Privacy Policy
This policy explains what personal data Companion processes, why, where, and what your rights are. The controller is [Company name], [address], Denmark, reachable at [privacy email].
What we store and why
| Data | Why | Kept |
|---|---|---|
| Account: username, email address, a salted hash of your password, plan, the invite you used, creation and last log-in time | To run your account and log you in (contract) | Until you delete the account |
| Session records: session token, time, IP address and browser type of each log-in | Security, spotting abuse (legitimate interest) | 30 days after the session ends |
| Your characters, conversations, the facts the character remembers, your settings | The service itself: this is what makes the companion remember you (contract) | Until you delete the character or the account |
| Generated pictures and videos, and any reference details you give for your character's look | The service (contract) | Until you delete them or the account |
| Usage counters: number of messages, pictures and video seconds, GPU time and cost | Plan limits and cost control (contract, legitimate interest) | 13 months |
| Safety log: requests refused by the content limits, level changes, media checks | Enforcing the content limits and the terms (legitimate interest, legal obligation) | 13 months |
We do not build profiles for advertising, we do not sell data, and we do not use your conversations to train AI models.
Where the data is
The service runs on servers in Frankfurt, Germany (Alibaba Cloud (Germany) GmbH, an EU entity, as our hosting processor). The AI models that write the replies and make the pictures and videos run on our own rented servers in the same data centre; your conversations are not sent to third-party AI providers. Backups are kept by us in Denmark.
Cookies and local storage
We use one cookie, sid, which keeps you logged in. It is strictly necessary and needs no consent. The app stores small preferences in your browser (for example whether voice is on). There are no advertising or analytics cookies.
Voice
If you use the microphone, your speech is turned into text by your browser's own speech recognition. Depending on the browser this may be processed by the browser vendor (for example Google for Chrome). We only receive the resulting text. Spoken replies are generated on our servers and not stored.
Your rights
- Access and export: you can download everything we hold about you from the Account page, as a single archive.
- Correction: change your email and password in the app; ask us for anything else.
- Deletion: delete your account on the Account page. Your account, characters, conversations, pictures and videos are removed immediately; usage counters and the safety log are kept for the periods above without your name attached to a live account, then deleted. Backups roll off within 30 days.
- Objection and restriction for processing based on legitimate interest, and portability for data you gave us.
- You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the authority in your country.
Write to [privacy email] for any request. We answer within a month.
Security
Passwords are stored as salted scrypt hashes. Traffic is encrypted. Servers are reachable only through a private network, apart from the web application itself. Administrators can see account data and the safety log, and can open a conversation only when investigating a report of abuse.
Changes
We will announce changes to this policy in the app. This is version 1.