Privacy Policy

ZA.AI is an AI character companion. The site operator is the data controller for the information described in this policy. For questions or requests, use the contact method listed on the Site.

We collect only what is needed to run the service:

• Account information from third-party sign-in (Google, Apple, Meta, etc.): your name, email address, profile picture, and unique account ID.
• Content you create: characters you build, messages you send to characters, memories, continuity notes, scheduled tasks, and custom API definitions.
• Technical data needed to operate the app: session tokens, minimal request logs, and error diagnostics.
• Guardrail refusal logs: when the AI refuses a prompt, we store a short excerpt of the prompt and the refusal so we can review false positives. These logs do not include your name, email, or account ID.

We do not knowingly collect information from children under 13, and we do not sell your personal information.

• Create and manage your account.
• Sync your characters, chats, and memories across your devices.
• Generate AI responses to your prompts.
• Personalise your experience and remember preferences you set.
• Detect abuse, enforce the Terms, and improve safety guardrails.
• Communicate service-related updates when necessary.

We rely on the consent you give at sign-in and on our legitimate interest in operating and securing the Site.

• Locally on your device: characters, chats, memories, and continuity settings are stored in your browser so the app works offline and stays fast.
• In our cloud backend: when you are signed in, the same data is synced to your account so you can pick up on another device. Guardrail refusal logs and scheduled tasks are stored server-side.

We share the minimum needed to run features you use:

• AI providers (via the Lovable AI Gateway) receive the prompts, character instructions, and memories required to generate a reply. They do not receive your account identity.
• Third-party sign-in providers (Google, Apple, Meta) receive only what is needed to authenticate you. Their own privacy policies also apply.
• Voice services (speech-to-text, text-to-speech) receive audio you choose to send from voice chat, and short synthesised audio requests.
• Custom APIs you register receive requests you or your character choose to make to them. You control what you register.

We do not sell your data and we do not use it to build advertising profiles.

We use browser storage (localStorage and cookies) to keep you signed in, remember your preferences (such as sidebar width and theme), and cache your characters and chats. We do not use tracking cookies for third-party advertising.

We keep your account data for as long as your account exists. You can delete individual characters, chats, and memories at any time from inside the app. If you delete your account, we remove your synced data from our backend within a reasonable period, except where we are required to retain it by law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Delete your account and associated synced data.
• Export your chats and characters (use the Export button on the home screen).
• Revoke third-party sign-in access at any time through your provider's account settings. Doing so may limit or disable your ability to use the Site.

To exercise these rights, contact the site operator through the Site.

We use industry-standard measures to protect your data in transit and at rest, including encrypted connections, row-level security in our database, and role-based access controls for administrative surfaces. No online service can be guaranteed 100% secure — you also help by keeping your third-party account secure.

We may update this Privacy Policy from time to time. The latest version is always posted here, with the “Last updated” date at the top. Continued use of the Site after changes means you accept the updated policy.

For privacy questions or data requests, contact the site operator through the contact method provided on the Site.