Privacy Policy

What we collect

• Account data: e-mail, language preferences and age confirmation — plus age-verification data where required by the law of your region.
• Technical data: IP address, device and browser type, and access logs kept for up to 30 days for security and diagnostics.
• Conversation and creation data: messages, character settings and preferences, and the memory your companion builds from them.
• Purchase data: transaction history. Card details are handled exclusively by the payment processor; at most we receive partial references (such as the last digits) for support.

How we use it and legal bases

• Providing the service (account, conversations, memory, purchases, support) — performance of contract.
• Security, fraud prevention, content moderation and product improvement using aggregated data — legitimate interest.
• Marketing communications — only with your consent, revocable at any time.
• Compliance with legal obligations — where the law requires.

We do not sell your data. We do not use your conversations to train AI models without your explicit consent.

Who we share with

• Providers necessary to operate, under contract: the payment processor, hosting and AI-model infrastructure, moderation and communication tools.
• Professional advisers (legal and accounting) and authorities, where required by law.
• In a corporate transaction (merger, acquisition or sale of assets), with the business successor, who remains bound by this policy.

In the event of a payment dispute (chargeback) or fraud, we share with the payment processor, banks and card networks, to the extent necessary for the defence, records of access to and use of the service — including IP address, dates and times, purchase and consumption history and evidence that the contracted content was delivered and used. Legal bases: defence of rights in disputes and legitimate interest, including fraud prevention, as permitted by the data protection laws applicable in your country — for example the GDPR in the EU and UK, the LGPD in Brazil and equivalent laws in other jurisdictions.

Sign in with Google and Apple

You can create your account and sign in with Google, with Apple or with your e-mail address. We never store a password.

• Google user data we access: when you choose Sign in with Google, we receive from Google only your basic profile — name, e-mail address and profile picture — through the OpenID Connect scopes openid, email and profile. We do not request access to Gmail, Drive, Contacts, Calendar or any other Google service.
• How we use it: only to create your Amoryne account, sign you in, show your name and picture in your profile and send you account e-mails (sign-in codes, receipts, security notices).
• Sharing: we do not sell, transfer or disclose Google user data to third parties, and we do not use it for advertising, for training AI or machine-learning models, or for any purpose other than operating the service. Our use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Protection: the data is stored encrypted at rest, in a database with row-level access controls, and transmitted only over HTTPS.
• Retention and deletion: we keep it while your account is active. You can delete your account at any time in your settings or by writing to [email protected]; profile, conversations, memory and sign-in identities are removed. You can also revoke Amoryne's access in your Google Account permissions at any time.

Sign in with Apple works the same way: we receive your name and e-mail address (or Apple's private relay address, if you choose to hide it) and use them only to create and sign in your account.

Security and retention

Conversation and memory data are encrypted at rest, with restricted access controls.

• Account, conversations and memory: kept while your account is active; removed upon account deletion.
• Accounts inactive for more than 3 years may be deleted, with prior notice by e-mail.
• Financial transaction records: kept for the period required by tax and anti-fraud laws, up to 10 years.
• Technical logs: up to 30 days.

Your rights

Access, correction, deletion, objection to processing based on legitimate interest, and withdrawal of consent — at any time — plus any further rights provided by the GDPR and the LGPD, upon request to support. Deletion is real: profile, conversations, memory and derived embeddings are removed.

You may also lodge a complaint with the data protection authority of your country (in Brazil, the ANPD; in the EU, the authority of your member state).

To exercise any right, write to [email protected].

Minors

Amoryne is strictly for adults aged 18 or older. We do not provide the service to, or collect data from, minors; accounts identified as belonging to minors are blocked immediately and their data deleted.

International transfers

Data may be processed on infrastructure located in other countries, always with safeguards equivalent to those of this policy.