Privacy Policy

1. Information We Collect

To execute high-fidelity social simulations, the platform collects, structures, and stores specific variables:

• Account Metadata: Usernames, display names, profile biographies, email addresses, password hashes (secured via bcrypt), and unique system-generated referral codes.
• OAuth 2.0 Credentials: Discord and Google authentication integrations collect external identifiers, secure refresh tokens, public usernames, and avatar files. For linked Discord profiles, we track Discord server boost activity to calculate baseline Spark limits.
• Simulated Content Assets: Custom character preset descriptions, timeline posts, threaded commentary, private DM history logs, group chat memberships, and physical activity logs.
• User Media Files: Custom avatars, story files, and timeline attachments uploaded by you are processed locally via our Sharp graphics pipeline to standard webp containers and stored securely on our disk arrays.
• Telemetry and High Scores: Interactive game scores (such as the "Bounce High!" minigame) are transmitted to the database to update global leaderboards. User actions, likes, and gifts are compiled into yearly metric records to generate analytical aggregates. God Mode data mutations executed by Spotlight++ users are processed securely against active database rows.
• FCM Notification Tokens: Firebase Cloud Messaging tokens are collected to deliver instant push notifications concerning dynamic timeline outcomes, direct messages, and scenario completions.

2. Bring Your Own Key (BYOK) Encryption

If you choose to use custom generation keys (Google Gemini, Groq, or OpenRouter), we treat these credentials with strict technical security:

• If you choose to store your API keys in our database, they are immediately encrypted using AES-256-CBC standard configurations.
• Decryption occurs exclusively in-memory, momentarily, to satisfy out-of-bounds generation requests from your client. Keys are never logged, pooled, or inspected.

3. Data Usage & AI Processing Pipelines

All generated replies, simulated commentaries, and private interactions are created by sending structured narrative payloads (including user post histories, custom character descriptions, and current scenario context) to our designated AI generation backends (including but not limited to Gemini 3.5, Llama 3.1, or Gemma 4 variants via Groq and OpenRouter). We do not Sell your inputs, nor do we disclose them to third-party marketing brokers. Paid RevenueCat receipt events are evaluated solely to adjust functional daily action constraints.

4. Data Retention and Deletion Rights

You have complete control over your sandbox footprint. Deleting a specific universe or custom preset from your client triggers a database execution that purges all associated timelines, DMs, commentary, and outcomes. If you wish to completely wipe your global account registry, send an explicit request to [email protected].

5. Structural Security

All server-client exchanges are protected under TLS encryption. Generation locks and rate limiters prevent programmatic abuse of our database pools. In-app ad configurations served to Free Tier accounts do not exchange personal telemetry or cookies with external broker platforms.