Dibaci is an independent software product for cross-device conversations, file transfer, and AI-assisted work.
Operator and scope
Dibaci is operated by the Google Play developer helium9527 as an independent developer. This policy applies to Dibaci for Android and Windows, its website, cloud synchronization, AI, and cloud-development services.
Data we process
We process account email addresses, one-way password hashes, plan and account status; generated device identifiers, user-assigned device names, platform, app and operating-system versions, online status, and push tokens; conversation names, messages, AI replies, response rules, model and skill selections, project-bound devices, project names, and project paths; images, video, audio, documents, and other files that users choose, capture, upload, generate, or download; model-token usage, credits, entitlements, and Google Play order status when applicable; and IP address, request time, client type, and redacted fault and security diagnostics.
How we use data
We use this data to register and sign users in, synchronize devices, route messages to the correct device or cloud environment, carry out instructions, invoke the selected AI, transfer files, provide voice features, send necessary notifications, meter usage, handle purchases and entitlements, diagnose faults, prevent abuse, and process reports. Dibaci does not sell personal data, serve ads based on personal data, or use user content to train its own general-purpose AI models.
Third-party processing and sharing
When required to provide a feature selected by the user, necessary data may be processed by infrastructure and network providers; system-model and live-voice requests may currently be processed by Alibaba Cloud Model Studio/Qwen; when a user selects Codex, Claude, or a custom API, request content is sent to OpenAI, Anthropic, or the provider configured by the user; Android notifications use Google Firebase Cloud Messaging to transmit a push token and wake-up metadata, without conversation text; and when Google Play purchases are enabled, Google Play and the Dibaci backend verify order identifiers, products, status, and purchase tokens. We do not disclose personal data to other parties except as needed to provide the service, comply with law, or protect users and service security.
On-device credentials and processing
API keys supplied by a user remain on the device where they are configured and are not synchronized to the Dibaci cloud. Sign-in credentials for Codex or other third-party kernels remain in the relevant local credential store; Dibaci cloud does not store those account passwords or sign-in tokens. To continue conversations across devices, message text, results, and attachments may still synchronize through Dibaci cloud. A third-party provider's handling of request content is governed by its own terms and privacy policy.
Permissions, images, and voice
Dibaci uses the camera or system picker, file access, or microphone only when the user chooses to take a photo, select a file, or start live voice. During live voice, audio streams through the Dibaci service and is sent to the selected speech-recognition or speech-synthesis service. Dibaci does not retain raw live audio as a long-term file, although recognized text and resulting conversation content may be retained with the conversation. Notification permission is used for user-enabled work-completion and necessary status alerts.
Retention
Conversations, messages, rules, device records, and project-binding metadata are generally retained until the user deletes the relevant conversation or account. Incomplete attachment uploads are normally cleared after 24 hours. Hosted content for completed attachments is normally retained for 7 days; after expiry, file content is deleted, while minimal reference information such as file name, type, size, and expired status may remain with the conversation. Client error diagnostics are normally retained for 14 days. Revoked sign-in sessions and push tokens are no longer used for access or notifications. Transaction, security, anti-fraud, and dispute records are retained only as long as needed for business or legal purposes.
Security
The public website, API, WebSocket, and file transfers use HTTPS/TLS or WSS. Passwords are stored using a strong one-way hash, sensitive service tokens use controlled encrypted storage, and account, conversation, device, file, and execution-worker ownership is verified. Error diagnostics filter passwords, API keys, conversation text, file content, email addresses, full URLs, and absolute local paths. No system can guarantee absolute security; please contact us promptly about a suspected security issue.
Choices and rights
Users can decline optional permissions, delete conversations, review and revoke signed-in devices, report inappropriate AI content, and request access, correction, or deletion of personal data where applicable law provides those rights. Account deletion can be requested in Dibaci under Settings > Account and Plan > Delete Account or through the public account-deletion page. After submission, the account is disabled immediately, associated cloud data is normally deleted within 30 days, and backup copies rotate out within 90 days. Data that must be retained by law is restricted and kept only for the necessary period.
Children's privacy
Dibaci is intended for work and project use and is not directed to children. A person below the minimum age applicable in their region should not use the service independently. If we learn that a child's data was collected without appropriate authorization, contact us so it can be addressed.
Policy changes
When product features, data handling, or legal requirements materially change, we will update the date on this page and provide notice in the app or another appropriate channel when required. Users should review the updated policy before continuing to use the service.
Contact
Dibaci's privacy contact and public support email is Sirintrasaelim82@gmail.com. Email questions about privacy, data access, correction, security, or deletion. Account deletion is also available through the public deletion page, and inappropriate AI content can be reported in the app. Do not send passwords, API keys, or verification codes by email.