Privacy Policy

[YOUR LEGAL ENTITY NAME], of [REGISTERED ADDRESS], operates this service and is the controller of the personal data described below.

For any question about this policy or about your data, contact [PRIVACY CONTACT EMAIL].

Account data: your email address, your name if you provide one, your authentication method, and — if you enable two-factor authentication — the fact that it is enabled. We never store your password in readable form.

Organisation data: the workspaces you belong to, your role in each, and invitations you send or receive.

Billing data: your subscription tier, plan history, orders, and credit ledger. Card details are handled by our payment processor and never reach our servers.

Content: files you upload and any text you submit through product features. These are private to your organisation by default.

Game dialogue and generated media: your selected player archetype, messages, fictional contact history, generated replies and images, relationship summaries, model usage, and private generated-media lifecycle. Bounded dialogue, character instructions, and—only when the fictional character is depicted—the pinned fictional-character portrait are sent to the configured AI model gateway. Player photos are not an input to the current generated-image feature. Do not enter secrets or information about another person that you are not authorised to share.

Technical data: IP address, user agent, and authentication events such as sign-ins and password resets. We keep these to detect abuse and to answer 'was this me?'

Cookies and similar technologies: see the cookies section below.

To provide the service you asked for, including authentication, storage, and any feature you use — performance of our contract with you.

To take payment and keep financial records — performance of our contract, and compliance with a legal obligation for records we must retain.

To keep the service secure and to investigate abuse — our legitimate interest in a service that is not being attacked.

To send transactional email such as verification, password resets, and receipts — performance of our contract.

For analytics or advertising, where enabled — your consent, which you may give or withdraw at any time.

Strictly necessary cookies keep you signed in, protect forms against cross-site request forgery, and remember your cookie choice. These are required for the service to function and are set without consent.

Analytics and advertising technologies, where enabled, are set only after you accept them. Nothing in those categories loads before you make a choice, and rejecting them is a single click with the same prominence as accepting.

You can change your decision at any time from the cookie settings link in the site footer. Withdrawing consent stops future collection; it does not undo processing that already, lawfully, happened.

We do not sell personal data.

We use service providers who process data on our instructions: Stripe — Payment processing and subscription billing; Resend — Transactional email delivery; Object storage provider (S3, Cloudflare R2, or compatible) — Storage of files you upload; Configured AI model gateway (Kie.ai by default) — Generation and summarisation of fictional dialogue, plus optional fictional-character images and short videos from bounded text and a pinned character portrait/selfie; ElevenLabs — Optional text-to-speech generation for private fictional-character voice notes; Vercel — Application hosting and request logs.

The configured AI model gateway receives character instructions and a bounded portion of the selected contact's private conversation. For optional generated images it may also receive a bounded visual prompt and the pinned fictional-character portrait; it does not receive player photos under the current feature contract. Requests ask text models not to retain provider-side state, while asynchronous image tasks and temporary files follow the provider's task lifecycle. Provider logging and retention remain governed by our agreement with that provider. Confirm those terms and the applicable data-processing agreement before launch.

We may disclose data where we are legally required to, or to establish or defend legal claims.

Our providers may process data outside your country, including outside the EEA or the UK. Where that happens we rely on an approved transfer mechanism, such as the European Commission's standard contractual clauses.

[Confirm with counsel which mechanism applies to your provider set and the regions you serve, and name it here.]

Account and organisation data: for as long as your account exists.

Financial records, including orders and subscription history: retained after account closure for the period our tax and accounting obligations require.

Authentication and administrative audit events: retained as a security record, and by design cannot be edited after the fact.

Uploaded files: until you delete them, subject to a short grace period during which a deleted record is recoverable.

Game runs, conversations, generated memories, messages, and private generated images: until you delete your account or a product control deletes that game data. Durable background-job records are pruned after completion under the operational retention schedule.

[This table must match what your deletion implementation actually does. Reconcile it with the account-deletion policy before publishing.]

Depending on where you live, you may have the right to access your data, correct it, delete it, receive a portable copy, object to processing based on legitimate interests, or withdraw consent you have given.

To exercise any of these, contact [PRIVACY CONTACT EMAIL]. We will respond within the period the applicable law requires.

If you believe we have handled your data improperly, you may complain to your local supervisory authority. We would rather you told us first.

Access to your data is scoped to your organisation, uploaded files are private by default and served through expiring links, and administrative accounts require two-factor authentication.

No service is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority where the law requires it.

This fictional relationship game is intended only for adults aged 18 or older. Every depicted character is a fictional adult aged 22 or older. We do not knowingly permit children to use the service; contact us if you believe a child has created an account.

We will post any change here and update the effective date above. If a change materially affects your rights, we will tell you before it takes effect.