Privacy Policy

Effective date: 2026-11-07

This Privacy Policy explains how GRYFFINDOR PTE. LTD. ("we", "us", "our"), a company registered in Singapore with its address at 12 Woodlands Square, #13-62 Woods Square, Singapore 737715, collects, uses, shares and protects personal information when you use the Ithren mobile app and related services (the "Service").

Ithren is intended only for adults aged 18 or older. If you do not agree with this policy, please do not use the Service.

1. Information we collect

Account information. When you sign in we create an account with a user ID, a nickname and, if you choose, an avatar image. New accounts get a randomly generated default nickname, which you can change. We do not take your name from Apple or Google.

Sign-in identifiers. We use Sign in with Apple and Google Sign-In. From these providers we receive a unique account identifier and, if the provider shares it, an email address (which may be a private relay address). We do not receive your Apple or Google password.

Age and consent records. We record when you confirmed that you are at least 18 years old and when you agreed to have your chat content processed by third-party AI providers.

Chat content. The messages you send to AI characters, the AI replies, conversation settings (such as the selected model and memory length) and conversation summaries that we generate to help characters remember earlier parts of a story.

Character content. Characters you create, including name, avatar, description, personality and background, speaking style, greeting, example dialogue, tags and visibility setting.

Purchase and wallet records. Credit purchases and subscriptions made through the App Store or Google Play, including product, transaction identifiers, price, currency, store and purchase time; your credit balance and the record of how credits were added and spent; and refund events reported by the stores.

Creator earnings and contract settlement. To settle creator earnings (including the share of paid spending and the monthly popularity pool) and to prevent artificial inflation of earnings, we process the amounts spent and the amount of activity when you interact with characters (such as how many users chat with a character and how many messages they send, but not the content of your chats). If you are invited to the contracted creator program and apply, we collect the country or region you provide and, where necessary, identity and tax information.

Device identifier. When the app first starts, it generates a random ID, stores it on your device and sends it with its requests to us. The app creates this ID itself: it is not an advertising identifier, it is not derived from your device hardware, and it is not used to track you across other apps or websites. We store only a hash of it, and keep at most 20 per account.

Time zone. The app sends us your device's time zone setting (for example, "America/New_York"), not your location. The time zone is fixed to your account the first time it is sent, and is used to count the days of new-user rewards in your local time and to schedule push notification quiet hours and daily limits.

Risk-control records. We record, linked to your account and in hashed form (we do not store them in plain text), the IP addresses you use when signing in and using the Service and the device identifier described above. We use them to tell whether different accounts share a device or network, for example to detect repeated or abusive refunds, to check whether an invite comes from the same device or network, to limit how many times one-time rewards can be claimed from the same device or network, and to detect artificial inflation of creator earnings.

Reward and invite records. The version of the new-user rewards that applies to you, whether each reward has been reached, claimed or has expired, and the days on which you opened the app (used for new-user journey rewards). If you use an invite code, we record your invite code, who invited you and when. The person who invited you can see, on their invite page, your nickname, when you joined, how many messages you have sent (not their content) and whether the invite counted toward a reward.

Follows and creator profiles. Which creators you follow, and the bio you write. Your creator profile is public to other users and shows your nickname, avatar, bio, public characters and rounded aggregate figures (number of public characters, total number of people who have chatted with your public characters, and number of followers). Only you can see your list of followers and the creators you follow. Your public characters and nickname may appear on leaderboards.

Notification records. The in-app notifications and push notifications we send you, and whether you opened a getting-started tip notification, which we use to limit how often we notify you and to measure how well notifications work.

Safety records. Reports you submit or that are submitted about you, blocks, content moderation results and enforcement actions.

Feedback and support. Messages you send through in-app feedback or by email, any contact email you choose to provide, and, with in-app feedback, the app version and platform (iOS or Android) so we can reproduce the problem.

Technical information. IP address, language setting, and request logs including timestamps and error information. If you enable push notifications, we store a push notification token and the platform (iOS or Android) it belongs to. Except for Sentry native crash reports described in Section 4, we do not collect your device model or operating system version. Apart from the app-generated device identifier described above, we do not collect device identifiers, and we do not collect advertising identifiers.

We do not collect your precise location, contacts, photos other than images you choose to upload, or health information. We do not use third-party advertising SDKs and do not track you across other companies' apps or websites.

