Privacy
Plain words first. The whole policy is underneath, section by section, the same text the app shows.
Your diary is encrypted on your phone before it is stored. So that a new phone can open it, a copy of its key is kept, encrypted, with your account on our server: we could technically read it, and we do not. A match never sees your diary or your questions. When the gods answer, your words go to the AI writer, and your conversations are kept encrypted until you delete them.
One private picture of you, made of words, and the memories you confirm. It is never shown to anyone. It helps the matching only after you switch that on, and you can switch it off again.
The name you go by, the portrait the app painted of you, and your song. Never your diary, your questions, or the reasons you were introduced.
Off until you switch it on. You can switch it off again. Nothing happens on one yes. Agreeing to meet is not agreeing to anything more.
Privacy policy · updated October 19, 2026
The same text the app shows. Nothing is left out here.
This service is operated by PRETTY GOOD - FZCO (Pretty Good Company), IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.
Your email address and account identifier, encrypted journal entries, your versioned sign-up agreement covering sentence reflections, portrait creation, and spoken conversation, AI-generated quality scores and abstract vectors when enabled, tentative character observations, separately permitted private understanding and reviewed connection preferences, event participation and encounter records, optional reminder preferences and delivery metadata, your required first name and birth year, an exact 18+ attestation, profile information and portrait you choose to share, private introduction audio and photo, separately approved duet sources and generated films with consent and processing records, consumable purchase and token-ledger status, encrypted messages, safety reports, device push tokens, a request to be notified when the guru is available if you make one, and an encrypted revocation credential for Apple sign-in accounts.
Your sentence is encrypted on your device before storage. Until you accept the sign-up agreement, the archive receives ciphertext and basic entry metadata, never plaintext content, and private journaling remains fully usable. When allowed, plaintext travels securely for one request to our contracted AI service and is not logged or retained by our backend.
Your journal key is kept in secure storage on your phone and, so that a new or restored phone can open your diary, also with your account on our server, where it is encrypted with a server secret. This means we could technically read your diary sentences. We do not read them. AI reflection reads a sentence briefly only when you have switched it on. Deleting your account deletes the stored key.
The in-app control creates a readable dated copy with sentence text and locally available reflection details from this device. It does not fetch other server-held profile, purchase, recognition, chat, or account records. Anyone you share the file with can read it.
Course progress stays on this device, scoped to your account, and is not used for AI analysis or matching. Our backend retrieves course PDFs and course preview images from Google Drive without sending your identity, journal, profile or account token to Drive. Downloads are temporarily cached on your device. A PDF is shared outside the app only when you choose to save or share it; saved copies do not update automatically. Preview images are not personalized.
Requesting the next course block saves your account identifier, request state, active-request time and a retry revision on our server. It records interest only, not a purchase, lesson unlock or permission for messages. You can withdraw it. Withdrawal clears the active-request time; an inactive revision remains to prevent stale retries. Account deletion removes the request record.
With the separate Let these threads inform the gods choice, up to 24 reviewed threads may join your next Shiva and Parvati reply request. The API decrypts these words transiently and sends them to the configured text writer: OpenAI directly, or a model through OpenRouter, with DeepSeek in China if that fallback is enabled. Drafts, matching labels, source identifiers, raw journals, human calls, voice analysis and enrolled identity are not part of this added context. The writer treats reviewed words as tentative context and gives your current statement and corrections priority. Original conversation permission must also remain on. Correction, forgetting or source removal changes future inputs. Withdrawal stops new use and rejects an unfinished answer based on an older revision; it cannot recall a request already sent. Earlier replies, films and existing personal memory remain under their own controls and may still influence later replies.
Matchik-making is optional. Event attendance and introductions start off at signup; you switch them on yourself, then or later in You → Settings. Other signup choices start on and take effect only after you review and confirm OK. You can change them before confirming or later in You → Settings. Existing saved choices stay unchanged. Introductions open only during the configured event season, after adult eligibility, your explicit participation, a fresh twenty-minute wish and permission to use reviewed connection preferences. No writing streak or payment is required. We look for compatible wishes and at least one shared reviewed preference. Separately approved original diary patterns may help order eligible introductions; this is not a personality score or a promise of compatibility. Both people choose independently. A meeting needs agreement on the exact public place and time, and either person can withdraw. Your words, private notes, internal tags and selection reasons are never shown to the other person. Separately opting into public charms shows anonymous counts of current wishes, not your identity or location. Earlier mutual rooms remain available.
