Privacy Policy — AYNI

Last updated: 14 October 2026

Summary — in plain language

AYNI is an interactive Earth science globe from Pachamama Studios. This page explains what the app records, what it never records, and the choices you have.

• Nothing is reported about how you use the app unless you allow it. The first time you open AYNI it asks. "No thanks" is a full answer; the app works the same either way.
• We do not use advertising, tracking cookies, or third-party analytics services.
• Using AYNI XR needs a free account (your email address, or your Google sign-in). Joining a room or a meeting through its link does not need one.
• We set a cookie only when you need one: when you play a real-time stream (it counts your free weekly viewing allowance), and when you sign in (it keeps you signed in).
• If you buy a plan online, Paddle sells it to you as our reseller and handles your payment; we never see your card or address. Section 6 says what we and Paddle exchange.
• Chatting with the chatbot and sending feedback each send what you type or submit to our servers, because that is what those features do. Sections 4 to 6 say exactly what.
• You have rights over your data under EU law — access, deletion, objection, and others. Section 10 lists them.

Nothing is sold, shared with advertisers, or used to build a profile of you.

1. Who is responsible

AYNI is operated by Pachamama Studios B.V., John M. Keynesplein 4, 1066 EP Amsterdam, the Netherlands (Chamber of Commerce (KvK) 97171298, VAT NL867939217B01). Pachamama Studios B.V. ("Pachamama Studios", "we") is the data controller for the processing described here.

Contact for anything on this page, including requests under section 10: privacy@pachamama-studios.com

AYNI is built from the open-source TerraViz project and uses the NOAA Science On a Sphere dataset catalog as a source for many datasets; AYNI serves its own copy of them. Original project source: https://github.com/zyra-project/terraviz.

2. What happens when you just open the site

Serving the pages. AYNI is hosted on Cloudflare. To deliver any page, Cloudflare's network necessarily sees your IP address and the technical details your browser sends with every request (browser type, language, the page asked for). We use the IP address briefly, in memory, to limit abuse of our endpoints (for example, too many chat requests per minute); we do not write it to our databases.

Preferences kept on your device. The app remembers your settings in your browser's own storage so you do not have to set them again. None of this is sent to us:

• Your language, interface size, and view options (labels, borders, legend, layout, browse view, and which Browse tab you used last)
• Your answer to the telemetry question (section 3)
• Playlists you create, and a note of the ones you deleted (so that, if you sign in, a deleted playlist does not come back from another device). Signed in, playlists are also kept on your account (section 6)
• The colours you chose for a dataset (palette, its direction and colour limits), by dataset, and a note of the ones you reset. Signed in, they are also kept on your account (section 6)
• The catalogue's search index for "related by meaning" results: a numeric summary of each dataset's public description, kept so it is not fetched again. It holds nothing about you
• Visit memory — the datasets you have opened and roughly how long you looked at each. It powers Browse's Recent tab and the "new since your last visit" badge. It is off until you say yes: the first time you open the app we ask, as a question of its own, and nothing is kept before a yes. Wipe it any time with Tools → More → Privacy settings → Clear visit history, or switch it off there ("Remember the datasets I open, on this device"), which also wipes it
• In AR, the identifier of the spot where you placed the globe, so it returns to the same place
• Your current chat with the chatbot (kept only until you close or reload the tab)
• If you present a meeting, which camera and microphone you chose
• If you teach with the AYNI lessons, the view you keep for a lesson step: where the camera was and which date was shown
• If you switch on Record this session (Research and Situation Room plans), the research record you are making, until you save it, download it or close the tab: the views you stopped on, the numbers you read, and the names and SHA-256 fingerprints of the files you exported (with a copy of the CSV files). Nothing is recorded until you switch it on

Clearing your browser's site data removes all of it.

3. Usage reports (telemetry) — only with your consent

Telemetry is off until you allow it. The app asks once, the first time you open it; you can change your answer at any time under Tools → Privacy, and the change takes effect immediately. If you never answer, nothing is reported.

When AYNI is embedded inside another website it does not ask, so it reports only if you had already allowed telemetry on AYNI itself in the same browser.

Essential (if you allow it)

Events about the health and use of the app:

• That the app started — with the app version, platform (web or mobile), operating-system family only (never the version), your browser's language setting, three bucketed screen signals (viewport size class, aspect-ratio class, display class — never your exact resolution), whether your device supports VR or AR, which build you ran, and a true/false flag for whether the request came from our own signed-in staff (never the email)
• The country your request came from, as a 2-letter code. Cloudflare derives it from your IP address; the IP address itself is not stored with the event
• That a data layer was loaded or unloaded — which layer, how long it took, how long you viewed it
• Where on the globe the camera settled, and where you clicked — coordinates of the view, rounded to about 100 metres. This is where you were looking on the globe, not where you are
• When you change layouts, open the tools menu, or change a setting — the name of the setting only
• When you enter or leave VR / AR — duration, exit reason, approximate frame rate, and a device class (for example "Quest")
• Periodic performance samples — frame rate, and a short code standing for your graphics hardware model
• When something goes wrong — the kind of error and a short summary with URLs, emails, numbers and file paths stripped out before it leaves your device
• That you submitted feedback, and which category — not its content

Research (a separate opt-in)

If you choose Research under Tools → Privacy, the app additionally records:

• How long you spend on each panel
• When you search the catalog — a shortened hash of your query plus its length and result count. The hash hides the text from casual view, but a common word could be recovered from it by someone determined, which is one reason this is opt-in
• In VR / AR: gesture types and magnitudes
• For errors: function names from our own code, without paths or line numbers

We use Research data to study how people explore Earth-observation data. Results may be published or shared for research only in aggregated form, without session identifiers.

