Privacy Policy
What we collect, why we collect it, and the rights you have
Last updated: 6 October 2026 · Effective: 6 October 2026
This policy explains what personal data waifun collects, why we collect it, how long we keep it and what you can ask us to do with it.
We do not sell your data. We do not share it with advertisers. We do not run advertising trackers or cross-site tracking pixels.
Most of what we store is required for your account to work. You can delete your account and request erasure of your data at any time.
waifun is a general-audience AI chat service.
1. Scope and definitions
This policy is issued by the operator of waifun. In this document, "waifun" means the application, the website at waifun.chat and the server infrastructure that operates them. "User" means the natural person using the service. "Controller" means the party that determines why and how personal data is processed.
This policy covers both the web and mobile versions of waifun. Third-party services we link to are outside its scope, and their own privacy policies apply to them.
Personal data means any information that identifies you or makes you identifiable, as defined in Article 4(1) of the EU General Data Protection Regulation and Article 3(1) of the UK GDPR.
2. Who is the controller
The controller is the legal entity that operates waifun. To reach us, to exercise any of your rights, or to raise a question about this policy, use the contact details at the end of this document.
Where the GDPR applies, you also have the right to lodge a complaint with your local supervisory authority.
3. What we collect
| Data | Where it comes from | Why we need it |
|---|---|---|
| Email address | You, or your sign-in provider | To create and identify your account, and to send a one-time verification code |
| Display name | You, or your sign-in provider | To greet you and identify you in your conversation list |
| Profile photo | Google, only if you sign in with Google | To show your avatar in your account area and conversation list |
| Sign-in provider and subject identifier | Google or Apple | To link your account to the provider you authenticated with |
| Messages, attachments and generated replies | You and our AI model | To run the conversation and show you your own history |
| IP address and sign-up date | Collected automatically at sign-up | Abuse prevention, rate limiting and daily account limits |
| Language and interface preferences | Your choices, stored on your device | To make the app behave the way you asked it to |
| Plan and payment confirmation | Our payment processor, Stripe | To confirm a paid plan is active. We never receive or store your full card number |
We do not collect special-category data. Please do not send us sensitive personal information in a chat message.
4. Why we process it and on what legal basis
We rely on the following legal bases under Article 6(1) GDPR:
- Contract | to provide the service you signed up for: your account, your conversations and your plan.
- Legitimate interests | to keep the service secure, prevent abuse, enforce our rate limits and understand aggregate usage so we can improve the product. We weigh these against your rights and freedoms.
- Legal obligation | to retain records where tax or accounting law requires it.
- Consent | where we specifically ask for it, for example to store a payment method or to send optional product emails. You can withdraw consent at any time.
Where we rely on legitimate interests, you can object to that processing. See section 14.
5. Profile photos and images
If you sign in with Google, we store the profile picture Google returns so it can be shown in your account area and conversation list. If you would rather we did not, you can remove it from your account.
If you upload images or files in a conversation, they are used to produce the reply to that message and are otherwise not used. Attachments are not used to train any model.
6. Messages and how they reach the AI
When you send a message, it is transmitted to an AI model provider in order to produce a reply. Our current model providers run on Cloudflare infrastructure in the United States.
We send the minimum needed to produce a reply: your message, a short window of the surrounding conversation for context, and the character instructions. We do not send your email address, your name, your profile photo, your plan or your IP address to the model provider.
Our hosting and AI infrastructure providers act as processors on our instructions and are not permitted to use your content for their own purposes.
The characters you talk to are AI personas. Their personality, warmth and humour are generated. They are not real people.
7. International transfers
waifun is operated globally and our infrastructure is hosted in the United States. Your data is therefore processed in a country whose data protection rules may differ from those in your own.
Where data is transferred outside the UK or the European Economic Area, we rely on an adequacy decision where one exists, or on the International Data Transfer Addendum to the European Commission's standard contractual clauses, supported by a transfer risk assessment.
