Privacy Policy

When you use Avatai, we collect information you provide directly: your account email and display name (via Google or Apple Sign-In), characters you create, messages you send, and any content you submit through our contact form.

We automatically collect usage data including message counts, feature usage, basic device information (OS version, app version), and device identifiers (Advertising ID on Android; IDFA on iOS only after you grant App Tracking Transparency consent) for analytics and ad delivery. We do not track you across other websites.

Your information is used to:

• Provide and maintain the service (authentication, chat, memory features)
• Process subscription billing through Apple App Store and Google Play
• Improve service quality and fix issues
• Respond to your support requests

What is sent to AI services: the text of your chat messages, the character's persona definition, recent conversation history, and condensed memory facts (preferences and topics you have shared in chat). We do not send your account email, real name, payment information, or device identifiers to AI providers.

Who receives it: OpenRouter (an AI gateway that routes requests to large language model providers such as Mistral AI) and Groq (used for memory processing on Pro accounts). Embeddings are generated through OpenRouter using OpenAI's embedding model.

Your consent: Before your first chat, the app displays a consent screen explaining this data flow. You must explicitly accept before any message is sent to an AI service. You can withdraw consent at any time by deleting your account.

Equal protection: OpenRouter, Groq, and the LLM providers they route to are bound by data processing terms requiring privacy protections equivalent to those described in this Policy. They do not use your messages for model training and do not link messages to your real-world identity.

We store conversation history and extracted memory facts on our servers to provide the persistent memory feature. AI-generated content may be inaccurate, inappropriate, or offensive. We do not manually review conversations. The AI operates based on character definitions and conversation context.

You are solely responsible for the content you create, including characters, messages, and any material shared through the platform. Avatai does not monitor, endorse, or take responsibility for user-generated content.

By creating public characters, you grant Avatai a non-exclusive license to display them to other users. You retain ownership of your content and may delete it at any time.

Your data is stored on secure servers provided by Supabase (cloud infrastructure). Conversations and memory data are encrypted in transit. We implement row-level security to ensure users can only access their own data.

When you delete a conversation, all associated messages and memory facts for that conversation are permanently removed.

• Conversation messages & memory facts: retained while the conversation exists; deleted permanently when you delete the conversation.
• Character data: retained while the character exists.
• Account data: retained while your account is active; deleted within 30 days of an account deletion request.
• Payment information: Avatai does not collect or store payment card information. All purchases are processed by Apple App Store or Google Play, who retain payment records under their own policies.
• Subscription state: the most recent subscription status (plan, expiration, store receipt token) is stored to determine your entitlements. Older receipts are overwritten on each verification.
• Credit & purchase audit logs (purchases, ad rewards, deductions): retained for abuse detection and accounting reconciliation. When you delete your account, these logs are anonymized — your user identifier is removed but aggregate transaction data is preserved.
• AI provider data: AI providers may temporarily retain messages (typically up to 30 days) for abuse prevention and quality monitoring; they do not use messages for model training.

We use the following third-party services:

• Google Sign-In / Apple Sign-In — authentication
• Supabase — database, storage, authentication
• OpenRouter — AI gateway routing chat messages and memory-mining requests to large language model providers (e.g., Mistral AI); also used for embeddings via OpenAI
• Groq — large language model provider used for memory processing on Pro accounts
• Google AdMob — rewarded advertisements (may collect device identifiers and usage data for ad personalization)
• Apple App Store / Google Play — in-app purchase and subscription billing
• Vercel — hosting and analytics

All third parties listed above are bound by data processing terms requiring privacy protections equivalent to those described in this Policy. AI providers do not use your messages for model training. Each service has its own privacy policy governing their use of your data.

Avatai displays rewarded advertisements through Google AdMob. AdMob may collect device identifiers (such as Advertising ID), IP address, device information, and usage data to serve and measure ads. You may opt out of personalized advertising through your device settings. On iOS, you will be prompted for consent via App Tracking Transparency before any tracking occurs.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Deletion — request deletion of your personal data
• Correction — request correction of inaccurate data
• Opt-out — opt out of personalized advertising via your device settings

To exercise any of these rights, please contact us through our contact form. We will respond within 30 days.

You may delete your conversations, characters, and account data at any time through the app. To request complete account deletion, contact us through the contact form. We will process deletion requests within 30 days.

Avatai is intended exclusively for users aged 18 and older. We do not knowingly collect information from anyone under 18. If a parent or guardian believes their child has provided us data, please contact us through our contact form and we will delete the data within 7 days.

We may update this policy from time to time. We will notify users of significant changes through the app. Continued use of the service after changes constitutes acceptance.

For privacy-related questions, please use our contact form.