Images you send in chat. When you send a photo or image to a character, we store it with that conversation, check it with our content moderation provider, and send it (or a short text description made by an AI model, which never identifies anyone) to the AI model provider so the character can respond. For now we only accept images of scenes, objects, screenshots and similar content, and we reject images that show a real person's face. These images are used only in that conversation: they are never shown publicly, shared with other users, or used as a reference for generating illustrations. They are kept as long as the conversation's messages and are deleted when you delete your account. If you take a photo in the app, we use the camera only at that moment.

Chat excerpts you share with creators. In a chat, you can pick up to 20 messages and choose "Share with creator". Before anything is sent we show you exactly what will be shared, with your nickname, email addresses, phone numbers, links and account handles removed automatically, and we only send it after you confirm; the excerpt also goes through content moderation. We store this de-identified excerpt, the character it relates to and your account ID (used only so you can withdraw it and so it is deleted with your account; the creator cannot see it). The character's creator can read the excerpt in their creator dashboard, mark it as handled, or report inappropriate content to us for review. You can withdraw it at any time in Settings › Chats shared with creators, which deletes it.

Voice input. When you use voice input in chat, your speech is turned into text on your device and placed in the message box for you to review before sending. We do not receive or store your audio; we only receive the text you choose to send. If your device does not support on-device recognition and you agree to use the system's online recognition instead, the audio is processed by the system provider (such as Apple or Google, or your browser's speech service on the web) under its own privacy policy.

2. How we use your information

To create and operate your account and keep you signed in.
To provide the core feature of the Service: generating AI character replies to your messages, including maintaining conversation memory.
Character messages: in a conversation you have chatted in for a while and then stepped away from, we use that conversation's memory and recent content to have AI generate a short message in the character's voice, add it to that conversation and send you a notification. These messages do not cost you credits and are moderated like any other message. The push notification only says that the character sent you a message and never shows the message text. You can turn this off entirely in Settings > Notification settings > Character messages, or for one conversation by turning off "Let them reach out to me" in that conversation.
Getting-started tips: during your first 30 days, we may send a reminder when you have a reward to claim, have not opened the app for a while, or have a getting-started task you could complete (at most one a day, and never during night-time quiet hours in your local time). These notifications never include chat content. We only send them after you check "Also send me starter rewards and event reminders" on the notification prompt or turn them on in Settings > Notification settings > Getting-started tips, and we record when you agreed; you can turn them off there at any time. Other notification categories (such as purchase confirmations, moderation and report outcomes, expiring limited-time credits, and new characters from creators you follow) can be turned off individually on the same page, and you can turn off all notifications for the app in your device settings.
To grant the sign-up gift, new-user rewards, achievement rewards and invite rewards, and to prevent duplicate claims and reward abuse.
To show creator profiles, handle follows, notify followers about new characters, and calculate popularity leaderboards.
To display characters you choose to make public to other users.
To process purchases, add and charge credits, provide subscription benefits, handle refunds and keep accurate financial records.
To settle creator earnings, review contract applications and settle under the Contracted Creator Agreement, and detect earnings manipulation. Identity and tax information is used only for review, settlement and to meet our legal obligations.
To keep the Service safe: moderating content, reviewing reports, enforcing our Terms of Service and Community Guidelines, and preventing fraud and abuse (including refund abuse).
AI disclosure and crisis response: reminding you in conversations that you are talking to AI, and showing crisis resources when a message suggests suicide or self-harm; for safety reporting we keep only the number of times this notice was shown and when. See Safety and Crisis Response.
To respond to your feedback and support requests and to send service notifications (for example, purchase confirmations or report outcomes).
To maintain, secure, debug and improve the Service, including aggregate statistics such as usage volume and costs per model.
Aggregate analysis: we calculate aggregate statistics from our business records, grouped for example by sign-up month, such as retention, conversion to paying, claim rates and costs of each reward, and how often notifications are opened or turned off, to evaluate and adjust new-user programs and notifications. These statistics are used only in aggregate, are not used for advertising, and are not provided to third parties.
To comply with legal obligations, including tax and accounting requirements.