8. How long we keep it
| Data | Retention |
|---|---|
| Account record (name, email, provider identifier) | Until you delete your account, then deleted within 30 days |
| Conversations and replies | Until you delete the conversation or your account |
| Uploaded attachments | Until you delete the conversation or your account |
| Session cookie | Up to 30 days, refreshed on activity |
| Email verification codes | 10 minutes, then deleted |
| Daily message counter | Reset each day, not retained beyond the current day |
| OAuth sign-in state | 15 minutes, then deleted |
| Payment records | As long as your subscription is active, then as required by tax and accounting law |
| Server and abuse logs | Short-term operational retention only; not used for profiling |
9. How we protect it
Data in transit is encrypted with TLS. We never store a password, because we do not ask you to create one: sign-in is handled by Google, Apple, or a one-time code sent to your email address.
Verification codes are stored only as a salted PBKDF2-SHA256 hash with 100,000 iterations. A leaked database would not reveal your codes.
Session tokens are random values held in an HttpOnly, SameSite=Lax cookie and are not readable from JavaScript. Access to production data is restricted to the person operating waifun.
No system is perfectly secure. If a breach affects your data and is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay.
10. Cookies
We set one essential cookie, wf_oturum, which keeps you signed in. It cannot be switched off without breaking sign-in. We also use a small amount of browser local storage to remember your interface preferences on the device you are using. Our Cookie Policy sets out the details.
11. Service providers
We use a small number of processors. Each one receives only what it needs to do its job, and is bound by contract to our instructions:
- Cloudflare | hosting, content delivery, database, rate limiting, and the AI inference used to generate replies.
- Stripe | payment processing. Your card details are entered on Stripe's hosted page; we receive only a confirmation of payment.
- Resend | transactional email, specifically the message containing your verification code.
- Google or Apple | only if you choose to sign in with them.
12. Disclosure and transfers
We do not sell, rent or trade your personal data. We disclose it outside our processors only in these situations:
- Where a competent public authority lawfully requests it, or where disclosure is necessary to establish or defend legal claims or to prevent serious harm.
- If waifun is sold or reorganised, in which case this policy will apply to the new operator and you will be told beforehand.
13. Automated decision-making and profiling
We do not build advertising profiles, and we do not make decisions that produce legal or similarly significant effects for you.
We do apply automated checks that will refuse or limit a sign-in attempt when it looks abusive. Those checks use request volume, rate limits and a blocklist of disposable email domains. They are not retained as behavioural profiles and are not used for targeting.
14. Your rights
Where the GDPR or UK GDPR applies to you, you have the right to:
- Access | get a copy of the personal data we hold about you.
- Rectification | have inaccurate data corrected.
- Erasure | have your account and data deleted.
- Restriction | ask us to pause processing while a dispute is resolved.
- Portability | receive your data in a structured, machine-readable format.
- Object | object to processing based on legitimate interests, and object to direct marketing at any time.
- Withdraw consent | where consent was the basis, without affecting anything already done.
- Complain | to your local supervisory authority.
To exercise any of these, email the address below. We respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.
You can delete your account directly from inside the app. That also deletes your conversations.
15. Children
The service is not directed at children. We do not knowingly collect personal data from anyone below the age of digital consent in their jurisdiction, and we delete an account if we learn it was created by someone below it.
16. Security incidents
If we discover a security incident affecting your personal data, we will investigate and mitigate it, record it, and where the law requires, notify the supervisory authority within 72 hours and notify you without undue delay where the risk to you is high.
17. Changes to this policy
We may update this policy as the service or the law changes. The date at the top of this page shows when it last changed. Material changes are announced inside the app before they take effect.
18. Resolving concerns
We would rather hear from you first. If something is wrong, contact us and we will try to fix it.
If you are not satisfied with our response, and the GDPR or UK GDPR applies to you, you may complain to your local supervisory authority or, in the United Kingdom, to the Information Commissioner's Office.
Contact
Questions about this policy, your data, or a rights request:
privacy@waifun.chat
Related
waifun | waifun.chat