Privacy Policy

Effective date: 27 September 2026

Ayla ("we", "the extension") is a browser extension that replaces your browser's new tab page. It is developed by Ibrohim Qobilov (Uzbekistan), who is responsible for your data (the "controller"). This policy explains what data Ayla uses, where it is stored and what choices you have.

In short: Ayla works without an account and keeps your data in your browser. It shows no ads, has no analytics or tracking, and never sells your data.

1. Data stored on your device

The following is stored locally in your browser (chrome.storage):

• Your settings, daily and weekly goals, and your goal history (each day's goal and whether you completed it).
• Tasks and task lists, notes, habits, reminders and your class schedule.
• Focus statistics, achievements and the water log.
• Favorite wallpapers, uploaded images, quick links (Speed Dial) and quotes.
• The read-later list and saved tabs.
• The prayer log and "Time on sites" data, if you use those features.

This data never leaves your device unless you sign in (section 2), connect a service yourself (section 6) or join a Focus together room (section 7). Uninstalling the extension deletes it.

2. Optional account and sync

Signing in is optional. You can sign in with email and password, Google or GitHub. Sign-in is provided by Google Firebase Authentication. When you sign in, we receive your email address, display name and profile photo URL from the provider you choose.

So that your data appears on all your devices, a copy of the following is stored in Google Cloud Firestore:

• Settings, daily and weekly goals and your goal history, tasks and task lists, notes, habits and reminders.
• Your class schedule and water log.
• Quotes, favorite wallpapers, quick links and the read-later list (page addresses and titles).
• Focus statistics and achievements.

Each account can only read and write its own data. Nobody else, including other users, can access it.

Never synced:

• Uploaded images and saved tabs.
• Your recent searches in the search bar.
• "Time on sites" data.
• The prayer log. Information about religious practice is a special category of data, so it stays on your device.
• Your calendar connection.
• Your keys and links for connected services (Trello, Todoist, ClickUp, Jira, Notion, Asana, GitHub, Bitrix24, Microsoft To Do, Google Tasks, Slack, Telegram).

3. Calendar (optional)

You can connect a calendar with an iCal link or with your Google account. With Google, Ayla requests read-only access (calendar.readonly).

• Your events are used only to show the calendar widget.
• Events are stored only on your device and are not sent to us or anyone else.
• Your calendars are never changed.

You can disconnect at any time in Settings.

Ayla's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is never used for advertising, never sold and never read by humans.

4. Location

Ayla uses your location to show weather, local currency and, where available, prayer times. It uses your browser's location (only if you allow it) or an approximate city based on your IP address. Your location is used only to request this information and is stored only on your device.

If you turn on rain and snow alerts, Ayla checks the forecast for your city once an hour in the background.

You can turn automatic location off and choose a city manually.

5. Features related to websites

All of these are optional. Their data stays on your device, except the read-later list, which is synced as described in section 2.

• Site blocking and daily limits. Blocking works inside your browser, using only the sites you add to your list. If you set a daily limit, Ayla counts time only on those sites, and only while that tab is active.
• Shorts & Reels. This is off by default. If you turn it on, Ayla asks for access to YouTube, Instagram and TikTok. Your browser then opens YouTube Shorts as regular videos and sends Instagram Reels and TikTok to an Ayla page, and a small script hides the Shorts and Reels shelves and buttons on YouTube and Instagram. The script reads nothing from those pages and sends nothing anywhere; it only reads Ayla's own settings and focus timer.
• Only allowed sites during focus. This is off by default. If you turn it on and allow access to all sites, your browser blocks every site that isn't on your allowed list, but only during a focus session. The addresses you visit are not recorded. As with your block list, an attempt to open a blocked site during focus counts as a distraction: the site name is kept only for that session's summary and the daily count for 14 days, on your device only.
• Time on sites (Ayla Plus). This is off by default. If you turn it on and allow the "read your tabs" permission, Ayla records the site name (for example youtube.com, not the full address) of the active tab and how long it stays in front. It counts only while the browser window is in focus and you are at your computer. Ayla uses this data only to show you where your time went. It is kept on your device for 30 days, then deleted automatically. It is never synced, never added to backup files and never sent anywhere.
• Saved tabs. When you click Save, Ayla stores the addresses and titles of the tabs in the current window.
• Read later. When you use the right-click menu or the shortcut, Ayla saves the address and title of that page only.
• Task from selected text. When you choose it from the right-click menu, the text you selected becomes a task.
• Search bar. Your last searches are kept on your device only; you can turn this off or clear it in Settings. Web suggestions are off by default: if you turn them on, the text you type is sent to the search engine you chose (Google, Yandex, Bing or DuckDuckGo) to get suggestions — the same place your search goes when you press Enter. Voice search is off by default: it uses your browser's own speech recognition (in Chrome it is provided by Google). Ayla never receives or stores the audio.
• Quick link suggestions. If you allow it, Ayla reads your most visited sites once, to suggest quick links. The list stays on your device.

