Privacy Policy

The short version

• Right now you're identified only by a random ID stored in your browser.
• We save your chats on our server so the characters can remember you.
• Your messages go to our AI and voice providers so they can write and speak the replies.
• We don't sell your data, use your chats for advertising, or use them to train AI models.
• You can delete your chats and memory at any time with “Delete my data” on the You page.

What we collect

• Chats: what you send and what the characters reply, with the time and which character.
• Memory: a name you share and short facts from your chats, plus a short dated diary of your past chats with each character (what happened and when), so she can remember them. You can see and delete the name and facts on the Chats page.
• Stories: if you start an illustrated story, the story you type and the scene description we write from it, kept with that chat.
• An anonymous browser ID: a random identifier stored in your browser. It is not your name or email.
• Network data: your approximate country, recorded with each message. We don't store your IP address. It's used in passing to estimate your country or region (Cloudflare tells us) and to count the daily message limit through a salted one-way hash that expires. Our hosting and network providers (Cloudflare and DigitalOcean) process it to deliver the site.
• How you found us: the site that sent you on your first visit (for example chatgpt.com) and the first page you opened, saved with your browser ID when you send a message.
• Your age answer: if you tell us you're under 18, we keep that for this browser so the romance mode stays off.
• Safety records: if our checks flag a chat for a serious safety reason, we keep a flag on the browser ID.
• Notifications: if you turn them on, the push address your browser gives us.
• Waitlist: if you joined our earlier waitlist, the email address you gave.
• Usage analytics: Google Analytics records pages viewed and actions such as sending a message, with device type and approximate location, using cookies.
• Ad measurement: the Meta Pixel tells Meta (Facebook and Instagram) which pages you view, which character's chat you open and when you send a message, with browser details, using cookies, so we can see how our ads perform. It never receives what you write, your name or contact details. It is not used in the iPhone and Android apps or for anyone who says they are under 18. Tracking protection or an ad blocker in your browser stops it.
• Ad visits: if you came from a Meta (Facebook or Instagram) ad, our server tells Meta once, server to server (Meta's Conversions API), when you send your first message. It sends the ad click's ID, the page you landed on, the time, your browser ID, your IP address and your browser string, so Meta can measure the ad. Nothing from your chats, and not for anyone who says they're under 18. We don't keep the IP address.

Kept only on your device

Your favorites, recent-chats list, a copy of your latest messages for fast loading, sound and language settings, your streak and the messages-left count stay in your browser. “Clear favorites and settings” on the You page removes your favorites, recent-chats list, sound settings and messages-left count.

Voice input

If you use the microphone, your browser's built-in speech recognition turns your speech into text, or in our iPhone or Android app, your phone's. Your browser or phone may send the audio to its own provider (for example Google in Chrome or on Android, Apple in Safari or on iPhone). We receive only the text.

AR view

On phones, "Bring Kinako into your room" and "Bring Ruby into your room" open the pet's 3D model in your phone's own AR viewer (AR Quick Look on iPhone, Google's Scene Viewer on Android). The viewer uses your camera on your phone to find the floor. We never receive camera images or anything about your room.

How we use it

• To run the chat and the characters' voices, and to let them remember you.
• To keep content within our rules: an age question, a check that switches romance off when a chat shows someone is under 18 (and stops the chat if they're under 13, or 14 in Canada), a rule that nothing gets explicit (romantic scenes fade to black), and automated checks, including an AI review of messages, that stop sexual content involving minors and threats.
• To enforce daily message limits and prevent abuse.
• To understand how Toonabi is used and improve it. We may read conversations to check that the characters and the safety rules work.

Who processes your data

• DigitalOcean: our servers, and the AI models that review messages for safety (open models that run on DigitalOcean).
• OpenRouter: the AI models that write the replies (Gemma, an open model from Google) and check ages and story scenes (Kimi, an open model), and a backup for the safety review when DigitalOcean's can't answer. It sends messages only to providers that don't store them or train on them.
• Black Forest Labs and ByteDance (Seedream), through OpenRouter: paint the background for an illustrated story. They receive only the scene description we write (a place, the time of day and the weather), never your messages.
• Fish Audio: turns the characters' replies into speech.
• Cloudflare: network delivery and security.
• Google: usage analytics (Google Analytics).
• Meta Platforms: ad measurement (Meta Pixel, and the Conversions API for visits from Meta ads).
• Your browser's push service, if you turn on notifications.

We share data with them only so they can provide these services. We may also disclose information when the law requires it.

Where your data is processed

Our servers are in the United States. If you use Toonabi from Japan or anywhere else, your data is transferred to and processed in the United States.

How long we keep it

• Chats, memory (including the diary), stories and profile: until you delete them with “Delete my data”.
• Server logs, which can include message text (not IP addresses): up to a few months. “Delete my data” doesn't reach them; they expire on their own.
• Analytics: according to our Google Analytics retention settings. Meta Pixel data: according to Meta's data policy.
• Being marked as under 18 (by your answer or by what you said in a chat), a warning for playing someone under 18 in a story, an answer under the minimum age, and safety flags stay after you delete your data, without your chats, to protect minors.
• When you delete your data, the send times of your last two days of messages stay for up to 2 days, with no content, so the daily message limit stays fair.

Deleting your data and your rights

“Delete my data” on the You page removes this browser's chats, memory, diary notes, conversation summaries, stories, notification subscription and waitlist email from our server, along with the chat copies on this device. The characters won't remember you afterwards.

Because there is no account, we can only find your data through the browser you used. To ask a question, get a copy of your data, or have it corrected or deleted, email [email protected]. Depending on where you live (for example California or Japan) you may have additional rights, and we will respond to requests as the law requires.

Children

Toonabi is not intended for children under 13 (under 14 in Canada), and we don't knowingly collect their personal information. If you give an age under that at the age question, you can't chat, and we delete this browser's chats and memory. If something you write in a chat shows you're under that age, you can't chat either, and we delete this browser's chats and memory within 7 days. People under 18 get a friendly mode with no romance, and so does anyone whose chat shows they're under 18. We use what you write in chat for this, to keep Toonabi suitable for your age. If you believe a child under that age has used Toonabi, email [email protected] and we will delete the data.

Security

Data travels over HTTPS and access to our servers is restricted. No system is perfectly secure, so please don't share anything in chat you wouldn't want stored.

Changes and contact

If we change this policy, we'll update the date at the top of this page.

Toonabi LLC · [email protected]