Privacy Policy

Last updated: March 9, 2026

1. Information We Collect

We collect the following information:

• Account information: email address, username, and display name
• Authentication data: password (hashed), OAuth tokens from Google Sign-In
• Chat data: messages you send and receive within the App
• Device information: device type, operating system, and push notification tokens
• Usage data: app interactions, feature usage, and analytics

2. How We Use Your Information

We use your information to:

• Provide and improve the App experience
• Personalize AI character interactions
• Send transactional emails (verification, password reset)
• Process payments and manage subscriptions
• Ensure safety and enforce our Terms of Service

3. Data Storage and Security

Your data is stored on secure servers hosted by Railway (cloud infrastructure). Passwords are hashed using bcrypt. We use HTTPS for all data transmission and JWT tokens for authentication.

4. Third-Party Services

We use the following third-party services:

• Google Sign-In: for OAuth authentication
• Google Play / Apple App Store: for payment processing
• Firebase Cloud Messaging: for push notifications
• Resend: for transactional emails
• Amazon S3: for file storage (avatars, images)
• Sentry: for error monitoring

5. AI and Chat Data

Your chat messages are processed by AI models to generate responses. We may store conversation history to provide continuity in your interactions. AI-generated character memories are stored to personalize your experience.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account, all associated data (messages, conversations, characters, memories) is permanently deleted.

7. Your Rights

You have the right to:

• Access your personal data through the App
• Update your account information
• Delete your account and all associated data
• Export your data upon request

8. Children's Privacy

The App is not intended for children under 13. We do not knowingly collect information from children under 13. If we discover such data, we will delete it promptly.

9. Cookies and Local Storage

The mobile App uses secure local storage for authentication tokens. The admin dashboard uses HTTP-only cookies for session management.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes through the App or email.

11. Contact

For privacy-related questions, contact us at support@xomi.app.