How the events are tied together

Every event carries a session ID: a random identifier created when you open the app and discarded when you close it. It is never stored on your device and is new on every visit, so two visits cannot be linked by it. Within one visit it does link your events together, and combined with the fields above an unusual device in a small country could in principle be singled out. For that reason we treat telemetry as personal data under EU law, not as anonymous data.

What telemetry never contains

• Your name, email address, or account
• The text of your chats or searches
• Your location. We never ask for geolocation permission
• Your IP address, exact screen resolution, browser version, fonts, time zone, or user-agent string
• Anything about other sites you visit

4. The AYNI chatbot

The chatbot (Ask Ayni Chatbot, bottom left) is an AI system. Its answers are generated by a language model and can be wrong. It comes with the AYNI XR plans: you need to be signed in, with a plan that includes it.

What is sent, each time you ask: your question; what the globe shows (the dataset, its date, the place you are looking at); the catalogue entries that match your words; and, when it reads values or pins for you, those values. While it answers, the chatbot may make several requests to the model, each carrying the conversation so far. They go to our server, then to AYNI's AI service on Cloudflare, which runs the model on Cloudflare Workers AI.

What is kept:

• The conversation lives only in your browser tab and is gone when you close or reload it.
• Our server keeps a count of how many requests your account made that day, for two days, to apply the daily limit. AYNI's AI service counts the site's requests per day in the same way.
• Neither our server nor AYNI's AI service records what you wrote or what the chatbot answered.

There is no voice, no rating and no picture of the globe: the chatbot works by typing only.

5. Feedback you send us

When you submit a bug report, feature request, or other feedback, we store:

• The text you wrote and the category you chose
• The address of the page, your browser's user-agent string, the app version, and the dataset that was loaded
• A screenshot, only if you chose to attach one
• A name, email, or handle, only if you chose to give one — used solely to follow up on your report

Who can read it: only Pachamama Studios staff, in two ways. Either signed in to AYNI XR with an account we have named as an AYNI admin in the site's settings, or with a private access key we use for scripts. No other account can read feedback.

6. Other features that use data

Real-time streams — one cookie

Real-time streams have a free weekly viewing allowance. To count it, the first time you play one we set a cookie named ayni_rt_visitor holding a random identifier. It is used for nothing else, is not readable by scripts, and is never shared.

• The cookie lasts up to one week, as long as the weekly allowance it counts
• On our side we store only the number of seconds watched against that identifier for the current week; that record deletes itself after about nine days

Because the cookie is strictly necessary to provide a metered service you asked for, it does not require consent under EU cookie rules. If you block it, each visit is counted as a new visitor.

Searching the catalogue

When you type in Browse's search and pause, the text of your search is sent to our server and on to Cloudflare Workers AI, which turns it into numbers that let the app find datasets "related by meaning". It is used only to answer that search: we do not store it, and Cloudflare states that it does not use it to train models. The datasets' descriptions are processed the same way; those are public and are kept so they are not processed twice. The search itself runs in your browser and sends nothing until you pause.

Accounts

You need a free account to use AYNI XR, except when you join a room or a meeting through its link. Without a session, the site's address shows a welcome page instead of the app; to decide, the server reads your session cookie (below) and nothing else. Your first sign-in creates the account, in one of two ways:

• An emailed link. You type your email address and we send a one-time link through our email provider, Mailjet. The link works once, for 15 minutes. We keep only a scrambled form (a hash) of it, and delete it a day after it expires.
• Continue with Google. Google confirms who you are and tells us your name, email address and Google account identifier. We ask for nothing more: no contacts, files or calendar. Google handles your Google account under its own privacy policy.

Your account keeps your email address, your name (from Google, if you used it), when it was created and last used, and the AYNI XR licences on it, with which one is in use (next section). Signing in sets one cookie, __Host-ayni-session, which keeps you signed in for 30 days from your last visit. It holds a random code that page scripts cannot read; we keep only a hash of it. Sign out ends it on that browser.

An account with no licence that nobody has signed in to for 24 months is deleted automatically. Account → Delete account deletes yours and everything kept for it at any time.

Lessons and other Khipus. With an Education plan, the lessons are read from our server when you open the Lessons tab or start a lesson; we check your plan and record nothing about which lessons you open. The views you keep for a lesson's steps stay in your browser, and Download my lesson builds your file on your device. Save to my account keeps your version of the lesson on our server (in its own database, with Cloudflare): the lesson as you set it (its steps, the camera and date you kept for each, and a credit line only if you typed one), linked to your account. Nothing about students is in it. With an Education plan it is kept 90 days from your last save; with the add-on that keeps them, and on the other plans, until your licence ends plus 30 days. In those 30 days you can still download or delete your lessons, but not save new ones. Then they are deleted automatically; if your licence was renewed, they stay. Delete in My lessons removes one at once, and deleting your account removes them all. Their datasets come from our own library at catalog.pachamama-studios.stream (Cloudflare). The same applies to any other Khipu you save to your account (since 7 October 2026): a story, or a meeting saved as a Khipu (what it holds is under Meetings). Record a Khipu (since 8 October 2026) notes, in your browser only, the dataset, view (with its rotation and tilt), date, overlay and spin of the globe you stop on (or record with Record this view), the places of the pins you put on it, and the notes you type, with no name; nothing is sent until you save it to your account or download it, and Discard or closing the page forgets it. Opening a Khipu file from your computer reads it in your browser; nothing of it is sent to us. When a NOAA dataset opens, the app asks our server whether that dataset has a Khipu (/api/stories); nothing about you is recorded.