New signup choices for private understanding are preselected on, with an explanation and individual choices before you confirm OK. You can change them later in You → Settings. Existing saved choices stay unchanged. You can separately permit existing journal-reflection themes, memories you explicitly confirmed, and your own retained Kailash words. Their original processing permission must remain current. We gather exact recurring, non-sensitive themes and short excerpts for you to review, correct or forget. No new AI request is made on this page. It does not analyze voice tone, human calls, film stories, enrolled voices or identity checks, and does not decrypt raw journal entries. You can write your own context at any time; a long history is not required.
Understanding text is encrypted on our server with a key available to the service, and is readable transiently when you view or edit it. It is not end-to-end encryption. Up to 24 threads of 800 characters are kept until you forget them, turn understanding off, remove their source or its permission, or delete your account. Source references and the six connection labels you review are server-private metadata. A separate choice lets those reviewed labels help Matchik-making during your event participation. Private prose and notes do not enforce encounter boundaries; your current wish is chosen in Burn. Existing personal-memory case files are excluded from this purpose.
You can correct or forget a thread in You. Forgetting retains only a source reference and change fingerprint so the same unchanged suggestion does not quietly return. Deleting the source removes that marker. Turning understanding off or choosing Forget all erases the threads and markers and withdraws encounter and god-reply use. Original journal and conversation records have their own deletion controls. Changes can end active invitations and meeting arrangements; choose a fresh wish when ready. Your separate understanding export includes your threads, choices and source history, not original source text or other account records. Anyone you share it with can read it.
You may separately allow original diary patterns to help Matchik-making, then approve that use for each reviewed thread. Existing threads do not opt in automatically. With current journal, understanding, diary and encounter permissions, the server may compare existing abstract diary patterns behind those approved threads alongside shared reviewed connection labels. No new AI request or raw journal decryption is made. Only compatible existing model formats are compared; otherwise reviewed labels are used. Gathering samples up to 120 permitted records across available history, with up to 20 source references per thread; this is sampled history, not a claim to know every day or a whole year. Editing a thread clears its original-pattern approval until you review it again. Source changes, deletion or withdrawal invalidate that use and pending encounters. Kept mutual connections remain separate. Internal comparisons, source records and scores are never shown to another person. Human calls, mixed personal memory, voice analysis and enrolled identity are excluded.
The server keeps event choices, expiring wishes, independent responses, and shared meeting place, time and arrival updates. Meeting details and command retry records are access-controlled server data; they are not encrypted with your journal key. Closed encounters are removed by maintenance after 30 days and retry records after one day. Optional Magic alerts use generic wording without names, wishes or meeting details. Their private delivery metadata is removed after one day by maintenance. Account deletion removes your event records. The device keeps only an encrypted copy of a mutually confirmed meeting, with its last-confirmed time, for offline reference. Offline viewing cannot confirm a new agreement or deliver an arrival update. Existing chat and restricted safety-report retention remain separate.
After both people accept an introduction, each can separately choose Keep this connection. Only two independent keep choices open a free encrypted chat room. A kept connection can remain after the Burn and after the temporary encounter record is removed; the 30-day encounter cleanup does not delete it. Either person can end the connection. Ending is final for that connection and stops both people from reading or sending through the room again, while existing message ciphertext stays stored until either account is deleted. Blocks, account restrictions or withdrawal of the general agreement can also end access. Leaving the event or turning off understanding does not end a separately kept connection. Messages already read, downloaded or otherwise copied cannot be recalled. Restricted safety reports have their own retention rules.