Ayla does not collect your browsing history for any other purpose.

6. Integrations you connect yourself

• Trello. You sign in on Trello's page (Atlassian). Ayla can then read your boards, show your account name, and create or update cards in the list you choose. The access key stays on your device. Tasks linked to cards sync together with your other tasks (section 2).
• Todoist. You sign in on Todoist's page, or paste your personal API token. Ayla uses the access only to sync tasks between Ayla and Todoist (create, rename, change the date, complete). The keys stay on your device. When you sign in, Todoist's one-time code and, about once an hour while you use Ayla, the key renewal pass through our small Cloudflare server, which stores nothing.
• ClickUp. You sign in on ClickUp's page. Ayla can then read your workspaces, lists and tasks, show the names and pictures of the people tasks are assigned to, and create or update tasks (status, name, due date, priority, assignees). If you choose lists to watch, Ayla checks them for new tasks every 5 minutes in the background; notifications about them are off unless you turn them on. The access key stays on your device. To finish signing in, ClickUp's one-time code passes through our small Cloudflare server, which exchanges it for the key and stores nothing. Tasks in the ClickUp tab sync together with your other tasks (section 2).
• Jira. You sign in on Atlassian's page. Ayla can then read the open Jira issues assigned to you (name, due date, status), close them, rename them or change the due date, and create new issues in the project you choose. Issues are never deleted. The one-time sign-in code and the hourly key renewal pass through our small Cloudflare server, which stores nothing. The keys stay on your device.
• Notion. You sign in on Notion's page and choose which pages Ayla may see. Ayla reads tasks from the database you pick (title, due date, done), marks them done, renames them or changes the date, and adds new pages. Pages are never deleted. The one-time code passes through our Cloudflare server; the key stays on your device.
• Asana. You sign in on Asana's page. Ayla reads the incomplete tasks assigned to you in the workspace you choose, completes, renames or reschedules them, and creates new tasks in My Tasks. The one-time code and the hourly key renewal pass through our Cloudflare server; the keys stay on your device.
• GitHub. You sign in on GitHub's page. Ayla reads open issues assigned to you (including private repositories, which is why GitHub asks for the "repo" permission), closes or renames them, and creates new issues in the repository you choose. Pull requests are not read. The one-time code passes through our Cloudflare server; the key stays on your device.
• Bitrix24. You paste an inbound webhook link from your own Bitrix24 portal; no sign-in page is involved. The link is a secret key: it stays only on your device and is never sent to us. Ayla talks directly to your portal to read your open tasks, complete, rename or reschedule them, and create new tasks. Tasks are never deleted.
• Microsoft To Do. You sign in on Microsoft's page. Ayla reads your name and the tasks in the list you choose, completes, renames or reschedules them, and creates new tasks. The one-time code and the key renewal pass through our Cloudflare server, which stores nothing; the keys stay on your device.
• Google Tasks. You sign in on Google's page. Ayla reads the tasks in the list you choose, completes, renames or reschedules them, and creates new tasks. The access key is kept in memory only until you close the browser, and no server of ours is involved. Disconnecting also revokes the access at Google.
• Slack. You sign in on Slack's page. When a focus session starts, Ayla sets your Slack status to "Focusing" and pauses notifications until the session ends; if you stop early, it removes them. Ayla cannot read your messages or channels. The one-time code passes through our Cloudflare server; the key stays on your device, and disconnecting revokes it at Slack.
• Telegram. You connect by opening Ayla's bot with a one-time code; no Telegram sign-in is used. Messages you send to the bot become tasks or "read later" links in Ayla. If you turn them on, your evening summary and task reminders are sent to you in Telegram. Message text passes through Telegram and our Cloudflare server. Our server keeps only a random connection key with your chat ID, your Telegram name and language, and messages Ayla has not picked up yet. Each message is deleted once Ayla receives it, unused codes after 1 hour, untouched connections after 90 days, and everything as soon as you disconnect.