Research records. With a Research or Situation Room plan, Record this session (off until you switch it on, with a "Recording" mark on screen while it is on) notes what you do on the globe: the datasets you open, each view you stop on (dataset, date, camera, layers, the link that reopens it and its citation), pins and the values they read, statistics, baselines, comparisons and trends with their numbers, figures (their settings), methods paragraphs you copy or save (their text), areas over a threshold with their numbers, and the files you export: each file's name, kind, size and SHA-256 fingerprint, and a copy of the CSV files (up to eight). Numbers the chatbot works out for you while a record is running (a trend, a comparison, a value it reads) go in as entries marked as the chatbot's; never what you or the chatbot wrote. It does not record your name, the conversation with the chatbot, voice or camera. Put my name on the record (off by default) adds your account's display name to each entry; that is your choice, and you can untick it before saving. Download builds the file on your device. Save to my account keeps the record and its CSV copies on our server, in the same database as saved lessons (Cloudflare), linked to your account, until your licence ends plus 30 days, like saved lessons; Delete removes one at once, and deleting your account removes them all.

Lab space. On a licence with the research tools and more than one seat (Lab, Department, Situation Room teams, or a custom licence with both), Lab space (Tools → Data) lets the people who hold that licence's seats share work with each other. Nothing is shared until you press a Share button. What you share is kept on our server, in the same database as saved lessons and research records (Cloudflare): a view (the dataset, date, camera, layers), a set of up to four pins (their places and names), a baseline's definition (the dataset, the date or years and the region, not its numbers), or a copy of one of your saved research records with its CSV files; each with the title and note you type, when it was shared and changed, and your account as its author.

Your name in Lab space. The others see your display name on what you share, never your email address, and only while you hold a seat. A research record is shared without names unless you choose Share with my name when sharing it (asked each time, for a record you made with "Put my name on the record"); even then only your own name can be in it. A copy another member makes of it carries no name, and once you no longer hold a seat, the record is shown without your name.

Who sees it: everyone who holds a seat of the same licence, and nobody else (not us, except to keep the service running, and not people on other licences). Anyone who has the licence key can take a seat, so the lab's owner sees the list of the members holding a seat (their display names and when they joined) and is told when someone new joins; whoever manages the licence can free a seat. When you give back your seat, remove the licence from your account, or your seat is moved to someone else, you lose access at once (at the latest when your licence is next checked, within five minutes). Whether others still hold a seat is read from what their accounts last told us: someone whose seat was freed while they stay away still counts, and is still named on what they shared, until their licence check runs out (at most 14 days); then what they shared stays with the lab as shared by "a former member". To decide who is in a lab we keep, per lab, a scrambled form of the licence's identifier, and for each member their account, when they joined and when they were last seen holding a seat, and when the owner last looked at the member list. The lab's owner is the first member who still holds a seat, or whoever the owner hands the role to; the owner may delete anything in the lab. Requests are counted per account per hour to stop abuse; old counts are deleted within a few hours, the next time anyone uses Lab space.

How long: while the licence runs and 30 days after; in those 30 days the members can still open, download and delete, but not share; then everything in the lab is deleted automatically, the next time anyone uses Lab space or signs in to AYNI XR (if the licence was renewed, it stays). Delete removes something you shared at once. Another member may Copy what you shared as their own; that copy is theirs and stays if you delete yours (without your name). Deleting your account deletes everything you shared, and any copy still carrying your name, and forgets you as a member; if that cannot be done at that moment, your account is not deleted and you are asked to try again.

Playlists on your account. While you are signed in, your playlists are kept on your account so they appear on every device you sign in on: each playlist's name, the datasets in it and how each plays (wait for a click, or a number of seconds), when it last changed, and which playlists you deleted in the last six months. Nothing else. Signed out, playlists stay in your browser only. They are deleted with your account, and with an unused account after 24 months.

Colours on your account. While you are signed in, the colours you chose for each dataset are kept on your account so they appear on every device you sign in on: for each dataset you changed, its id and the palette, its direction and the colour limits you set, when you changed them, and which datasets you reset in the last six months. Nothing else. Signed out, they stay in your browser only. They are deleted with your account, and with an unused account after 24 months.

There is no separate sign-in for publishers: the publishing portal we inherited, which used Cloudflare Access, was removed on 6 October 2026, and nobody can sign in as a publisher.

Google user data

When you choose Continue with Google, this is how AYNI XR handles the information it receives from Google:

• What it receives: only your name, your email address (and whether Google has verified it), and your Google account identifier. These come from the openid, email and profile permissions you are asked to grant. It does not request access to your contacts, files, calendar, photos, or any other Google data.
• How it is used: to create your AYNI XR account, sign you in, and show you which account is signed in. Your email address is also the label of your licence seat, so the licence holder can see who uses its seats (section 6, "Plans and licence keys"). Nothing else.
• How it is stored: in your account record in our database (Cloudflare, section 7), for as long as the account exists. It is deleted with the account, or automatically after 24 months without a sign-in if the account holds no licence.
• Who it is shared with: no one, apart from the licence seat label just described. It is never sold, never used for advertising, and never used to train AI models.
• How to remove it: delete your account (Account → Delete account), and you can withdraw AYNI XR's access at any time at myaccount.google.com/permissions.

AYNI XR's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Plans and licence keys

Requesting an invoice. If you ask for a plan from the plans page, we receive the plan, the packages and seats you chose, and the details you type: organisation, your name, the email for the invoice, country, and if you give them a VAT number, a purchase-order number and a message. We use them to prepare your invoice and your licence, and keep the request for 24 months, after which it is deleted automatically. A copy of the request is emailed to us so we can answer it: it is sent through our email provider, Mailjet, to our mailbox, which Google hosts (section 7). Invoices themselves are kept as accounting law requires.

