Privacy Policy

1. Information handled

The account flow handles name, email, mobile number and credentials through the configured authentication service. Identity-provider profile photos may be displayed when supplied. Profiles can contain family relationships, biographies, important dates, language/region preferences and information about people other than the account holder.

Memory features handle photos, videos, voice recordings, stories and private-message content that you choose to provide. Chat and voice features can handle prompts, replies, recordings or transcripts. Not every feature is enabled or available in every environment.

2. Local storage, cloud sync & AI processing

The browser implementation uses local storage for session-related state, language, Memory Space/profile information and some memory/chat state. Some paths sync content to the configured Supabase database or private storage. Signing out does not erase all locally stored memory/profile content; use particular care on shared devices.

Source code includes server-side OpenAI chat, speech transcription and speech generation integrations. Context assembled from selected profile/memory information may be processed for AI replies. This is not an offline-only service. Do not submit sensitive information without the necessary authorization.

[REQUIRES CONFIRMATION] The exact deployed processing paths, fields sent for each AI operation, logs, analytics/cookies, training use, processing locations, cross-border transfers and provider retention must be verified against deployment and contracts before approval.

3. Service providers & sharing

Source integrations include Supabase for authentication/data/storage, OpenAI for configured AI operations, Jitsi Meet for video meetings and an optional, separately consented LiveAvatar media panel. These source integrations are not a verified list of active production subprocessors. A gated voice-clone flow exists separately and is not authorized by these general acknowledgements.

A shared video room involves other participants and its meeting provider. Only share room details with intended participants. Displaying a provider-hosted account photo may request it from that host.

[REQUIRES CONFIRMATION] Approve the complete provider/subprocessor inventory, hosting arrangements, legal disclosures, sharing purposes and lawful bases. This draft does not promise that data is never shared, sold, used for training or transferred internationally.

4. Security & retention

The application uses existing authentication, server authorization and private-media access helpers. These mechanisms reduce certain risks but do not guarantee confidentiality, availability or freedom from unauthorized access.

Local content can remain after logout; cloud record deletion does not establish deletion of stored media, backups, logs or provider copies. See Data Retention & Deletion for the implementation limits.

[REQUIRES CONFIRMATION] Security controls, access reviews, incident handling, backup practices and category-specific retention periods are not certified by this policy. No security certification or fixed deletion deadline is claimed.

5. Rights, requests & Indian law review

You may wish to request access, correction, deletion, export, withdrawal or information about processing. The scope of legally applicable rights and any exceptions must be confirmed; an account-wide self-service request/export/deletion workflow is not implemented.

The Grievance & Support draft explains information to prepare for a request. Approved contact details and a monitored submission channel are currently missing, so this page cannot receive or confirm a request.

[REQUIRES CONFIRMATION] An India-qualified technology/privacy lawyer must confirm applicable Indian data-protection requirements, their commencement dates, legal bases, notices, children's data rules, rights and grievance obligations. No claim of DPDP or other legal compliance is made.