Privacy Policy

1. Data stored on your device

These use localStorage or sessionStorage. We cannot remotely restore them. Delete them through your browser’s clear-site-data controls.

• audience choice, language, intensity and model preferences;
• your optional persona, custom characters (currently unavailable) and chat history;
• a random analytics session ID used only for one browser session.

2. Data processed when you send a message

A request contains a preset character ID, intensity and model choices, an optional persona, and up to 24 recent non-empty messages. Our server supplies the trusted preset profile, relays the request to Venice API, safety-checks the reply and then returns it. Application code does not write full prompts or outputs to product-event logs. By default we also store that sent or regenerated exchange on the server as described below; you can disagree in chat settings.

Paid live motion contains only the preset-character image URL and a limited motion label derived from the character, intensity and reply. It does not contain your messages, persona or the reply text. Your browser plays the generated video from a temporary Atlas Cloud URL.

2a. Saving exchanges to improve chat

Help improve chat is on by default. We store future messages you send or regenerate, safety-checked replies returned to you, and sent messages plus error categories for failed requests. Authorized Huangguo staff may review them to investigate problems and improve the product. Earlier local history, full system prompts and persona profiles are not bulk uploaded. This is separate from the chat sync in section 2b and does not change your chat access. If you disagree, chat settings let you stop further storage.

Records are AES-256-GCM encrypted in Railway PostgreSQL, with random conversation, message and request IDs, character, languages, model tier, intensity, timing and outcome. An internal user UUID may be linked after login for account deletion; review exports omit account email by default. Information you write in messages can still be saved. Text is not sent to PostHog or used for advertising.

Records expire after 30 days, are excluded from review at expiry and are removed by periodic cleanup. Chat settings let you stop future saving or stop and delete records saved from this browser. Stopping alone does not delete existing records. Account-linked records are deleted with the account. A signed HttpOnly cookie identifies the setting for up to 365 days. Clearing browser data may remove the credential for managing guest records and restore default saving; those records still expire.

2b. Chat sync when signed in

After you sign in and verify your email, Sync chats across devices is on by default: conversations from this browser and your other devices, including ones held in this browser from before you signed in, are uploaded to your account so you can continue on another device. Synced data includes message text and each conversation's reply language, intensity and conversation-style settings. Conversations with custom characters are not synced.

Conversation content is stored in Railway PostgreSQL encrypted with AES-256-GCM; only your user UUID, the conversation ID, character ID and last-updated time are stored in the clear. Each account keeps up to its 60 most recent conversations. Synced copies are used only to show them to you and keep your devices in step; they are not sent to PostHog or used for advertising.

Deleting a conversation deletes the account copy and leaves a content-free deletion marker so your other devices remove it too. Turning sync off in chat settings immediately deletes every account copy; deleting your account deletes them all. Records kept in this browser are still handled as described in section 1.

3. Accounts, subscriptions, product events and infrastructure logs

At registration, a Railway-hosted PostgreSQL database stores your normalized email, email-verification time, scrypt password hash, Terms-acceptance time and version, and account timestamps. Passwords are not stored in plaintext. On login, the browser receives an HttpOnly session cookie; the database stores only a SHA-256 hash of the session token and its expiry. One-time email-verification and password-reset tokens are also stored only as SHA-256 hashes, together with purpose, expiry and use time. Login codes are stored by email as an HMAC hash, attempt count and a 10-minute expiry; the plaintext code is not stored.

When you use Stripe, Stripe directly processes payment methods and checkout information; we do not receive or store full card numbers. We store the Stripe customer ID, subscription ID, plan, status, current-period end, processed event IDs, and the account’s current-month H3 motion usage needed to provide benefits.

When you use the site, we record limited product events: a random session ID, event name, page path, character ID, entry or campaign source, language, coarse device class, intensity or audience choice, turn count, response time, and registration, plan, payment and live-motion status. After login, the random session may be linked to an internal user UUID that does not contain an email so we can measure cross-session retention. Events exclude message text, personas, custom-character text, email and full payment details.

When you use the site, the browser also loads PostHog session replay, which records page structure, clicks and navigation paths so we can diagnose interface problems. Chat text, personas, form inputs and account email are masked before they are sent. Autocapture and heatmaps are not enabled.

