Privacy Policy

1. Data controller

The data controller responsible for your personal data is:

2. What data we collect

• Account data: Your email address; a hashed password if you choose to set one; your date of birth; a record of when you accepted our Terms of Service and Privacy Policy (including the version accepted); your mature-content preference; and whether you have opted in to marketing emails. Collected when you register, complete account consent, or update your account settings.
• Subscription data: Your subscription status and payment information, processed by Stripe. We do not store card numbers.
• Chat data: Messages you exchange with AI characters, stored in our database to enable conversation history and AI memory features.
• Usage data: Product analytics events (for example page views and feature usage) via PostHog when you use the service while logged in.
• Analytics data: Anonymous page views and visitor counts via Vercel Analytics (only if you consent to analytical cookies).

3. How we use your data

• To provide the chat and interactive storytelling services you sign up for.
• To verify that you meet our 18+ eligibility requirement using your date of birth.
• To apply your content preferences (including mature-content settings).
• To manage your subscription and process payments through Stripe.
• To send transactional emails (for example sign-in links, confirmations, and billing notices) via our email provider.
• To send occasional product updates and offers by email, but only if you have opted in to marketing communications.
• To personalise AI responses using your conversation history (memory feature, paid plans).
• To understand how the service is used and improve it, using product analytics and (with your consent) anonymous site analytics.

4. Legal basis (GDPR)

• Contract performance — processing your account, subscription, chat, and content-preference data to deliver the service you signed up for.
• Legitimate interests — verifying eligibility for an adults-only service, basic security, fraud prevention, and improving the product through aggregated analytics.
• Consent — marketing emails; analytical cookies and non-essential tracking via the cookie banner. You may withdraw marketing consent at any time by turning off the option in your account Profile settings. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Legal obligation — retaining payment records as required by applicable tax and accounting law.

5. Data sharing

We do not sell your personal data. We share data only with the following processors:

• Neon — PostgreSQL database hosting (EU/US)
• Fly.io — API application hosting
• Groq — AI language model inference (your messages are sent to Groq for response generation)
• OpenAI — text embedding generation for the memory feature (paid plans)
• Stripe — payment processing
• Resend — transactional and marketing email delivery (marketing only if you have opted in)
• PostHog — product analytics (may include your account identifier and email when you are logged in)
• Vercel — website hosting and anonymous analytics (with consent)

6. Data retention

Your account data and chat history are retained for as long as your account is active. You may delete your account and all associated data by contacting us at the address below. Payment records are kept for 7 years as required by Bulgarian and EU law.

7. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing
• Data portability
• Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal), including marketing emails via Profile settings and analytical cookies via the cookie banner

To exercise any of these rights, contact us at the address in section 9. We will respond within 30 days.

8. Cookies

For full details of the cookies and local storage items we use, see our Cookie Policy.

9. Contact

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria.