Legal
Privacy Policy
Novalie is an AI companion app for adults (18+). You talk with AI characters (Novalie, Veronica and Jake) by voice call and by text. The short version of this policy:
- The AI runs on your phone. Your voice, your camera picture, your messages and what the characters remember about you are processed on your device. They are not sent to us or to an AI company.
- We have no ads, no analytics SDKs, no tracking and no data brokers. We do not sell or share personal information.
- You sign in with an account (Apple, Google, or email and password). That is the only personal information we hold. Beyond it, only two things are ever sent from your phone: a report, if you choose to send one, and a daily safety count with no words in it. Section 3 lists everything.
1. Who we are
[COMPANY LEGAL NAME] ("we", "us") makes the Novalie app and is the controller of the limited personal data described here. Contact us at [CONTACT EMAIL] or [ADDRESS].
2. What stays on your device
These are processed only on your phone or tablet, by AI models that ship with or download into the app:
| Data | What the app does with it | Where it is kept |
|---|---|---|
| Your voice on a call | Turned into text by on-device speech recognition. The audio is not stored. | Not stored |
| Your messages and call transcripts | Used to write the character's replies | In the app on your device until you delete them |
| Your camera, when you turn it on in a call | Frames are described on the device so the character can see you ("Look"). Frames are not stored. | Not stored |
| Photos you ask for ("take a picture") | Saved to your photo library, only when you ask | Your photo library |
| Memories and notes | Short facts the character keeps about you (for example your name or your plans), made on the device from your conversations | In the app on your device until you delete them |
| Safety checks | Every message in both directions is checked on the device for harmful content | Not stored, except the anonymous counts in section 3 |
| Settings and onboarding answers | For example your display name, your age confirmation, speaker preference | In the app on your device |
iOS speech recognition. The app asks iOS for on-device speech recognition. On devices where Apple does not offer on-device recognition, iOS may send audio to Apple to transcribe it, under Apple's privacy policy. The app asks for the Speech Recognition permission before this can happen.
3. What is sent to us, and what the app downloads
| What | When | What is sent | Who receives it |
|---|---|---|---|
| Account | When you sign up, sign in, reset a password or delete your account | Your email address; your name if you give it or Apple or Google shares it; which sign-in method you used; an account ID; your age confirmation. If you use email and password, the password is stored only as a salted hash, never in readable form. Password reset sends a one-time link to your email. | Us and our sign-in provider, [AUTH PROVIDER], who handles it for us only |
| Model downloads | When the app downloads its AI models | A normal web request for the file. Your IP address is visible to the server, as with any download. No content. | Our own model server |
| Reports | Only when you tap Report on a message or during a call, and then tap Send | The reported AI message, your message just before it, the reason you picked, any note you typed, which character, the app version and the safety check result. No name, account, phone number or device identifier. | Us, to review it ([REPORT HOST]) |
| Anonymous safety counts | Once a day | Daily totals only, for example "3 messages blocked" or "1 crisis line card shown", with the app version and platform. No text, no identifiers. | Us, for safety reporting required by law (for example California SB 243) |
We use reports and counts only to keep the app safe, to improve the safety checks, and to meet legal reporting duties. Reports are kept for 180 days and then deleted, unless the law requires us to keep one longer (for example a report of child sexual abuse material, which we must preserve and report to the authorities).
4. What we do not do
- No advertising, and no advertising or analytics SDKs.
- No tracking across apps or websites. There is no advertising identifier.
- No selling or sharing of personal information, as those terms are used in California law.
- An account is required. We collect only what it needs: your email address, your name if you share it, and your sign-in method. We do not collect your phone number, contacts or location. We do not use your email for marketing.
- No in-app purchases are processed at present. If we add them, payments will go through Apple or Google, and we will update this policy first.
5. Adults only
Novalie is for people 18 and over. The app asks your age when you first open it, and locks itself if you say you are under 18 or tell a character so. We do not knowingly collect data from anyone under 18. If you believe a minor is using the app, contact [CONTACT EMAIL].
6. Crisis support
If you talk about suicide or self-harm, the app shows a "Help is available" card with crisis line numbers for your region. Tapping a number opens your phone's dialer or messaging app; the app does not call or send anything itself. Nothing about that conversation is sent to us, except the anonymous daily count of how often the card was shown.
7. Permissions
| Permission | Platform | Why |
|---|---|---|
| Microphone | iOS, Android | To hear you on calls |
| Speech Recognition | iOS | To turn your voice into text (see section 2) |
| Camera | iOS, Android | So the character can see you, only when you turn the camera on in a call |
| Add to Photos | iOS | To save a picture you ask for |
| Local Network | iOS | To download models from a host on your network in test builds |
| Internet and network state | Android | Model downloads, reports and counts (section 3) |
| Audio settings, vibrate, keep awake | Android | Call audio routing, haptics, keeping a call running |
You can turn any permission off in your phone's settings. The features that need it will stop working; the rest of the app keeps working.
8. Keeping and deleting your data
- On your device: your conversations, memories and settings stay until you delete them. You can delete one conversation, use Settings > Clear data (per character or everything), or uninstall the app, which removes all of it.
- Your account: you can delete it in Settings > Account > Delete account. That removes your email, name, sign-in details and account ID from our systems, and signs you out everywhere. You can also ask by email to [CONTACT EMAIL].
- With us: reports are kept 180 days (see section 3). Anonymous counts contain no personal data. To ask about a report you sent, contact [CONTACT EMAIL].
9. Security
Your data stays on your device and is protected by your device's own security (passcode, encryption). Reports and counts are sent over an encrypted connection (HTTPS) in release builds, and stored on access-controlled servers.
10. Your rights
Everyone. You can ask what data we hold about you, ask us to correct or delete it, or object to how we use it, by writing to [CONTACT EMAIL]. Reports are not linked to your account, so we may need details of a report (for example the date and the text) to find it.
European Economic Area and UK (GDPR). Our legal bases are: our legitimate interest in keeping the app safe (reports, counts), and compliance with legal obligations (safety reporting, preserving reports of child abuse). You have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your data protection authority. Our lead supervisory authority is [SUPERVISORY AUTHORITY].
California (CCPA/CPRA). We do not sell or share personal information, and we do not use sensitive personal information to infer anything about you. You may ask to know, delete or correct personal information, and we will not treat you differently for doing so.
11. Changes
If we change this policy, we will update the effective date above and, for important changes, tell you in the app before they apply.
12. Contact
[COMPANY LEGAL NAME], [ADDRESS], [CONTACT EMAIL]