Privacy Policy

1. Who we are

Swoonly ("we", "us", "the Service") is operated by Craig Kidney, based in New Brunswick, Canada. This policy describes what personal data we collect, how we use it, and the choices you have. Questions: contact support or email [email protected].

2. Data we collect

Account data: your email address, a hashed password (never stored in plaintext), an optional display name, and — when you sign in with Google or Meta — the OAuth provider's public account identifier and verified email only.

Content you create: character profiles you build, messages you send in chat, images and videos you generate, voice notes you record, ratings and reactions.

Usage data: tokens spent, media generated, subscription status, feature interactions, and the timestamps needed to run the Service.

Payments: handled entirely by CCBill (our payment processor). We store only the transaction identifier and the amount — never your full card number, expiry, or CVV.

Diagnostics: request logs (IP address, user agent, path, status code) retained for up to 30 days for troubleshooting and abuse prevention.

3. How we use it

To provide the Service you asked for: run your account, generate replies, produce images and videos, remember conversation context, deliver voice notes, meter and bill for token use, and support you when you contact us.

To keep the Service safe: enforce our Terms of Service, block prohibited content, prevent abuse and fraud, and comply with legal obligations.

We do NOT use your content to train third-party AI models or advertise to you. We do NOT sell your personal data. Ever.

4. Third-party processors

We share the minimum necessary data with the following processors to operate the Service. Each is bound by contract to protect it.

• AI model providers (chat, image, video, voice) — OpenRouter, wiro.ai, Venice, AtlasCloud. Your messages and any prompts you generate are sent to whichever provider you or we have selected for that call. Selection is visible in your Settings.
• Hosting — DigitalOcean (application and database, Toronto region).
• Media storage and delivery — Backblaze B2 (origin) and Bunny (CDN) for images, videos, and voice notes you generate.
• Payments — CCBill. When you buy tokens or subscribe you leave our site for CCBill's hosted checkout; they collect and process your card details directly.
• Sign in with Google / Meta — optional. Only the account identifier and verified email are received from them.

5. Retention

Account and content data are kept for as long as your account exists. Delete your account from Settings → Privacy & data at any time — this removes your account, characters, messages, and generated media within 30 days, subject to legal retention requirements (e.g. payment records for tax purposes). Server access logs are kept up to 30 days.

6. Your rights

Under GDPR, CCPA, PIPEDA, and comparable laws you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Use Settings → Privacy & data for self-service export and deletion, or contact us for anything else. We respond within 30 days.

You may withdraw consent to non-essential processing at any time; this does not affect the lawfulness of processing done before withdrawal.

7. Cookies and local storage

We use one strictly necessary session cookie (cmp_session) to keep you signed in. No analytics cookies, no advertising cookies, no third-party trackers. Your browser also uses local storage on-device for per-viewer conveniences (a remembered tab, a draft message); nothing there is sent to us.

8. Age of users

The Service is for adults 18 and older. We do not knowingly collect personal data from anyone under 18. If we learn we have, we delete it.

9. Data transfers

The Service is hosted in Canada. Our processors may operate in the US, EU, or elsewhere. We rely on standard contractual clauses or equivalent safeguards where a transfer requires them.

10. Security

Passwords are hashed with PBKDF2-HMAC-SHA256. Traffic is served over HTTPS. Payments are handled by CCBill on their own PCI-DSS-compliant systems. No system is perfectly secure — if we become aware of a breach that affects your data, we will notify affected users without undue delay.

11. Changes

We may update this policy from time to time. Material changes will be signalled by an updated "Last updated" date at the top of this page and, where required, by notice in the app.

12. Contact

Craig Kidney (Swoonly), New Brunswick, Canada. [email protected] — support.