Privacy Policy

1. Data We Collect

• Account data: Email address, OAuth provider ID (Google/Discord), anonymous username, anonymous avatar URL.
• Message content: All messages sent in matches and solo sessions. Match chat messages are encrypted at rest using AES-256-GCM. Solo session messages are stored as plaintext (they are private to you and the AI).
• Usage metadata: IP address, device type, timestamps, match history, token transactions, payment records.
• Content you create: Character prompts, personality traits, greetings, and ratings you submit.

2. Message Encryption

Match chat messages between users are encrypted at rest using AES-256-GCM symmetric encryption. The encryption key is stored server-side and is not accessible to the client. We retain the ability to decrypt messages for moderation and legal compliance purposes.

3. Automated AI Moderation

All messages and user-generated content are processed by automated AI moderation systems to detect policy violations. This processing happens server-side before content is stored or delivered. The AI moderation may flag, block, or report content without human review. Flagged content may be reviewed by human moderators.

4. Anonymization

Other users cannot see your real identity. Your OAuth email, provider ID, and IP address are never displayed to other users. Partner UUIDs in match views are hashed (SHA-256) to prevent cross-referencing. However, true anonymization cannot be guaranteed if you voluntarily share identifying information in messages.

5. Data Retention

• Account data: Retained until account deletion.
• Match messages: Retained for the duration of the match and 90 days after the match ends.
• Solo session messages: Retained until you delete the session or your account.
• Payment records: Retained for 7 years for tax and legal compliance.
• Reports: Retained for 1 year after resolution.

6. Law Enforcement Disclosure

We may disclose account information, including decrypted message content, metadata, and IP addresses, to law enforcement in response to valid legal process. We do not provide backdoor access. All disclosures are logged.

7. Third-Party Services

• Supabase: Database, authentication, and real-time infrastructure.
• Google / Discord: OAuth authentication providers.
• DeepSeek / Google Gemini: AI content generation.
• NOWPayments: Cryptocurrency payment processing.
• Cloudflare: DDoS protection and bot mitigation (Turnstile).

Each third-party service has its own privacy policy. We share only the minimum data necessary to provide the service.

8. Your Rights

• Access: You can view your data via your profile page.
• Deletion: You can delete your account, which cascades to all associated data (messages, characters, sessions).
• NSFW opt-out: You can revoke NSFW opt-in at any time from your profile settings.
• Data export: Contact support to request a data export.

9. Children's Privacy

The platform is not directed at children under 13. Users under 13 are not permitted. Users aged 13–17 are classified as minors and cannot access NSFW content. We do not knowingly collect data from children under 13. If you believe a child under 13 has registered, contact support for immediate removal.

10. Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be announced on the platform. Continued use after changes constitutes acceptance.