Infrastructure may process IP address, request time and path, browser/device information, status codes and diagnostic logs. The application converts the IP address into an irreversible keyed digest for the 30-day guest allowance, rate limits and concurrency controls; those tables do not store raw IP addresses or chat text.

4. Legal reports

If you use the legal-report form, we process the submitted name, email, URLs, statements and other details. The complete report is encrypted with AES-256-GCM under a separate key before being stored in PostgreSQL; operational logs contain only the receipt and report type. Keep the receipt and avoid unrelated sensitive information.

5. Purposes and legal bases

Depending on location, the legal basis may be performance of the service you request, legitimate interests, consent or compliance with law.

• provide the reply you request and maintain the local experience;
• secure the service, prevent abuse and enforce the Terms;
• create accounts, maintain login sessions, process subscriptions, verify benefits and deduplicate webhooks;
• understand feature use without collecting chat content in product events;
• record masked sessions during site use to diagnose interface problems;
• store future exchanges to improve the product unless you opt out;
• handle copyright, privacy, safety and lawful requests.

6. Providers and international processing

Story pages load public thumbnails from YouTube and embed its privacy-enhanced youtube-nocookie.com player when the page loads. Your browser connects to YouTube before you press play so it can process player requests and associated network information. The video does not autoplay.

Railway provides application, PostgreSQL database and logging infrastructure. Cloudflare Email Service receives the recipient address, sender details and account-security email content to deliver login codes, verification and password-reset messages; those emails contain no chat content. Venice.ai provides text inference. Atlas Cloud provides live video generation and may forward the character-image URL and motion instructions to an underlying model provider. Stripe provides Checkout, subscriptions, payment processing, fraud prevention and Billing Portal. PostHog provides product analytics. Product events are filtered by our server before being sent to PostHog. When you use the site, the browser loads PostHog session replay; form inputs, chat text, personas and account email are masked first, and autocapture and heatmaps are not enabled. Server-side product events still exclude chat text, email, visitor IP and browser User-Agent. Session recordings are sent from the browser to PostHog, and connection metadata is handled under PostHog’s policy. Each provider’s privacy and retention rules apply. We do not receive full card details. Venice publicly states that its API does not store prompts and outputs, while underlying models can have different privacy modes; we do not expand that statement into an absolute guarantee.

Browsing pages may display a labeled Adsterra banner. If an ad is enabled and loaded, its provider receives connection information such as IP address and browser data and may use cookies under its own privacy policy. Chat text, personas and account email are not passed to ads. Ads do not appear in chat, account or payment pages.

Providers may process data outside your country. External links, including Huangguo Drama, apply their own policies once opened.

7. Retention

Local data remains until you clear it; the analytics session ID normally ends with the tab session. Account data remains until account deletion or until no longer needed. Login sessions last up to 30 days and expired records are cleaned up. Login codes expire after 10 minutes and are removed after expiry. Email-verification and password-reset tokens expire after 30 minutes and are normally removed about one day after use or expiry. Subscription and transaction-linked records may remain for tax, accounting, fraud, refund, chargeback and legal obligations; Stripe independently retains payment data under its policies. Model requests are processed for generation. Live-motion requests instruct Atlas Cloud to retain generated media and request records for one hour; we do not persist those generated videos on our own server. Product events and session recordings in PostHog follow the analytics project’s retention settings; access/error logs and legal reports are retained for security, disputes and legal needs, then deleted or aggregated.

8. Your choices and rights

You can stop using the service, clear local chats, stop server-side saving in chat settings, omit a persona or sensitive information, and delete chat context before sending. After login, the Account Security area lets you change your password or permanently delete the account; first cancel any active subscription in Stripe Portal. You may also submit a privacy request through the legal-report channel. Local law may provide access, correction, deletion, restriction, objection or complaint rights. Random analytics identifiers may not be locatable from identity alone; include enough information to verify a request.

9. General audience and security

Public content is for a general audience. Do not share your age, school, address or other sensitive personal information in chat. Guardians can use the privacy-report channel to request deletion of a minor’s data. We use reasonable safeguards, but no transmission or local storage is perfectly secure. Other people using a shared device may be able to read browser-stored chats.

10. Changes and contact

We update the date above when this Policy changes. A public privacy mailbox is not configured yet. Use the legal-report form below for a privacy or security request and retain its receipt; this interim channel will be replaced when formal operator contact details are published.