The technical log of feed impressions linked to your account identifier is deleted manually on request (section 11). If you signed in with Apple, the app asks you to confirm once more and revokes Sign in with Apple access. The owner’s venues are taken off publication. Deletion is irreversible: bonuses and coupons cannot be restored. If deleting in the app does not work, contact us (section 11) and we will delete it manually.

7. Retention

• account, wallet, coupon and review data — while the account exists; erased after deletion;
• a guest account is deleted when you sign out of it;
• anonymised Firebase analytics is kept for up to 14 months, Crashlytics crash reports for up to 90 days;
• server function security logs — up to 30 days.

8. Children

The app is not intended for children under 13; we do not knowingly collect their data.

9. Your rights

You may request access to your data, its correction or deletion, switch off venue mailings in your profile (“Venue news and offers”), and withdraw access to notifications, location, camera and photos in your device settings.

10. Changes

We may update this policy. The current version is always available at this address; we will announce material changes in the app.

11. Contacts

WhatsApp: +996 707 266 556 · Email: ostepp1@gmail.com · Telegram: @bonus_kg_bot