Creators of characters see only aggregate statistics about their characters (such as number of chats and messages, spending and popularity figures), plus weekly anonymous improvement suggestions that AI summarises from many users' chats (such as popular topics and where the character falls short). Suggestions are only generated when enough users chatted with the character in the past 7 days, contain only aggregated points, never include original messages and never include information that identifies you; to produce them, the relevant chat excerpts are processed by our third-party AI model providers (see Section 3) after nicknames, emails, phone numbers and links are removed. Apart from excerpts you choose to share with a creator, creators cannot see your conversations.

3. Third-party AI model providers

To generate replies, the content of your conversation is sent to third-party AI model providers for processing. This includes your messages, recent conversation history and summaries, and the definition of the character you are chatting with. You give separate, explicit consent to this before you can start chatting, and you can review the date of that consent in Settings.

The providers we use fall into these categories:

Large language model (LLM) API providers that generate character replies, character messages and conversation summaries;
Image generation API providers, if you use AI avatar generation.

We may change providers over time and may route a conversation to different providers depending on the model you select. We only send the content needed to generate a response, and we choose providers whose API terms do not permit them to use API content to train their models by default, where such terms are available. Providers may retain content for a limited period for abuse monitoring under their own terms.

4. Other service providers

We share information with service providers who process it on our behalf and only for the purposes described in this policy:

Content moderation providers, which analyze text and images (messages, images you send in chat, AI replies, character content and avatars) to detect content that violates our rules;
Payment processors: Apple (App Store) and Google (Google Play), which process in-app purchases and subscriptions and issue the purchase receipts. Receipts are verified and purchases are recorded by Kasskeep, an in-app purchase service we operate ourselves (it is not a third party), which receives the stores' purchase and refund events and passes them to us. We never receive your full payment card details;
Hosting and storage providers, which host our servers, databases and uploaded images;
Email and push notification providers, when we send you messages.

Refund requests. When you request a refund from Apple or Google, we (directly or through our self-operated Kasskeep service) may provide the store with information about your use of the purchased item so that the store can decide on the request, such as whether the credits were delivered, what proportion of all credits delivered by that purchase (including bonus credits delivered with it) has been consumed, and other account information the store asks for to evaluate refunds (such as how long the account has existed and the total amounts purchased and refunded). See our Terms of Service for details.

We may also disclose information if required by law, to protect the rights and safety of users or others, or in connection with a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

We do not sell your personal information and do not share it for cross-context behavioral advertising.

Crash and error diagnostics

To find and fix crashes and errors, the app sends us an error report when a program error occurs:

What a report contains: the error name and message, the program stack trace (minified code locations in release builds), the name of the screen you were on (not its contents), when the error happened, the app version and build number, the platform (iOS or Android), and a session ID that is randomly generated each time the app starts and is not tied to your device. If you are signed in, the report is linked to your user ID so we can tell how many users are affected.
What it does not contain: chat content, text you type into input fields, or sign-in credentials or tokens. Tokens and email addresses that might appear in a report are removed before it is sent.
Purpose: only to diagnose and fix errors and improve app stability — never for advertising or profiling.
Sentry: we may use Functional Software, Inc. (Sentry) as a service provider that receives and analyzes crash reports on our behalf, including native crashes. We turn off Sentry's personal-data collection, session replay and performance tracing, and strip user identifiers and device details before sending; however, native crash reports are generated by Sentry's native component on the next launch and may include the device model and operating system version needed to diagnose the crash.
Retention: error reports on our own servers are deleted automatically after 30 days; data in Sentry is deleted according to the retention period we set in Sentry (no more than 90 days).

5. Where your information is stored

Our servers are located in United States (New York). Our service providers may process information in other countries, including the United States. Where we transfer personal information out of the European Economic Area, the United Kingdom or other regions with transfer restrictions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep your information

