Privacy Policy

Device ID and account

• Device ID: a random identifier the app creates on your device (not an advertising ID). It is sent with every request so that usage limits, purchases, ad rewards and bug investigation work even without an account. While you are signed in it is stored in the same records as your account.
• Email address (if you register): used for sign-in and account management. Sign-in codes are sent by email and expire 15 minutes after they are issued.
• Password (if you set one): we never store the password itself, only a one-way hash.

Conversations and AI

Characters' replies are generated by AI. To generate a reply, what you type, the recent conversation and related memories are sent through our server to the following AI providers. Our server does not store the conversation text it sends for this purpose.

• Google (Gemini API): the main model for conversations. Part of a prompt may be cached temporarily by Google to make replies faster.
• OpenRouter: rewriting replies and, when enabled, deciding how a story moves on.
• DeepInfra: rewriting replies and safety checks of text that will be published.

Your personal conversations, memories and story progress are stored mainly on your device, encrypted. Deleting the app deletes them.

Account backup of memories (only if you choose it): after signing in, you can have conversations, memories, relationship and story progress encrypted on your device and stored on our server so you can restore them on another device. Each account has its own encryption key, protected by a separate server key. Because we can technically decrypt it, this is not end-to-end encryption. Backups not used for 24 months are deleted.

Use of conversations for training (only with your consent): only if you agree to "Use my conversations to improve quality and train AI", we store what you type, the character's replies and the context used to generate them, and use them to improve quality and to develop and train our AI models. You can withdraw consent at any time in the app settings, which deletes what was stored. We never sell or provide stored conversations to third parties. Please do not write sensitive information such as health conditions in conversations.

Published content, reports and blocks

• Characters, stories and worlds you publish: names, settings, text and tags are stored and shown to other users. Before publishing, the text is checked by a classification model on DeepInfra.
• Uploaded images (characters created on the website only): checked by Amazon Rekognition for inappropriate content and stored as public images.
• Reports: we store the reporting account, the target, the reason and any note.
• Reports of AI replies: we store a copy of the reported reply and the message before it, a reference to the character, the reason, and your account or device ID. The app tells you this before sending.
• Blocks: the authors you block, and the character or story you blocked them from, are stored on your device and (when signed in) your account, and used to hide that author's published content.
• Invite-only Rooms (where offered): members, messages, shared stories and votes are stored so members can play the same continuation. Your personal conversations and memories are never moved into a Room.

Usage measurement

To improve the Service we record usage events such as screens viewed, characters chosen, stories started and finished and purchases started, together with the device ID (or an anonymous visitor ID), and with your account while you are signed in. Events never contain conversation text, character settings or the text of memories.

In the app, turn off "Settings → Help with anonymous usage data" to stop recording from that moment; unsent events are discarded. On the website, use "Turn off usage measurement" in the footer; if your browser sends Global Privacy Control (GPC), we do not measure at all.

On the website, we also send page types to Google Analytics. Google uses an _ga cookie to count visits and processes browser and connection information. We do not send search parameters, character names, invite codes or conversation text. Turning off measurement in the footer also stops Google Analytics and removes its _ga cookie.

Crash reports and AI usage records

• Crash reports: when the app hits an error, it sends the error text (up to 1,000 characters), stack trace, app version, OS type, screen name and time, with the device ID. No account or IP address is attached. Because we need them to fix bugs, these reports cannot be turned off. They are deleted after 30 days.
• AI usage records: for each reply we record the device ID, account (if signed in), character and story identifiers, model used, amount of text (tokens), cost and latency. No conversation text is included. Used for cost management and quality improvement.

Purchases

In-app purchases are paid through Apple or Google; we never receive card numbers or other payment details. To confirm a purchase is valid, our server verifies the store receipt and records the product, transaction ID, device ID, account, status and expiry in a purchase ledger.

Advertising

When you have used up your free conversations, you can choose to watch a rewarded ad served by Google AdMob. We never use your conversations for advertising and do not profile you for ads. Our app requests non-personalized ads only.

The AdMob SDK may process device information, IP address and the advertising ID (the Android advertising ID; the iOS advertising identifier is not used because we do not ask for tracking permission) to show, measure and prevent fraud in ads. To give the reward to the right user, we pass our device ID to Google. Google's handling of information is governed by Google's privacy policy. You can limit use of the advertising ID in your device settings.

Web advertising: Google AdSense ads are not currently being served. Once approval and consent management are ready and ads are enabled, ad placements will appear only on public home pages for signed-out visitors. We do not place ads on signed-in pages, conversations, DREAM, purchase screens or URLs with search parameters.

