Privacy Policy

01. Scope and responsibility

This draft describes information involved in using the YouPlot website and iOS app. The website introduces YouPlot; the app lets you discover stories, exchange messages with AI characters and return to previous conversations.

The legal identity, address and privacy contact of the operator responsible for your information must be confirmed before this notice becomes effective. Information about server-side providers and practices is still being verified, as identified below.

02. Information involved

• Account information: an email address when you use email-link sign-in, authentication identifiers, guest or registered account status, and profile information returned for your account, such as nickname and avatar.
• Conversations: messages you send, generated replies, associated story and conversation identifiers, and history needed to continue a conversation.
• Device and app information: app-generated device identifiers, device type, operating-system and app versions, language and time-zone settings, and session identifiers.
• Usage information: app launches, foreground and background activity, pages and stories viewed, and time spent in those experiences. Analytics can associate these events with account or device identifiers.
• Content reports: the story being reported and the report details you choose to send.
• Connection information: network services receive information needed to handle requests, such as IP addresses and request metadata. Production logging and retention details remain to be verified.

Do not include sensitive personal information in story messages unless you understand and accept how it will be processed.

03. How information is used

Information is used to establish guest or registered sessions, authenticate requests, deliver story content, generate replies, show your conversation history and profile, process reports, and understand app usage.

AI replies require transmitting your messages and relevant conversation context to the Service. The complete list of AI providers, their handling of conversation data and any use for model training must be confirmed before publication. This draft makes no promise that conversations stay on your device or that providers do not retain them.

Where a legal basis is required, the operator must identify the applicable basis for each purpose, including any required consent. This draft does not establish that consent has already been obtained.

04. Service providers and sharing

The app integrates Google Firebase for authentication and analytics, along with Firebase configuration and notification infrastructure. Firebase services can process identifiers and technical information necessary for those services. See Firebase’s privacy information for the provider’s documentation.

AppsFlyer attribution support is included in the app but is disabled in the currently reviewed configuration. Its release status, data categories, purposes and any tracking-consent requirements must be reviewed before enabling it or publishing a final notice.

Hosting, AI generation and other service-provider details must be verified with the operator. The final notice must also describe any disclosures required by law, corporate transfers, and any sale, sharing or targeted-advertising practices that apply. This draft does not assert that these practices are absent.

05. Website, cookies and local storage

This website has no account sign-in, message submission, payment form or application-level analytics SDK. Its story preview uses a temporary browser state to switch between Chat and Roleplay and does not send a conversation to an AI service.

The website does not set application-level cookies or use browser storage for this preview. Hosting and network infrastructure may process connection logs; the operator must confirm those practices and retention periods.

The iOS app stores information needed for device identity, sessions, authentication and local operation. Some device identifiers are kept in the system Keychain and may remain available after reinstallation. Signing out does not necessarily remove all device-level data.

06. Retention and deletion

Account records, messages, generated replies, analytics, reports and operational logs can require different retention rules. Their periods, deletion criteria, backup handling and provider-side retention must be verified before a final policy is issued.

Logging out or deleting the app is not the same as requesting deletion of server-held information. A verified request channel, identity-verification process and explanation of any lawful retention exceptions must be published before release.

07. Your choices and rights

Depending on your location, you may have rights to access, correct, delete or receive a copy of your information, object to or restrict certain processing, withdraw consent, or complain to a relevant regulator.

You can manage available notification and tracking permissions through your device settings. A tracking permission is separate from the processing needed to deliver a conversation or maintain your account; changing it does not necessarily disable all analytics.

The privacy request address and response process are not yet confirmed. This draft does not describe a working in-app deletion or analytics opt-out control that has not been verified.

08. Security and international processing

The app uses encrypted network connections for its configured production services and system-protected storage for certain credentials and device identifiers. No method of transmission or storage can provide an absolute security guarantee.

Processing locations, international transfer arrangements, provider safeguards and the operator’s security procedures require confirmation. This draft does not promise that all information stays in a particular country or that conversations are end-to-end encrypted.

09. Children and age requirements

The operator must confirm the intended audience, minimum age, any parental-consent process and procedures for handling children’s information before release. These requirements may vary by region.

The final policy must explain how to report suspected collection of a child’s information and how such reports are handled. No unverified age threshold or deletion commitment is stated here.

10. Changes and privacy contact

The final policy will display its effective date and provide a verified contact for privacy questions and rights requests. Material changes should be communicated as required by applicable law.

Pending confirmation: the operator’s legal name and postal address, monitored privacy email, supported regions, provider list, retention schedule, request procedures and effective date.