Legal

Privacy Policy.

Last updated: April 2026

We keep this short because privacy should be easy to understand. No dark patterns, no 40-page legalese, no selling your data.

TL;DR: We collect the minimum needed to run the service. Your conversations stay between you and the AI character. We don't sell anything. You can delete your data any time.

What we collect

Data	Why
Email (if you sign in)	Account recovery, session credit balance
Wallet address (if you pay with crypto)	Attribute payment to your account
Chat messages	Deliver the conversation, build character memory
Voice transcripts	Same as above, voice sessions are transcribed in real time
Character prompts you create	Run the character, display on Network if public
Payment records	Receipts, refunds, fraud prevention
Basic telemetry (errors, latency)	Keep the service working

We do not collect: real names, addresses, phone numbers, IDs, health records, location data, browsing history, contacts, or anything else not listed above.

Where it lives

Supabase — auth, database (accounts, character configs, payment records, messages).
Mem0 — long-term memory summaries for AI characters (so they remember you across sessions).
LiveKit — real-time voice transport (not stored after call ends).
OpenRouter / Gemini — the LLM that generates character replies (see OpenRouter's privacy policy for their retention).
xAI Grok — text-to-speech. Receives text to synthesize, doesn't retain.
Cartesia — speech-to-text. Receives audio chunks, doesn't retain.
Stripe — card processing. If you pay with card, Stripe holds card details (we never see them).

What we do NOT do

Sell or rent your data to anyone, ever.
Train foundation models on your conversations.
Share your chats with advertisers, data brokers, or insurance companies.
Read your private conversations (except when legally compelled, or when you report abuse).
Require an email to use the free tier — anon sessions just use a local session ID.

Your rights

Access: email ai.therapy.free@proton.me and we'll send you everything we have on you within 30 days.
Delete: same email, we delete your account and all associated data within 30 days. Mem0 memories are wiped. Payment records are retained for accounting for 7 years as required by law — but detached from your identity.
Export: we send a JSON dump of your account + messages.
Correct: you can edit your own character prompts, delete individual chat messages, or ask us to fix anything wrong.

Cookies + tracking

We use one first-party cookie (or localStorage equivalent) to keep you signed in. We don't use Google Analytics, Meta Pixel, or any third-party tracker. No cross-site tracking.

Crypto payments

Blockchain transactions are public by nature. If you pay in ETH or USDC on Base, the tx hash and your wallet address are publicly viewable on-chain forever. We link your wallet to your account server-side. If you disconnect the wallet, the link on our side is removed — but the chain record stays.

Children

Not for anyone under 18. If we find out a user is under 18, we delete the account. No exceptions.

Security

Passwords are hashed (we use Supabase Auth, bcrypt). Data is encrypted in transit (TLS). Secrets are stored in environment variables, not in the code. We're not a bank — don't put things in chat that you wouldn't put in a regular email.

Data breaches

If something leaks, we'll email affected users within 72 hours and post a notice on the landing page. We'll say what happened, what data was involved, and what we're doing about it.

Transfers

Data may be processed in the US and EU depending on which provider handles it (Supabase, Stripe, LiveKit etc.). We use providers with standard contractual clauses where required.

Changes

If we change this policy materially, we'll email you (if we have your email) and post a note on the landing page. Minor changes just get a new "Last updated" date.

Contact

Privacy questions or requests — email ai.therapy.free@proton.me.

ai.therapy · Last updated April 2026 · Terms · Disclaimer