Account, chat and character content: for as long as your account is active, or until you delete the specific item.
After account deletion: see Section 7. The sign-in identifier hash and anti-abuse markers described there are kept for as long as we offer the sign-up gift, the new-member offer, one-time rewards and invite rewards, and need to detect refund abuse, except that IP address and device identifier hashes are deleted 180 days after they were last recorded.
Risk-control records (keyed hashes of IP addresses and device identifiers): deleted automatically 180 days after they were last recorded, whether or not your account has been deleted (see Section 7).
Reward and invite records: while your account is active; after deletion, they are kept in de-identified form to prevent duplicate claims and for aggregate statistics.
Notification delivery records (getting-started tips and character messages, including whether you opened them): for up to 1 year, and deleted when your account is deleted. Aggregate statistics already calculated from them are kept.
Purchase and wallet records: retained after account deletion in de-identified form for as long as required for reconciliation with the stores, tax and accounting purposes (typically up to 7 years).
Creator earnings, contract settlement and review records: for the periods required by financial, tax and other legal requirements, including after account deletion where the law requires.
Safety records (reports, moderation results and enforcement actions): for up to 2 years, or longer where needed to prevent repeat abuse or to comply with law.
Feedback and support messages: for up to 2 years.
Chat excerpts shared with creators: until you withdraw them, the character is deleted or you delete your account; if an excerpt is reported and removed by us, its content is cleared immediately.
Server logs: for up to 90 days.
Backups: overwritten on a rolling basis; deleted data may remain in backups for up to 30 days before it is overwritten.

7. Deleting your account

You can delete your account at any time in the app (Settings).

After you request deletion, your account enters a 30-day cooling-off period. During this period your account is deactivated and your public characters are no longer shown. If you sign in again during this period, you can cancel the deletion.
When the 30 days end, we delete or anonymize your personal information, including your profile, sign-in identifiers, chat content and characters. Published characters that other users have already chatted with are kept available to those users by "Ithren Official", with author information that identifies you removed (see Section 8 of the Terms of Service).
Purchase, transaction and credit ledger records are kept in anonymized form (no longer linked to your identity) because we need them for reconciliation with the stores and for tax and accounting purposes.
We keep an irreversible hash of your sign-in identifier (a keyed SHA-256 hash, HMAC-SHA256, of the account identifier from Apple or Google). It cannot be turned back into the identifier. We use it only to tell whether that sign-in account has already received the sign-up gift, the new-member offer or a one-time reward, or has already been counted as an invited friend, so that deleting and re-creating an account does not grant them again. It may be stored with the anonymized account number and the related purchase or claim record, but is no longer linked to your identity.
We keep anti-abuse markers: hashes of the device identifier and IP address recorded when rewards were claimed, the IP address and device identifier hashes in risk-control records, and reward, invite and refund-risk records. They are linked only to the anonymized account number and are used only to prevent duplicate reward claims, invite abuse and refund abuse. The IP address and device identifier hashes are deleted automatically 180 days after they were last recorded.
Your follows, bio, in-app notifications, notification delivery records, push tokens, time zone, invite code and any chat excerpts you shared with creators are deleted.
Any remaining credit balance is forfeited when the deletion completes, and any Coins that have not been redeemed are handled as described in our Terms of Service. Deleting your account does not cancel an active subscription; please cancel it in your App Store or Google Play account settings.

If you cannot use the app, you can ask us to delete your account by email. See How to delete your Ithren account for the steps.

8. Your rights

Depending on where you live, you may have the right to:

access the personal information we hold about you and receive a copy of it;
correct inaccurate information;
delete your information (see Section 7);
object to or restrict certain processing;
data portability;
withdraw consent at any time, without affecting processing that took place before withdrawal (withdrawing consent to AI processing means you will not be able to use chat features);
lodge a complaint with your local data protection authority.

California residents: you have the right to know, delete and correct personal information, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

Legal bases (EEA/UK): we process your information to perform our contract with you (providing the Service), on the basis of your consent (sending chat content to AI providers), for our legitimate interests (safety, fraud prevention and improving the Service), and to comply with legal obligations.

To exercise your rights, contact us at [email protected]. We will respond within the time required by applicable law and may need to verify your identity first.

9. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit, access controls, and logging of administrator access. Administrators may view conversation content only when needed to handle reports, moderation or support requests, and such access is logged. No method of transmission or storage is completely secure.

10. Adults only

The Service is not directed to anyone under 18. We do not knowingly collect personal information from minors. If we learn that a user is under 18, we will close the account and delete the information. If you believe a minor is using the Service, please contact us or report the account in the app.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you in the app or by other appropriate means before the changes take effect. The effective date at the top shows when it was last updated.

12. Contact us

GRYFFINDOR PTE. LTD.
12 Woodlands Square, #13-62 Woods Square, Singapore 737715
Email: [email protected]

This policy is available in English and Chinese. If there is any inconsistency between the versions, the English version prevails.