Cuddlo is a web app where adults chat with AI characters. This policy explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have. Cuddlo is for adults aged 18 and over only.
What we collect
- Account details. A user id. If you sign in, your email address (from Google or from an email sign in link). Your country (from our network provider, not your exact location), when you confirmed you are 18 or older, and which version of the Terms you accepted.
- Your chats. The messages you send and the characters' replies, so you can pick up where you left off.
- What characters remember. Short notes each character keeps about you (for example a nickname or interests). You can see, edit and delete them in Memory. Characters are told never to keep passwords, card or bank numbers, ID numbers, exact addresses, health diagnoses or crisis details.
- Usage records. How many messages you send per day, token counts and costs of AI calls, and safety flags (a category such as “possible minor”, never the message itself).
- Subscription records. Plan, status, dates and amounts. Card details go straight to our payment processor; they never reach our servers.
- Advertising and analytics data. Described below.
- Technical data. IP address and browser details, used for security (rate limits, bot checks) and, if you allow it, ad measurement.
How your messages are processed
To write a reply, your messages are sent to our AI model provider to generate replies, together with recent chat history and what the character remembers about you. The provider is a third party large language model service that processes this data on our behalf. [Provider name or names to be listed here before launch.]
Cuddlo chats are not end-to-end encrypted. That is not possible here, because our server has to read your message to send it to the AI model. Traffic between your browser and us is encrypted with HTTPS. [Encryption at rest for stored data and backups to be confirmed before launch.]
Automated safety checks run on every message and reply to enforce our hard limits. Our staff and admin tools cannot read your chats. If you choose to share a chat with support, we record only which chat and when.
Why we use it
- To run the chats you ask for, remember context, and keep your account.
- To enforce daily limits, prevent abuse and keep the service safe and legal.
- To process payments for Plus.
- To understand how Cuddlo is used, with first party analytics that never include message text.
- To learn which ads bring people here, if you allow it (see below).
We never sell your chats or what characters remember, and never use them for advertising.
Advertising and attribution
We advertise Cuddlo and want to know which ads bring people here, so we only pay for ads that work. When you arrive from an ad or a campaign link, we keep a first party cookie with the campaign tags, the referring site, the landing page and the ad click id, and link it to your account when you start a chat.
Ad networks we may use include social and search platforms (such as Meta, TikTok, Google Ads, Microsoft Advertising, Snap, Reddit, X and Pinterest) and adult traffic networks. When you sign up, start a chat, start a checkout or pay, our server can tell the network that sent you, with the click id, an event id, the amount and currency for payments, your IP address and browser details. If an email address is ever sent, it is only a one way hash, only where the network allows it, and never after you opt out. We never send your messages, what characters remember, character names, or anything describing your chats. On our home and pricing pages only, these networks' own tags may also count page views.
Sharing data with ad networks may count as a “sale” or “sharing” under some US state laws. You can turn it off on Your Privacy Choices. If your browser sends Global Privacy Control, we treat it as that opt out automatically. In regions that require it, nothing is shared until you agree. Every cookie and storage item we use is on the cookie list.
Analytics
We count product events (such as starting as a guest, signing up, sending a first message, upgrading or cancelling) in our own database. No third party analytics tool is used and message text is never included. If you turn analytics off, or your browser sends Global Privacy Control, events are only added to anonymous daily totals and are not linked to your account.
How long we keep it
- Chats and what characters remember: until you clear them, delete them in Memory, or delete your account.
- Guest profiles: deleted after 90 days without a visit. [The scheduled clean up of those guests' chats is still being built; until then you can delete a guest's data on Your data.]
- Usage, cost and event records: 400 days. Analytics events: 395 days.
- Attribution, consent and ad conversion records: 13 months.
- Payment provider notifications: 180 days. Shared chat links: 7 days.
- Subscription and payment records: as long as tax and accounting law requires, without your account id once your account is deleted. [Period to be confirmed.]
- Server logs never contain message text. [Log and backup retention periods to be confirmed before launch; deleted data leaves backups when they rotate.]
Download or delete your data
On Your data you can download a copy of everything we hold about you (profile, chats, memory, privacy choices, attribution and subscription history) as a file, and delete your account. Deleting cancels any active subscription first, then removes your chats, memory, usage, consent and attribution records, and your sign in. Safety and cost records we keep for statistics lose your account id. You can also clear a single chat, or make one character forget you, at any time.
Your US state privacy rights
If you live in California (CCPA as amended by the CPRA) or another US state with a consumer privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas or Oregon), you have the right to:
- know what personal information we collect, use and disclose, and get a copy;
- delete it, and correct it if it is wrong;
- opt out of the “sale” or “sharing” of personal information and of targeted advertising (on Your Privacy Choices or with Global Privacy Control);
- limit the use of sensitive personal information;
- appeal if we turn down a request, and not be treated differently for using a right.
Sensitive information. Using an adult companion app, and what you say in chats, may reveal information about your sex life or sexual orientation, which these laws treat as sensitive. We use it only to provide the chats you ask for and to keep the service safe, never to infer characteristics about you for advertising, and we never share it with ad networks. We do not sell personal information for money.
Use the tools on Your data, or write to support@heycuddlo.pro. We may need to confirm the request comes from the account holder; an authorised agent can act for you with your signed permission. We answer within 45 days. [State-specific appeal contact to be confirmed.]
Adults only
Cuddlo is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If a chat suggests a user may be under 18, the character stops any romantic tone and the account is restricted for review.
Changes and contact
When we change this policy we update the date at the top; for significant changes we will also tell you in the app. Questions or requests: support@heycuddlo.pro, or see Contact.