Preparation reminders and an event-opening notice are separate choices that start off. Preparation follows your chosen 7-day or 30-day interval and local hour; the first reminder waits that interval. Choose your timezone explicitly. No reminder is sent from 21:00 to 08:00 in that timezone. One opening notice per season is considered only after the configured opening instant and while the Burn remains open. Neither reminder requires attendance or enables event participation. Existing Occasional app notes permission and a registered device are also required. Messages use fixed generic wording and link to Diary or Burn, without names, private words, wishes or meeting details. Delivery is best effort, not proof you saw it. We retain preferences, the next preparation time and the seasons already considered until account deletion; turning a choice off cancels its pending use. Private delivery attempts, provider tickets and receipts are removed by maintenance after one day. A notification already sent cannot be recalled.
If you sing the door song and agree to share it, your recording is stored privately and played only to a person you are introduced to, next to your portrait. It is never used to choose who you meet. You can replace or remove it at any time, and it is deleted with your account.
Where the new introduction is enabled, onboarding asks for one recording lasting at least three minutes and a photo. We store these files in private, access-controlled Supabase storage and our server checks that they can be decoded and that the recording meets the duration requirement. They are not encrypted with your journal key or end-to-end encrypted. When you save the photo, our server sends it once to a Google model reached through OpenRouter, which only checks that it shows one real adult face and no nudity; a photo that fails is not saved, and the answer is not kept with your photo. The recording is not sent to AI for this. Saving them does not create a voice clone, enable matching or show them to a match. Selected files remain until you delete your introduction or account. Unselected uploads expire after 24 hours unless retained as an explicitly reused profile-photo source; physical deletion follows when cleanup succeeds. Stopped recordings and photo drafts may remain on this phone for recovery, including after sign-out, scoped to your account. Deleting the introduction or account also clears these local drafts; failed cleanup is queued for retry.
After completing your introduction, you can separately choose to copy its photo into your existing profile-photo source. This does not itself create a portrait or film. Those features still require their own permissions and explicit requests. The raw introduction recording is never reused for them. Deleting your introduction removes its stored audio and photo and any profile source copied from it; portraits and films already generated have their own deletion controls and are not erased by introduction-only deletion.
When available, a genuine mutual Burn introduction can have an optional seven-second film. Each person must separately approve their current shareable generated portrait and door-song recording for that pair. Fal, using MiniMax H3 Max, receives the approved portraits and original song excerpts to animate the duet. OpenRouter sends those approved portraits, excerpts and the seven-second film to Google Vertex, using Gemini 2.5 Pro, for an automated check of identity, lip movement, original audio, timing and unintended exposure. An uncertain or rejected result is not released. Private introduction audio and its private photo, raw journals, private notes and cloned voices are excluded. This feature does not clone either voice or use the film to choose a match. Consent to matching, sharing a door song or making other personal films does not grant duet permission.
The finished duet is available in the app only to the same pair while both source approvals and connection access remain valid. We keep the generated video, original soundtrack and production copies in private app storage, together with consent revisions, source fingerprints, processing receipts and the quality-review result. These are access-controlled service records, not end-to-end encrypted. Either person can withdraw duet permission; changing or removing an approved source also invalidates the duet. Withdrawal, a block, ending the connection or deleting either account stops in-app access for both people and queues media cleanup. An expired introduction loses access unless both people separately kept the connection. Removal of the underlying encounter also removes its duet records and queues cleanup. Restricted retry and cleanup records, file-path tombstones and minimal one-attempt records can remain to prevent delayed writes or duplicate paid processing. Physical deletion may be delayed by outages or unavailable provider deletion. We cannot recall inputs already sent to a processor or copies saved outside the app, and do not promise immediate provider or backup erasure.
Sentence reflections, surreal portrait creation and spoken conversation are covered by the one agreement you accept at sign-up; private understanding, use of reviewed preferences for encounters, event participation and public charm visibility remain separate choices. A chosen photo is sent only after portrait permission and an explicit creation request. First a Google model reached through OpenRouter checks that the photo shows one real adult face and no nudity; a photo that fails is not used and no portrait attempt is spent. Then an OpenAI model, reached through OpenRouter, briefly describes the photo (approximate age, build, face shape and hair, never ethnicity or health), and Black Forest Labs, reached through OpenRouter, turns it into your portrait.
