A helping hand.
With boundaries.

Your account has its own space.

Ayo uses your phone number to identify your account across WhatsApp and Telegram. On Telegram, you must share your own contact in the private chat. A phone number typed into a message is not enough to establish ownership.

Conversation history, saved preferences, files, connected-service sessions, schedules, and call records are scoped to your account. Account ownership is resolved on the server. It is not taken from an account ID supplied by a browser.

Encrypted storage for sensitive content.

Ayo encrypts stored message payloads, results, saved memories, supported file contents, and call transcripts using authenticated encryption. Saved browser sessions are encrypted too. The implementation uses AES-256-GCM, with context binding to help prevent encrypted records or sessions from being substituted across accounts.

Some operational information, such as task state, timestamps, channel identifiers, and delivery status, remains outside this application-level encryption. Ayo must decrypt relevant content while it works on your request.

Separate browser sessions.

Connected services run in account-specific browser processes and profiles. Saved login sessions are associated with their account and service. Ayo checks ownership before loading them.

You complete sensitive sign-ins and verification steps yourself through a temporary connection session. Ayo’s browser tools are designed to refuse password, one-time-code, and payment-credential fields. Do not send passwords or payment details in chat.

Short-lived access. Checked on the server.

Personal administration links and connection links are random, time-limited capabilities. Stored tokens are hashed. The server checks their expiry, ownership, and the account’s access status.

Production personal portal sessions use HttpOnly, Secure, SameSite cookies. The operator portal uses a separate Google-authenticated access check. Access to your personal settings does not grant operator permissions.

Your request sets the limits.

Ayo can prepare drafts and perform supported actions you explicitly request. A request to draft an email does not authorize sending it. A clear instruction to send a specific message can authorize that action without another confirmation.

Saved memories, documents, web pages, and other external content are treated as information, not permission to act. Before supported phone calls, Ayo requires account-number verification. It does not substitute the service owner’s phone number.

AI and automation can make mistakes. These controls reduce risk; they are not a guarantee that every output or third-party action is correct.

Controls for interrupted work.

Tasks use account-specific ordering and transactional claims to reduce duplicate execution. An uncertain external action is not treated as a confirmed success or automatically replayed as a fresh action.

Revoking an account invalidates existing personal access links and sessions, blocks further authorized work, and pauses schedules. An external action already in progress may finish. Revocation is not the same as deleting account data.

Infrastructure and service providers.

Ayo uses Google Cloud infrastructure for its application, task processing, database, and object storage. WhatsApp and Telegram carry messages. Google or OpenAI models process relevant task content, depending on the configured model. Supported voice tasks use Twilio and OpenAI.

These services have their own security and processing arrangements. We do not claim that all processing stays in one country, that AI requests contain no personal data, or that provider retention is zero.

See the privacy notice for more about the data involved.

Questions or a security concern?

Contact support@woopsapps.com. Describe what happened and which part of Ayo is affected. Please avoid including passwords, authentication codes, or other people’s private data.

This page describes the current implementation. It is not a claim of independent certification, a completed security audit, or a promise of risk-free operation.