You can disconnect any of these services at any time in Settings.

7. Focus together (optional)

You can create a focus room or join one with a code; no account is needed. Everyone in the room (up to 8 people) sees your display name (your app or account name, up to 24 characters, which you can change) and your focus status (focusing, on a break, paused or online, and the minutes left).

• Rooms run on our Cloudflare server (ayla-rooms) in the European Union. The server keeps no activity logs.
• Only the room code, a hash of the room owner's key and the time the room was created are written to disk. Your name and status are kept in memory only while you are connected, and are removed when you leave the room or close the tab. A room nobody has joined for 24 hours is deleted completely.
• Ayla connects only while focus mode or the room window is open.
• There is no free-text chat, only 4 ready-made reactions. Your email, account ID and IP address are never shown to others in the room.
• On your device, Ayla keeps the room code, a random member ID, the owner key and the name you chose. This is not synced and not included in backup files.

Share a room code only with people you trust.

8. Services Ayla connects to

To provide its features, Ayla requests public information from the following services. These requests do not include your account data.

9. Feedback when you uninstall

When you remove Ayla, a short survey page opens. Answering is optional and anonymous. If you answer, we receive only these:

• the reason you pick;
• your comment, if you write one;
• the extension language and version.

The answer is stored in Firebase and also sent to the developer's private Telegram channel through a Cloudflare Worker, so we can read it quickly. We don't ask for your name, email or any other personal data, so please don't write personal details in the comment.

10. Why we process your data (legal bases)

• Account and sync: to provide the service you asked for (GDPR Art. 6(1)(b)).
• Location, calendar, the integrations in section 6, Focus together and Time on sites: your consent (Art. 6(1)(a)). You can withdraw it at any time by turning the feature off, leaving the room or disconnecting.

11. Where data is stored

Firestore data is stored in Google Cloud's European multi-region (Belgium and the Netherlands). Firebase Authentication is operated by Google and may process sign-in data in the United States, under Google's Standard Contractual Clauses and the EU–US Data Privacy Framework. Focus together rooms run on Cloudflare in the European Union.

These countries are also on Uzbekistan's list of countries that ensure adequate protection of personal data.

12. How long we keep data

• Account data: kept while your account exists.
• Deleted accounts: kept for 30 days so you can restore the account, then permanently deleted.
• Focus together: your name and status only while you are connected; the room itself until nobody has joined it for 24 hours.
• On your device: daily focus records are kept for 60 days, goal history for about 13 months (400 days), the prayer log for 90 days, Time on sites data for 30 days and daily distraction counts for 14 days. Everything else stays until you delete it or uninstall Ayla.

13. Your rights

You can do all of the following at any time:

• See and download all your data: Settings → Account → My data.
• Correct your data.
• Delete your account.
• Withdraw your consent.
• Object to processing.
• Complain to your data protection authority.

For any request, contact us (section 17).

14. What we don't do

• We don't show ads and don't use analytics or tracking.
• We don't sell, rent or share your personal data with third parties for advertising or any other purpose.
• We don't use your data to determine creditworthiness or for lending.
• Ayla complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

15. Children

• Accounts are for people aged 16 or older. People under 16 may create one only with a parent's or guardian's consent.
• Without an account, anyone can use Ayla, and no data is collected.

16. Changes

If this policy changes, we will update the date above. Significant changes will also be announced in the extension.

17. Contact

Ibrohim Qobilov · open an issue on GitHub.