Privacy Policy

1. Data we collect

• Account: email address, name, gender and age range from onboarding, “About me” text, social links.
• Content: chat messages and character replies, chat archive, memories, chat settings, comments, likes and favorites, creator follows, blocks, reports and support requests with attachments.
• Balance: gem credits and charges, purchases, invite code.
• Payments: from our payment provider (Stripe) — the name, email and billing address (country, postal code and, if given, city and state) you enter at checkout, what you bought, amounts, payment status, refunds and disputes. Card details stay with Stripe.
• Purchases in our apps: from Google Play or the App Store, through RevenueCat — what you bought, the price and currency, your country, the transaction identifiers and status, renewals, cancellations and refunds. Card details stay with the store.
• Our Android and iOS apps: an installation identifier created by the app, device model, operating system and app version, language, time zone, screen and storage size, the install referrer of the store (which link led to the installation); on Android, the device's advertising ID unless you have limited ad tracking in the device settings; and, if you allow notifications, a push notification token.
• Technical data: IP address and browser details in server logs, session identifier, and the approximate location (city, region, country) we derive from your IP address on our own servers.
• Advertising and analytics data: a random visitor identifier stored in your browser, the ad campaign tags of your first visit (utm, ad, ad set and campaign ids, fbclid) and the Meta and Google Analytics cookies described in section 4.

We don't collect your date of birth, ID documents or precise location. Card details are handled only by the payment provider.

2. Why

• To provide the service: sign-in, chats, reply generation, balance, purchases — under our contract (Terms of Service).
• Safety and rule enforcement: age checks, moderation of reports, fraud and abuse prevention — legitimate interest and legal obligations.
• Support: answering your requests.
• Notifications: telling you that a photo or video is ready, that your daily gems are waiting or that a character is waiting for your reply — only if you allow notifications; you can turn them off at any time in your device or browser settings.
• Improving the service: aggregated usage statistics.
• Measuring and optimizing our ads (Meta, Google Analytics): in the EU, the EEA, the UK and Switzerland only with your consent given in the cookie banner; elsewhere on the basis of our legitimate interest in measuring our advertising. You can withdraw consent or object at any time in “Cookie settings”.

We don't sell personal data and don't use your chats or their content for advertising.

3. Who we share data with

• xAI (Grok models) — to generate character replies and “inspirations”: we send the character description, recent chat messages, your memories and chat settings, and your profile name. Your email is not sent.
• Stripe — payment processing, invoices, the customer portal, refunds and disputes: your email, name, billing address and payment details.
• Google Analytics — site usage statistics: pages visited and product events (for example, sign-in, viewing plans, starting a checkout, purchases with their amount, sent from our server), a random browser identifier and ad campaign tags; IP addresses are anonymized.
• Meta (Meta Pixel and Conversions API) — to measure and optimize our ads: events such as sign-up, viewing plans, starting a checkout and purchases (with amount and currency), together with your random visitor identifier and account identifier, ad click identifiers (fbclid, _fbc), the _fbp cookie, your IP address and browser, and — hashed with SHA-256 before sending — your email, the name and billing address (city, state, postal code, country) from the payment, the approximate location derived from your IP address, and the gender from your profile. Purchases made in our apps are sent the same way from our server; when we send them as app events, they also include the app's installation identifier, device details and, on Android, the advertising ID unless ad tracking is limited. We never send your chats or their content.
• OneSignal — delivery of emails with sign-in codes (your email address) and of push notifications (your account identifier, the push notification token and basic device details: model, operating system, language, time zone).
• Google Play and the Apple App Store — payment, renewal, cancellation and refunds of purchases made in our apps.
• RevenueCat — processing of purchases and subscriptions made in our apps: your account identifier, what you bought, the price, transaction identifiers and status.
• Google Firebase / Google Cloud — sign-in with Google or Apple (Firebase Authentication) and file storage (images, support attachments).
• Hosting provider Scaleway (France, EU) — servers and database.
• Authorities — only when legally required.

We determine approximate location from IP addresses ourselves, with a MaxMind GeoLite2 database stored on our servers; your IP address is not sent to MaxMind.

Some providers are located outside your country (for example, in the USA). Transfers use the safeguards required by applicable law.

4. Cookies and browser storage

Sign-in uses one essential cookie with a session identifier (httpOnly, not accessible to page scripts); the service can't work without it.

Google Analytics (_ga) and the Meta Pixel (_fbp, _fbc) set their own cookies to measure visits and ad performance. In the EU, the EEA, the UK and Switzerland they are loaded only after you accept them in the cookie banner; elsewhere they are on by default. You can change your choice at any time in “Cookie settings” (in the page footer and in Settings), and you can also block them in your browser — the service keeps working.

Browser storage (localStorage) keeps display preferences: language, chat appearance, recent chats and search queries, the “Unrestricted” mode choice, your cookie choice, and for ad measurement a random visitor identifier and the ad campaign tags (utm, ad ids, fbclid) of your first visit.

5. Retention

Account data and content are kept while the account exists. After deletion they are removed from the live database immediately and from backups within 30 days. Payment records may be kept longer where accounting or tax law requires. Server logs are kept up to 90 days. Records of the events we sent to Meta and Google Analytics are kept up to 24 months. After an account is deleted, we keep only an irreversible hash of its email address, so that welcome bonuses are not given again if the same address signs up later.

6. Your rights

• Get a copy of your data and information about its processing.
• Correct your data — in your profile or via support.
• Delete your account and data — from the profile menu (“Delete account”).
• Restrict or object to processing, withdraw consent.
• Complain to your local data protection authority.

For requests, write to swoonie@riseforward.biz. We reply within the period required by law, usually within 30 days.

7. Age

The service is for people aged 18 or older only. If we learn an account belongs to a minor, we will delete it and the related data.

8. Security

Connections are encrypted (HTTPS), session tokens are stored only as hashes, and staff access to data is restricted. No system is perfectly secure — please tell us if you find a vulnerability.

9. Changes and contact

We will give advance notice of material changes. Data controller: Riseforward Ltd., Level 1, Blue Harbour Business Centre, Ix-Xatt Ta' Xbiex, Ta' Xbiex XBX 1027, Malta. You may also complain to the Information and Data Protection Commissioner (IDPC), Malta — idpc.org.mt. Privacy contact: swoonie@riseforward.biz.