Privacy Policy

1) What data we process

• Google/Firebase sign-in data (e.g., UID, email, display name, profile image).
• Portrait photos you upload to generate avatars.
• Avatar and character data (name, voice, role/context text, system prompt if provided).
• Technical usage/event data (e.g., event types, error context, page and feature usage, pseudonymous hashed user identifier).
• Campaign and attribution parameters from the URL where present (e.g., `utm_source`, `utm_campaign`, `utm_term`).
• Demo usage counters (e.g., local demo ID for limit handling).

2) Why we process data

• To provide sign-in, avatar generation, and live conversation features.
• To store your avatars/characters and processing progress.
• To maintain security, prevent abuse, debug issues, and improve the product.

2a) Analytics / “typical tracking”

• We use technical, pseudonymous event tracking (e.g., clicks, error events, usage events) to improve reliability and product quality.
• We store a random anonymous ID in the browser. If you are signed in, your auth state may be used server-side only to derive a stable pseudonymous hash. We do not store a plain-text account user ID in metrics storage.
• This tracking is not used to identify you by name; it is used to technically link related events from the same usage context.
• We currently do not embed Google Ads or other third-party conversion tracking in the frontend. If campaign parameters are present in the URL, we may store them internally alongside events to understand which sources led to product usage.

3) Legal bases (GDPR)

• Art. 6(1)(b) GDPR (contract/performance of service).
• Art. 6(1)(f) GDPR (legitimate interest in secure, reliable operation).
• Art. 6(1)(a) GDPR (consent), where specifically required.

4) Storage & recipients

Data may be processed in our database and cloud infrastructure required for uploads, media processing, and delivery. We do not sell personal data.

5) Your rights

You may have rights to access, rectification, deletion, restriction, portability, and objection under applicable law (including GDPR). For requests, contact us via your legal notice/support contact.

6) Note

Please only upload content you have rights to use and avoid sharing sensitive data in free-text fields unless necessary.