Using a licence key. A licence key is entered while you are signed in, and is held by your account, not your browser. Our site's server sends the key to our licence server (licence.pachamama-studios.stream, run by us on Cloudflare). With it go an identifier made for your account and a label with your account's email address, such as "AYNI XR account ana@school.example". The licence server keeps these as one of the licence's seats, with when it was activated and last checked, so the licence holder (for example your school) and we can see who holds its seats. One account takes one seat, however many devices you use. Our server keeps the signed licence with your account and checks it with the licence server every few hours while you use it. When the licence ends, the ended licence stays on your account for 30 days (it no longer gives any plan), so that what you saved or shared under it can still be opened, downloaded and deleted in those 30 days; then it is removed. Remove it any time from Account → Your plan → Remove from my account, which also frees the seat.

Several licences (since 10 October 2026). An account can hold up to five licences, for example your own and a seat your school gave you; each is one seat of its own licence, with the same identifier and label. We keep each signed licence as above, which one you chose to use, and, when the licence in use ended or was taken away and another took its place, a short note saying so (which plan, the last characters of its key, why, and when) until you have seen it. Each licence holder sees only the seat on its own licence, never your other licences.

Meetings hosted on a licence (since 10 October 2026). When you start a meeting as a signed-in account, our server notes your account, which of your licences and plan hosted it, and when, so a licence holder can be answered about how its seats were used. Nothing about the people in the meeting is in it. It is kept 12 months, then deleted, and deleted with your account.

Render credits. With a Media plan (Media Desk or Newsroom), our server keeps a ledger of your render credits with your account (in our accounts database, with Cloudflare): each movement, with its amount and date — the plan's yearly allowance, a credit pack you bought (with the payment provider's transaction reference, so a refund can be matched), credits reserved for a render you ordered and whether they were spent or given back. It holds no card or bank details and nothing about what a render shows. Deleting your account deletes the ledger. On a Newsroom plan the credits belong to the team: everyone holding a seat of the same licence spends from one shared balance and sees the team's orders and videos. Brand kits you make in the Studio (a name, a logo image, a lower-third line and a colour) are kept with your account, or your team's on Newsroom; a shot keeps a copy of the kit it uses. Deleting your account deletes your own kits. On a Newsroom licence, the Studio notes who on the team uses it, which of them are editors, whether orders need an editor's approval, and who asked for and who decided each approval. The team's editors see the email addresses of the team members who have used the Studio. Deleting your account takes you off the team and deletes the approvals you asked for.

Renders (not yet open; this describes how they will work). When you order a render of a shot you saved, our server keeps the order with your account: a copy of the shot as ordered (the same content as the saved Khipu), its size and price, and where it stands. A rented graphics server opens the shot on AYNI's site with a key that opens that one order for two hours, draws it frame by frame and sends the finished file back to our storage (Cloudflare, in the EU), where only your account (or your Newsroom team) can download it for 30 days; then it is deleted. If you choose Keep (1 credit), it stays until your licence's current term ends, and you can keep it again after a renewal; then it is deleted. A video's poster (its first frame) is kept and deleted with it. The rented server receives the shot and the public data streams, never your account or your name. Deleting your account deletes your orders and their files.

Voice-overs. If you add a voice-over to a video, the recording you upload is kept in our storage (Cloudflare, in the EU) with your account, with the file's name and your confirmation, and its time, that you own the recording or have the rights to use it. Only your account can remove it; the rented graphics server reads it only with the key of an order that uses it, to lay it under that video. We do not listen to, analyse or transcribe it, and we share it with no one. It is deleted 30 days after you upload it, when you remove it from the video (Remove the voice-over), or when you delete your account; the finished video keeps its sound for as long as the video is kept. A recording of someone's voice is their personal data: upload only recordings you may use, and tell the people whose voices are in them.

The Situation room (Situation Room plans)

On a Situation Room plan, Tools → Situation room keeps a room for the whole licence on our server, in the same database as saved lessons (Cloudflare). Everyone who holds a seat of the licence can see and change it; nobody else can.

• What the room keeps. The board (the views the room's screens show in turn: datasets, dates, camera; no names, and nothing about who changed it); the wall displays paired to it: the name you give each screen, when it was paired and when it last asked for the board, and a scrambled form (a hash) of the secret the screen holds, never the secret itself; the meeting put on the walls (its code and audience link, until it ends); and your organisation's own layers: from each GeoJSON, KML or KMZ file only the shapes and each feature's name and description are kept, with the title you give the layer. To decide which room is yours we keep a scrambled form of the licence's identifier, as for Lab space.
• Your own layers may hold personal data (an address, a person's name in a description). Your organisation decides what goes in them and is responsible for it; we keep and show them only to the licence's seats and its paired screens, for the room to work.
• A wall display has no account. It shows a six-character code until a member pairs it; while it waits, its pairing code and a hash of its own secret are kept for at most ten minutes, and requests are counted per hour by a scrambled form of its internet address (never the address itself) to stop abuse. Once paired, it keeps its secret in its own browser (local storage) until it is unpaired.
• Your layers in a briefing meeting. While a member presents a meeting, the page tells us which own layers it shows (proving it is the presenter with the meeting's signed presenter link). Everyone in that meeting may then read those layers, as they see the presenter's globe; we keep only a scrambled form of the meeting's code and the layers' identifiers, until the meeting ends (at most 8 hours), then delete it.
• Briefings. A briefing you record keeps what was shown and decided, without names unless you tick Put my name on the record (your display name is then on every step of it). It stays on your device until you save it to your account (kept like saved research records, until the licence ends plus 30 days), download it, or print its pack.
• How long: while the licence runs and 30 days after; then the room and everything in it is deleted automatically, the next time anyone uses it. Unpair and Remove delete a screen or a layer at once.

Your own data (Researcher and Lab plans)

With a Researcher or Lab plan you can send us your own data files (for example a NetCDF model run) to see them on the globe as private streams. This service is being set up: until the My data tab appears in Browse, we receive none of what this section describes.