When web ads are enabled, Google may process IP addresses, browser and device information, and cookies to display and measure ads and prevent fraud. We do not attach conversation text, memories, DREAM content or account IDs to web advertising data. Non-personalized ads may still use cookies. See Google's privacy policy and its explanation of advertising.

Before serving web ads, we will provide a Google-certified consent management platform (CMP), obtain consent for cookies and similar technologies where required, and provide ways to refuse or revisit consent settings. Ads will not load until the applicable consent-management conditions are met.

Notifications

If you allow notifications, we store the notification address (an Android Firebase Cloud Messaging token or a web browser push subscription) with your device ID, account, language and time zone, and use it to send notifications. Delivery records are deleted after 30 days and addresses that stop working after 90 days. You can turn notifications off at any time in your device settings.

Cookies and browser storage on the website

The public website uses an anonymous visitor identifier "ol_anon" for up to 1 year, a visit identifier "ol_sess" for about 30 minutes and, when you sign in, a session cookie "ol_session" for up to 30 days. The trial chat identifier and your age confirmation and AI consent are kept in the browser's localStorage. Cookies never contain conversation text.

What you type in a trial chat, and the recent context, is sent to the AI providers above to generate replies. A trial conversation is saved to your account, as the start of that character's conversation (up to the last 40 lines), only when you press "Save it for free" and sign up. Otherwise it is not stored, and it is never used for training.

IP addresses

To prevent abuse, rate limits use your IP address (or a value derived from it) temporarily, for up to 24 hours. IP addresses are not stored in usage records. Some features estimate your country from the IP address to decide whether they can be offered there; this is not stored.

Service providers

To provide the Service we use, or send information to, the following providers:

• Google (Gemini API): generating conversations
• OpenRouter: rewriting replies, story decisions
• DeepInfra: rewriting replies, safety checks of published text
• Amazon Web Services (Amazon SES / Amazon Rekognition): sign-in emails / safety checks of uploaded images
• Vercel: running our servers, storing public images
• Upstash: temporary storage such as usage counts and purchase copies
• Our database provider: storing the records above
• Cloudflare: delivering character images (images are only downloaded; none of your information is sent)
• Apple / Google: payments and receipt checks, notifications via Google Firebase Cloud Messaging
• Google AdMob: rewarded ads
• Google AdSense: ads on public web pages (not currently served; only if enabled)

Some of these providers are outside Japan (for example in the United States), and information may be processed there.

Purposes

• Providing the Service (generating replies, keeping memories, applying purchases, notifications)
• Managing usage and preventing abuse
• Detecting inappropriate posts and handling reports
• Investigating and fixing bugs, improving features
• Only with your consent, developing and training our AI models
• Answering your enquiries

Except as required by law, we never sell or provide your personal information to third parties without your consent.

Retention

• Conversations and memories on your device: until you delete the app
• Account (email address, password hash): until you delete the account
• Sign-in codes: invalid 15 minutes after issue; the records are deleted when the account is deleted
• Account backup of memories: until you delete it; deleted after 24 months without use
• Conversations stored for training: until you withdraw consent or delete the account
• Published content and uploaded images: until you delete them, they are suspended for a violation, or you delete the account
• Reports, AI-reply reports and blocks: until you remove them or delete the account
• Usage records: individual rows until account deletion or a deletion request; daily totals for 90 days
• Crash reports: 30 days (on account deletion, those from devices used with the account are deleted too)
• AI usage records: kept without a fixed limit; unlinked from your account when it is deleted
• Purchase ledger: kept for refunds and tax purposes; unlinked from your account when it is deleted
• Notification addresses: delivery records 30 days, addresses that stop working 90 days
• IP-based rate limits: up to 24 hours
• Cookies: as described in "Cookies and browser storage on the website"

Deletion and your choices

Deleting your account: you can delete it yourself at any time in the app under "Settings → Account → Delete account". Deletion happens immediately and cannot be undone. If you cannot use the app, you can request deletion by email as described on the account deletion page; we delete the account within 30 days of verifying that the request is yours.

Deletion removes the account, your email address and sign-in codes, the characters, stories, worlds and images you published, your reports, AI-reply reports and blocks, your account backup of memories, conversations stored for training, usage records linked to the account, notification addresses, temporarily stored data linked to the account (including purchase copies), and crash reports from devices used with the account. The purchase ledger and AI usage records are kept, unlinked from your account.

Deleting your account does not cancel an App Store / Google Play subscription. Please cancel it in the store first.

In the app settings you can also stop usage recording, withdraw training consent (which deletes stored conversations) and delete your account backup of memories. To delete usage records from a device used without signing in, or to request disclosure, correction or suspension of use of your information, contact us below.

Age

The Service is intended for people aged 18 and over. We do not knowingly collect information from anyone under 18.

Changes

If we change this policy, we will announce it on this page or in the app.