Privacy Policy

1. Information we collect

Account information. When you sign in with your email, we store your email address. When you sign in with Google, Google sends us your email address, your name, and your profile picture. We do not receive your Google password.

Profile information. Your display name, avatar, bio, and a randomly generated user ID shown on your profile.

Content you create. Chats, characters, personas, images, and any other content you create, upload, or generate on the Service, including the messages you send to AI characters and the replies you receive.

Payment information. If you buy credits or a subscription, payment is processed by Stripe. We receive a Stripe customer ID, the plan you purchased, and the payment status. We never see or store your full card number.

Usage and technical information. Server logs, IP address, browser type, device information, pages visited, and timestamps. We use this to keep the Service running and secure.

Cookies. We use cookies only to keep you signed in and to remember basic preferences. We do not use advertising cookies.

2. How we use information

• To provide the Service: create your account, run your chats, save your progress, show your content.
• To generate AI replies (see Section 3).
• To process payments and manage credits and subscriptions.
• To keep the Service safe: detect abuse, enforce our Terms of Service, review reported content.
• To communicate with you about your account, such as sign-in links and billing notices.
• To improve the Service using aggregated, de-identified usage data.

We do not sell your personal information.

3. AI processing

The Service uses large language models and image models operated by third-party AI providers. To generate a reply, the messages in your chat, the character definition, and your persona are sent to the AI provider. Providers process this data on our behalf under their business terms and do not use it to train their models. Do not include sensitive personal information (such as health, financial, or government ID details) in your chats.

AI-generated content is fictional and may be inaccurate. It is not professional advice.

4. How we share information

We share information only with:

• Service providers that host and run the Service: Supabase (database, authentication, and file storage), Railway (application hosting), Stripe (payments), Google (sign-in, if you use it), and our AI model providers. Each provider may only use your data to provide its service to us.
• Other users, when you choose to publish content. Published characters, chats, and your public profile (display name, avatar, bio, user ID) are visible to other users.
• Authorities, when required by law or to protect the rights, safety, or property of SONAI, our users, or others.
• A successor if SONAI is involved in a merger, acquisition, or sale of assets. We will notify you before your information becomes subject to a different privacy policy.

5. Data retention

We keep your account information and content for as long as your account exists. If you delete your account, we delete your personal information and content within 30 days, except for records we must keep for legal, tax, or fraud-prevention reasons, and for aggregated data that no longer identifies you. Server logs are kept for up to 90 days.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update your profile in the app and delete your account from Settings. For any other request, email us at [[PRIVACY_EMAIL]]. We respond within 30 days.

If you are in the European Economic Area or the United Kingdom, our legal bases for processing are performance of our contract with you, our legitimate interests in running and securing the Service, your consent where we ask for it, and compliance with legal obligations. You may lodge a complaint with your local data protection authority.

If you are a California resident, you have the rights described in the CCPA, including the right to know, delete, and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioral advertising.

7. International transfers

The Service is hosted in the United States. If you use it from outside the United States, your information is transferred to and processed there. Where required, we rely on standard contractual clauses or other approved safeguards.

8. Security

We protect your information with encryption in transit, access controls, and regular review of our systems. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

9. Children

The Service is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with information, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. If the changes are material, we will notify you by email or with a notice in the Service before they take effect. The effective date at the top shows when the policy was last revised.

11. Contact

[[COMPANY_LEGAL_NAME]]
[[COMPANY_ADDRESS]]
[[PRIVACY_EMAIL]]