• What we receive. The file, encrypted on your device before it leaves, with a key made for that dataset alone; its name, size and the title you give it; and a fingerprint of the file (its SHA-256 hash) that your browser computes, so we can show the file we stored is the one you sent. It is stored with Cloudflare R2 in its EU jurisdiction (bucket ayni-research), which is never public.
• Processing. Our intake server, at Hetzner in the EU, decrypts the file only while it works on it, reads its variables, converts the one you choose into a stream for the globe, measures how far the stream's values are from yours, and writes the stream, your exact values (again encrypted with the dataset's key) and a signed record of what it did. Its working copies are deleted after each job, and a restart of the server erases them all.
• Who can see it. You and, on a Lab plan, the other people who hold your lab's licence (the lab's owner can make someone view only, or hand the owner's role on); someone who no longer holds it loses access, and the person who deletes and exports for the lab is the owner. Each viewing needs a token for that dataset that our server gives for 10 minutes at a time. Your data is never public unless you publish it openly (below), never in our catalogue, and never used for anything else, including training AI models.
• Sharing. You can let others view a dataset in AYNI XR. They do not get its exact values and cannot change, share or delete it; like anything on a screen, what they see can still be captured. You can share with:
  • someone by email — we keep the address you type until that person signs in to AYNI XR with it (their account is then linked to the share and the address is deleted), or until 30 days after the share ends, and we email them once through Mailjet that you (by your display name, if you have one) shared a dataset with them, without its title;
  • a link — it holds a random secret that we show you once and keep only in a scrambled (hashed) form; anyone signed in who opens it, and chooses to open the dataset after we show them what it is, can view it until it ends (at most 30 days) or you withdraw it, and we record which accounts opened it. If someone opens a link before signing in, this browser keeps it at most an hour;
  • a meeting you present — only after you confirm a notice saying so: everyone in the meeting, signed in or not, can view it until the meeting ends or you stop, and each viewing is logged; we do not store the meeting's code, only a scrambled form. You see who has access and can withdraw it at any time; it then ends within 10 minutes. The people you share with see your display name, not your email address. What you shared ends when you leave the lab, become a viewer or delete your account.
• Confirming risky actions. Before sharing, deleting a dataset, deleting your account, adding a continuous source, publishing openly, changing someone's role or changing your passkeys, we ask you to confirm with a passkey, or, if your account has none, with an eight-digit code we email to your account's address (after 15 wrong codes in a day, codes are locked for a day and we email you). For a passkey we keep only its public key (never your fingerprint, face or PIN, which stay on your device), its identifier, the name you give it, when it was added and last used, and a counter; it is deleted when you remove it or delete your account. We email you whenever one is added (with a single-use link, valid 7 days, that removes it and signs your account out everywhere if it was not you) or removed. A lost passkey can be removed with an emailed code, 72 hours after you ask, with an email then and a day before. Of a code, a passkey challenge or that link we keep only a scrambled form, and delete codes and challenges a day after they expire.
• Publishing openly (when this is switched on). The lab's owner can publish a dataset under the CC BY 4.0 licence: anyone can then view, download and reuse its current release, crediting you, until you withdraw it; copies already taken cannot be called back.
• Continuous sources. You can give us read access to your own S3-compatible bucket so new files are processed as they arrive. We store the address, bucket, prefix and region you give, and the access key you give, which is encrypted at once with your lab's key and never shown again (we show its last four characters to help you recognise it). Only our intake server receives it, to read your bucket; our website never connects to your bucket. We test that the key cannot write and refuse and delete it if it can. It is deleted when you delete the source, when its dataset is deleted, or when the account that added it is deleted. Alerts about the source (for example a release that missed your tolerance) are kept for you and emailed to whoever added it, at most once a day for each kind.
• The keys. Each dataset's key is stored only in a scrambled (wrapped) form, which only keys held in Cloudflare's secret store can unwrap. Delete destroys the dataset's key at once, so every encrypted copy (your original and your exact values) becomes unreadable ("crypto-shredding"), and at the same moment removes what our database said about the content (its title, file name, the list of variables and their value ranges, your choices and the accuracy figures). It then removes the files, and checks again a day later for anything still being written. What protects what: your original file and the exact values are encrypted with the dataset's own key; the stream made for the globe (its video, thumbnail and colour bar) is not encrypted by us and is protected by access tokens only, so it is shown only to the people allowed to see the dataset. Two limits: the stream itself (the video the globe plays) is not encrypted by us, so it is deleted rather than shredded, and a copy may stay in Cloudflare's cache for up to an hour, never shown to anyone; and Cloudflare's database keeps restore points for 30 days, so a destroyed key could be brought back from them within that time, and not after.
• How long. Until you delete it, while your plan is active. If your licence ends, we email its owner twice, and 30 days after the end everything is crypto-shredded; a renewal before then keeps it. An upload you do not finish is deleted after a day. Deleting your account deletes your data too; on a Lab plan, data stays with the lab while others hold its licence.
• The custody record. To let you prove what happened to your data, we keep a log of who uploaded what, what was done to it, every viewing token issued (which account, which dataset, when, and through which share), every share made, opened and withdrawn, role changes, continuous sources added and their releases, custody downloads and deletions, including a deletion certificate. It holds account identifiers, file fingerprints, sizes, dates and names of actions, never your data, its values, file names, email addresses or your bucket's address, and is kept for 10 years, even after deletion. You can download it from your datasets.
• Personal data. Our terms do not allow files with personal data unless your institution has signed a data processing agreement with us. For what is in your files, you decide what is processed and we act on your instructions.

Buying a plan online. Plus, Teacher, School, Researcher and Lab can be bought online through Paddle (Paddle.com Market Limited, United Kingdom), which sells them to you as our reseller ("merchant of record"): Paddle is the seller on your receipt, charges your country's VAT, and handles your payment, refunds and invoices under its own buyer terms and privacy policy.