Shiva and Parvati are fictional AI characters. Under the one agreement you accept at sign-up, configured AI models reached through OpenRouter write from your typed messages, and Inworld transcribes recorded speech. Background research can use different writer and critic models, including Anthropic and OpenAI. When you speak, Inworld also hears the mood and manner of your voice, such as tender or laughing, never your age or accent, so Shiva and Parvati can answer how you sound. That tone is used for one reply, is not stored and is never used for matching. For legacy conversations outside background research, if the configured writer is unavailable, DeepSeek (whose servers are in China) can write replies and video scenes from the same conversation text. Background research uses its configured writer and independent critic without switching to a fallback provider. When background answer preparation is available, the app temporarily stores your submitted text or full recording encrypted on its server, so preparation can continue while you leave the app. The queued copy is removed when preparation completes, fails or is cancelled. A request waits in line for up to 24 hours, and each answer gets at most 30 minutes of preparation; cleanup removes expired queued copies when maintenance next succeeds, so an outage can delay deletion. Outside this background queue, raw speech is discarded after transcription or when recording is abandoned. Providers process submitted inputs under their own terms. Conversation text and user-confirmed memories are stored encrypted on our server until deleted, and used for continuity. Before requesting a film, the app keeps its request identifier and original signed scene quote encrypted on your device with your account-specific device key, so an interrupted purchase can be recovered without repeating it. This pending copy survives sign-out and is removed when the request is resolved or rejected before purchase, when you delete its question, or when you delete your account. Inworld performs character dialogue. On your explicit request, fal, with MiniMax as its video model, processes your profile photo, short scene script and Inworld character audio to create short scenes that may be joined into a longer film. So that you look the same in every scene, an OpenAI image model reached through OpenRouter first turns your profile photo into a character reference sheet for that film; the sheet goes to fal with your photo and is not kept in app storage. If fal cannot accept the request because of account access, balance or rate limits, the app may send those same chosen inputs directly to MiniMax instead. The full conversation is not sent to the video model. Completed videos are copied to private app storage and listed in Your little cinema, where you can watch or delete each one. Saving a video to your phone downloads it and opens the share sheet; copies you save or share outside the app cannot be recalled by us. Only if you tap Publish on YouTube and confirm, our server uploads that one film to the app’s YouTube channel, where it is public for anyone; AI models reached through OpenRouter write its title and description from the gods’ lines and turn its cover picture into a thumbnail; YouTube (Google) then holds it under its own terms. Deleting the film in the app, or your account, also removes it from YouTube; copies others made meanwhile cannot be recalled. Withdrawing permission stops new processing; it does not recall data already submitted to providers. Forgetting conversations removes conversation history and memories. Films you made stay, together with the short scene script each was made from, until you delete that film; account deletion also queues removal of saved videos. Fictional performances never enter matching. With separate understanding and encounter-use choices, your own retained conversation words and confirmed memories may support connection labels that you personally review; raw words never go to another person.
Personal memory is part of the one agreement you accept at sign-up. What you tell Shiva and Parvati, the films made about you and the private recap of a guru call are stored encrypted on our server so the characters can come to know you over time. An OpenAI model reached through OpenRouter turns each item into a private search index so the most relevant memories can be found, and after each talk it rewrites a short cumulative case file about you, also encrypted, that Shiva and Parvati read before they answer. These personal-memory items and the cumulative case file are never shown to other people or used for matching. The separately controlled understanding page uses original retained Kailash words and confirmed memories, with source history, instead of this mixed memory store. It is a mirror, not therapy or diagnosis. You can delete retained conversation history in You → My memories, use the separate understanding controls, or ask support to delete personal memory and its case file. Deleting your account removes them all.
The app no longer offers live conversations with a digital guru. If you used them before, the tentative character observations and after-conversation reflections created then remain access-controlled account data, excluded from matching. Raw recordings were never saved. You can ask support to delete them at any time, and account deletion removes them.
When you call the guru, a real person, LiveKit carries the live audio and video. Our Fly API and Supabase store participant and call identifiers, connection times, call status, shared-wallet reservations and settlement records. Device registration and Apple push notifications support incoming calls on the guru’s answering phone. If you ask to be told when he is back, we keep that request until one notification has been sent or you withdraw it.