• When you open the plans, your browser asks Paddle for the plans' prices in your country, with VAT. Paddle sees your IP address for this, and nothing else about you.
• When you press Buy, you must be signed in. Our server makes a random checkout reference and gives your browser your account's email address, which fills Paddle's checkout in. Paddle's checkout then opens over the page, and your browser sends Paddle that reference and an identifier of your account, so the payment reaches your account and nobody else's. Everything you type in the checkout (name, address, card or other payment details, VAT number) goes to Paddle only; we never receive it.
• From Paddle we receive only what ties the subscription to your account: Paddle's ids for the subscription and the customer, the plan and packages bought, monthly or yearly, its status (active, payment failed, paused, cancelled) and its dates, and whether a payment was refunded or disputed (which ends the plan). We use them to put the plan on your account and to show it in Your plan.
• Your licence. To put the plan on your account, our site's server tells our licence server (licence.pachamama-studios.stream, run by us on Cloudflare) what the subscription bought: Paddle's ids for the subscription and the notification, the plan, its seats and packages, its dates, the identifier made for your account and your account's email address. The licence server makes the licence in your name, takes its seat for your account as with a key you enter yourself ("Using a licence key" above), and keeps each order it was sent, sealed, so that one sent twice is applied once; the licence and its history are kept as for every licence. For a licence for several people (School, Lab), Your plan → Show the key to share asks it for the licence's key each time; we do not keep the key.
• A payment link from Paddle (for example in its email to update your card) opens Paddle's checkout for that payment directly in AYNI XR, signed in or not; what you type there goes to Paddle only.
• Managing it. Your plan → Manage subscription asks Paddle for a one-time link to its billing page for you, where you cancel, change the card and download invoices. An account cannot be deleted while its subscription still runs: cancel it there first.

Shared sessions (rooms and meetings)

If you open AYNI through a room or meeting link, your device joins a shared session relayed by a small service we run on Cloudflare. The device that leads sends a short description of what its globe shows — the dataset, the playback position, the view, the layers, in AR how the sphere is turned and sized, and, while it plays a Khipu, the Khipu's title and the step's title, captions and pins — and the others follow it. When the leading device shows several globes, the description covers each globe: its dataset, how its date follows the main globe's, its view, and the random identifier of the participant driving it, if the presenter handed it to one; that participant's device then sends where its globe is pointed, and what it shows, in the same way. The room holds the latest description in its memory only, to pass it on. No name or account goes to the room: each connection gets a random identifier that lasts only for that session, and the room keeps nothing once it ends. To let someone in, the site reads your session cookie and tells the room only two things: whether you are signed in (a guest only watches) and how many people a room you open may hold (your plan's size).

A meeting's presenter can go live with camera and microphone. Only when the presenter presses "Go live" does their browser send their camera picture and microphone sound through Cloudflare Realtime, a relay that passes it on live to the people in that meeting. We do not record or store it, and neither does the relay; it stops when the presenter presses Stop or leaves. People watching send no camera or sound: they only receive the presenter's. A participant the presenter has handed a globe to can put their microphone on, by pressing the button that says so, beside these same words; their sound then goes through the relay to the meeting in the same way, never their camera, and stops when they press Stop, give the globe back, have it taken back or leave. A presenter's choice of camera and microphone is remembered in their own browser.

Activities in a meeting. The presenter can ask the room to explore, to answer a question by tapping the globe, or to pick an option. While one runs, the room service receives, in its memory only: where each participant's globe is pointed while exploring (sent every few seconds, and combined into cells about 300 km across before the presenter sees it), the pins and notes they choose to drop, and their answers. The presenter and moderator see the pins and notes, and the totals; on a reveal everyone sees the answers, without names. A display name is optional, typed by the participant, kept only in their browser tab and the room's memory, and shown to the presenter and moderator with their pins and raised hands. If the presenter hands a participant the globe, or one globe of several, everyone sees that participant's name (or "a participant" if they gave none) on it while they hold it.

Since 12 October 2026 a meeting keeps, for as long as it lasts, what each participant gave in its activities, so that a reload or a dropped connection loses nothing. To know a participant again, their browser makes a random code for each meeting, keeps it in its own storage (it is cleared after three days without use) and sends it with every connection; it is never shown, and it is not linked to an account. The meeting's room service stores, under that code, the participant's number in the meeting ("Guest 3"), the name they chose to give, and their answers and pins activity by activity. The presenter and the moderators can read each activity's answers next to the names; a poll is anonymous, and only its totals are kept for the presenter and shown to everyone. Each participant can read their own answers. If the presenter or a moderator removes someone from a meeting, the room keeps that browser's code to refuse it until the meeting ends. All of it is deleted when the meeting ends, or at once when the presenter presses End meeting; nothing is written to a database, and nothing leaves the meeting.

Games in a meeting (Education plans, since 10 October 2026). While the presenter runs a game, the room service keeps, for the meeting only: each player's game name (two words the room picks, such as "Glaciar Valiente"; nobody types one), their table, their answers and points, and a random code their browser tab makes so a dropped connection comes back as the same player (it stays in that tab and is never shown to anyone). Typed display names are not shown to anyone while a game is on. The presenter's page receives the players' pins of a data round to score them from its own globe. In the table games (Wayra's Adventures, Team Earth) the room also keeps each table's game: the places or cards each player voted for, and when they last pressed something, which the game uses to tell who is still playing. Players see their own points and place, the top five game names and the tables' totals. All of it is deleted when the presenter closes the game or the meeting ends; nothing is written to a database or linked to an account.

The presenter can save the meeting as a Khipu. It is made on the presenter's own device: the datasets and views shown, each question with its totals, and the pins with their notes — never anyone's name, chat, voice or camera. Download saves it on the presenter's device; Save to my account, on a plan that keeps Khipus, keeps it on our server like their other Khipus (see Lessons and other Khipus).

An output window (Tools → More), including a sphere output, follows the window that opened it on the same computer: what the globes show, and for a sphere output the Data tab's pins, pass between the two windows inside your browser and are not sent to us. In a meeting, an output window joins the meeting as one more participant's device would.

AR and VR

In AR, the camera view you see is drawn by your device, not sent to us. If you scan a shared-session marker, camera frames are examined on your device to find it and are never uploaded or stored.

Datasets and maps

The datasets come from AYNI's own servers (on Cloudflare, section 7): the NOAA Science On a Sphere datasets — their list, videos, pictures, legends, captions and thumbnails — and the cloud layer of the globe are copies AYNI keeps in its own storage, and the live data streams are AYNI's own. Your browser does not contact NOAA, Amazon or any video service to show them.

The globe's map imagery from NASA, its street map (OpenFreeMap) and its terrain (elevation tiles from Amazon's open-data registry) are fetched by our server on your behalf, so those services do not see your address.

Media from third parties

Some content is delivered by others, and your browser connects to them directly when you open it — which necessarily shows them your IP address:

• NOAA's stories (Khipus) and their datasets load from AYNI's own servers; a link in a story to another site opens in a new tab only when you press it. Nothing from another site is embedded in the app
• The pictures and clips someone adds to their own Khipu load, when its step is shown, from the site its author gave (an https address); that site sees your browser's request, as with any picture on the web. Its links open in a new tab only when you press them
• Live radio and camera streams, where offered, play directly from the broadcaster

7. Who receives your data, and where it goes

Cloudflare, Inc. is our processor for everything we host: page delivery, the functions behind the app, databases and file storage, the AI and speech models, sign-in, and the live relay of a meeting presenter's camera and microphone, and of the microphone of a participant handed a globe (Cloudflare Realtime). Cloudflare acts on our instructions under its Data Processing Addendum.

Cloudflare is a United States company with a global network, so your data may be processed outside the European Economic Area. Those transfers rely on Cloudflare's certification under the EU–US Data Privacy Framework and on the EU Standard Contractual Clauses in its Data Processing Addendum.

Online payment (section 6, "Buying a plan online"): Paddle (Paddle.com Market Limited, United Kingdom) sells the plan to you as our reseller and is an independent controller of the purchase: your payment, address, tax and invoice details, under its own privacy policy. It receives them directly from your browser, plus the checkout reference and account identifier described there, and your account's email address. The United Kingdom has an EU adequacy decision; Paddle may use processors elsewhere, as its policy says.

Your own data (section 6, "Your own data") is also processed by Hetzner Online GmbH (Germany), which runs our intake server in its EU data centres, as our processor. Its files stay in Cloudflare R2's EU jurisdiction.

Invoice requests and sign-in emails (section 6, "Accounts" and "Plans and licence keys") also reach two more processors, and only these:

• Mailjet (Sinch Mailjet SAS, France) sends invoice requests to us and sign-in links to you, and, for your own data, confirmation codes, invitations to a shared dataset and alerts about a continuous source. It stores and processes email in the European Union.
• Google (Google Workspace) hosts the mailbox invoice requests arrive in, under Google's Cloud Data Processing Addendum. Google may process them outside the European Economic Area, under the EU–US Data Privacy Framework and Standard Contractual Clauses.

Renders, once they open (section 6, "Plans and licence keys"), are drawn on graphics servers rented from Modal (Modal Labs, Inc., United States) in its European region, as our processor: it receives the shot and the public data streams for the length of the render (and, for a video with a voice-over, that recording), and nothing about you. Transfers rely on the EU Standard Contractual Clauses in its data processing agreement.

If you choose Continue with Google, Google confirms your identity to us as an independent controller of your Google account, under its own privacy policy.

The third parties in section 6 (YouTube and Vimeo in tours and stories, broadcasters, your browser's speech service) and any AI provider you configure yourself receive data directly from your browser, as independent controllers under their own policies. Several are in the United States.

We do not use Google Analytics, PostHog, Segment, Amplitude, Mixpanel, Meta Pixel, or any other third-party analytics service. Nothing is sold or shared with advertisers.

8. Why we may process it, and for how long

EU law requires a legal basis for each use of personal data, and a limit on how long it is kept.