Recording requires both participants to accept the recording notice for that call. LiveKit then records audio only, not video. OpenAI processes the audio to create a full transcript and private recap for the caller. Saved audio, transcript and recap use server-side encryption and access controls, not the device-bound journal key and not end-to-end encryption. Providers must process the audio and text to provide this feature. The saved history is private to the caller and is never shown to matches or used for matching. If the caller has allowed personal memory, the recap also becomes part of what Shiva and Parvati know about them. The app does not show this history; you can ask our support for a copy or its deletion at any time, and deleting your account removes it.
Saved human-call audio, full transcript and recap remain until the caller deletes them. Either participant can withdraw recording consent, which stops recording and removes the saved materials. Deletion of either participant’s account also invalidates these materials. Access is revoked, transcript and recap content and archive decryption keys are removed, and remaining recording objects are queued for deletion. Restricted cleanup records may remain until cleanup succeeds; provider or backup deletion is not necessarily immediate. Copies you choose to download or share outside the app cannot be recalled by us.
Recreating your voice is part of the one agreement you accept at sign-up. When you record the enrollment lines, that recording is sent to Inworld to create a private voice identity bound to your account, and the recording itself is stored privately on our server. Your voice is only ever used to speak your own character’s lines in your own scenes: it is never given to another person, never substituted for Shiva or Parvati, and no one else’s voice is ever used for you. It is never shown to a match and never used for matching. You can remove your voice at any time; removing it deletes the recording and the provider voice identity, stops any future use, and asks you whether the videos already made with it should be kept or deleted. Withdrawing the permission removes the voice immediately. Removal does not recall data already submitted to providers.
Fly hosts the API. Netlify serves our website, the legal pages and the short welcome clip the app plays before you sign in. Supabase provides authentication, database, storage and realtime infrastructure. Resend delivers account emails. RevenueCat processes consumable purchase events. OpenAI, Anthropic and Google models reached through OpenRouter, Inworld for speech, and DeepSeek as a fallback process the AI features you choose. A Google model reached through OpenRouter checks every profile and introduction photo for one real adult face and no nudity. Inworld performs character voices. fal and MiniMax create videos. Modal joins the finished shots into one film, and Cloudflare stores films in a private bucket. OpenRouter and Google Vertex review separately approved matched duets. OpenRouter and Black Forest Labs create portraits. LiveKit carries live consultations. Google Drive holds the course files. Apple, Google, Expo, APNs and FCM may process sign-in, purchases or notifications. They process only what is needed for the feature you choose to use.
You can withdraw the sign-up agreement in You → Settings. Conversations, films, the recreated voice, AI processing and event participation then stop. Separately kept personal memory remains unused under that agreement until you accept again or delete your account. Understanding drawn from a withdrawn source is removed. You can also withdraw encounter-use permission, leave Matchik-making, choose Space, remove entries, forget understanding, export your own records, block another person or submit a safety report. Withdrawing encounter use stops new candidacy and ends active invitations or meetings; it does not itself delete private understanding you chose to retain. Withdrawing sentence processing removes journal-derived understanding, while context you separately authored has its own permission. If you report a chat message, only that selected decrypted message is shared as your reporter statement. The service cannot independently verify that plaintext against an encrypted room.
Once deletion is confirmed, your account and profile no longer exist. Your encrypted ritual archive, character observations, token balance and ledger, recognition signals and history, private understanding and source markers, event participation and encounters, introductions, conversation ciphertext, push tokens, and app-held purchase status are removed with them. Removal of private profile media and the external RevenueCat record may remain queued in a restricted cleanup system until deletion succeeds. Store purchase records follow the store's own retention rules. If you used Apple sign-in, the app also asks Apple to disconnect. An encrypted revocation credential may remain only while a restricted retry is pending. Safety reports, any message you deliberately shared with a report, and related enforcement audit records may remain in a restricted review system for no more than 24 months from the date each record is created. They are used only for safety review, appeals, and legal response, including after account deletion. These restricted records may keep an opaque account reference needed to understand the report, but they do not keep your account or profile active. An active account restriction ends when the account is deleted.
We do not sell personal data, run behavioral advertising, or track you across other companies’ apps and websites.
Privacy questions can be sent to support@transcending-boundaries.lol.