• Delivering the site and protecting it from abuse (IP address, request details) — our legitimate interest in running a working, secure service (GDPR Art. 6(1)(f)). Held in memory for about a minute for rate limiting; Cloudflare's own network logs follow Cloudflare's retention
• Telemetry, Essential and Research — your consent (Art. 6(1)(a)), which you can withdraw at any time under Tools → Privacy. Reading the device details involved also relies on your consent under the ePrivacy rules. Individual events are kept for at most three months; totals computed from them, which no longer contain a session ID, may be kept longer
• The chatbot and shared sessions — providing the feature you asked for (Art. 6(1)(b)). Not stored by us, except the chatbot's daily request count per account, kept two days
• Feedback — our legitimate interest in fixing problems and improving the app (Art. 6(1)(f)). Kept for 24 months, then deleted automatically, along with any screenshot
• Real-time allowance — our legitimate interest in offering a metered free service fairly (Art. 6(1)(f)). Weekly counts are kept about nine days; the cookie up to one week
• Accounts — providing the account you asked for (Art. 6(1)(b)). Kept while the account exists; an account with no licence is deleted after 24 months without a sign-in. Sign-in links last 15 minutes and are deleted a day later; a sign-in lasts 30 days from your last visit. Playlists and colours on an account are kept with it and deleted with it
• Lessons and other Khipus saved to your account — providing the feature you asked for (Art. 6(1)(b)). Education plans: 90 days from the last save; otherwise until the licence ends plus 30 days. Never longer than the licence's end plus 30 days, and deleted with the account
• Studio voice-overs — providing the feature you asked for (Art. 6(1)(b)). Kept 30 days from upload, or less if you remove one, and deleted with the account
• Research records saved to your account — providing the feature you asked for (Art. 6(1)(b)); your name in a record only with your consent (Art. 6(1)(a)), given by ticking "Put my name on the record" and withdrawn by saving it again unticked or deleting it. Kept until the licence ends plus 30 days, and deleted with the account
• Lab space — keeping and showing what a member chose to share with the other seats of their licence is providing the feature they asked for (Art. 6(1)(b)). Showing the author's display name to the other members, the member list to the lab's owner, and remembering who holds a seat rest on the legitimate interest of the lab and its members in knowing who shared what, and who is in, in a shared research workspace (Art. 6(1)(f)); this is limited to the display name, to the people holding a seat of the same licence, and to while the person holds one. A name inside a shared research record only with that person's choice (Art. 6(1)(a), "Share with my name"), withdrawn by deleting it. Kept until the licence ends plus 30 days; what a member shared is deleted with their account. Request counts are kept a few hours
• The Situation room — keeping the room, its board, paired screens and own layers is providing the feature the licence's holder asked for (Art. 6(1)(b)); for personal data inside an organisation's own layers, the organisation decides and we keep them on its behalf. Counting a wall's requests by a hash of its address rests on our legitimate interest in stopping abuse (Art. 6(1)(f)); counts are kept a few hours. A briefer's name on a briefing record only with their consent (Art. 6(1)(a)). Kept until the licence ends plus 30 days; pairing codes at most ten minutes
• Your own data — providing the service you asked for (Art. 6(1)(b)). Kept until you delete it while your plan is active; crypto-shredded 30 days after the licence ends, after two emails. The custody record is kept 10 years, to prove what happened to your data (our and your legitimate interest, Art. 6(1)(f)); it holds no data values, no file names and no email addresses. The email address of someone you invite to a dataset: kept until they sign in, or 30 days after the invitation ends (the sharer's instruction and the invitee's interest in being told, Art. 6(1)(b) and (f)). Confirmation codes: deleted a day after they expire. Your bucket's access key: until you delete the source
• Searching by meaning — providing the search you asked for (Art. 6(1)(b)). Not stored by us
• Invoice requests and licences — steps you asked for before a contract, and the contract itself (Art. 6(1)(b)). Requests are kept 24 months, then deleted; a licence's seats are kept while the licence exists; an ended licence stays on the account 30 days after its end, for the 30 days in which saved and shared work can still be reached; the note of which licence hosted a meeting is kept 12 months
• Buying a plan online — the contract you asked for (Art. 6(1)(b)). A checkout reference is deleted two days after it is made; the record that each Paddle notification was applied, 90 days; your subscription's record and what it changed on your licence, while the account exists, and 24 months after the subscription ends. All of it is deleted with the account. Paddle keeps its own records of the purchase as the seller, as tax law requires

You are never required to provide data to use the globe. Declining telemetry, not sending feedback, and not signing in disable nothing but the features that need them (the chatbot needs a plan).

We do not make decisions about you by automated means, and we do not profile you.

9. Your choices

• Allow or refuse telemetry, and change your mind at any time: Tools → Privacy. Choosing Off also discards any events waiting to be sent
• Clear visit history, or stop it being kept: Tools → Privacy ("Clear visit history", and the "Remember the datasets I open" switch)
• Remove a licence from your account: Account → Your plan → Remove from my account
• Delete something you shared in Lab space: Tools → Data → Open Lab space → Delete (pressed twice)
• Sign out of a browser: Account → Sign out
• Delete your account and everything kept for it: Account → Delete account
• Do not use the chatbot if you do not want your questions sent to an AI model; everything else works without it
• Block or delete the allowance cookie in your browser
• Run a telemetry-free build: the source code is public and can be built with telemetry removed entirely

10. Your rights

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

• Access the personal data we hold about you and receive a copy
• Correct it if it is inaccurate
• Delete it
• Restrict how we use it
• Object to processing based on our legitimate interests
• Receive data you gave us in a portable format
• Withdraw consent at any time, without affecting what was done before

To use any of these, write to privacy@pachamama-studios.com. We answer within one month and do not charge for it.

Two practical notes. For feedback or a rated conversation, tell us roughly when you sent it and some of its text so we can find it. Telemetry events carry no name, account, or lasting identifier, so we cannot tell which events were yours and cannot pick them out to copy or delete; they expire on their own within three months, and turning telemetry off stops any more being sent.

You also have the right to complain to a data protection authority — in the EU country where you live, where you work, or where you believe the law was broken. Our lead authority is the Dutch Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl). All the EU authorities are listed at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

People elsewhere may have similar rights under their own laws (for example the CCPA in California); the same contact address applies.

11. Children

AYNI is an educational tool and may be used in classrooms. It can be used fully without giving any personal data.

Telemetry and signing in rely on consent or on an account. If you are under 16 — or under the lower age your country sets, never below 13 — please ask a parent or guardian before allowing telemetry, sending feedback with contact details, or signing in. Schools deploying AYNI should decide whether their policies permit those features and the chatbot, which sends questions to an AI provider.

If you believe a child has sent us personal data without that permission, contact us and we will delete it.

12. Security

Data in transit is encrypted (HTTPS). Stored feedback and account data are held in Cloudflare databases reachable only by our staff. Feedback is read, in order to act on it, by staff signed in with an account we have named as an AYNI admin, or with a private access key (section 5). If a breach of personal data occurs that is likely to put people at risk, we will notify the competent data protection authority and, where required, the people affected.

13. Changes to this policy

Material changes will be announced in the app's changelog. The "Last updated" date at the top of this page reflects the most recent change.

14. Contact

Pachamama Studios — privacy@pachamama-studios.com