Privacy Notice

1. Without an account

You can watch without an account. What you watch, the choices you make, the endings you find, your list, your coins and your settings stay in your browser (its local storage), on your device only.

We count visits, plays, choices and sign-ups to see what works, with a random number your browser keeps instead of your name, plus the page, the show and episode, your language and your rough country.

2. Your account

• Your email address and a protected (hashed) version of your password; we never see the password itself.
• Your date of birth, only to confirm that you are 18 or older.
• Your language, time zone and plan, the version of these documents you accepted and when.
• Your sign-in sessions: a sign-in cookie and the kind of browser you used. We do not store your IP address with your account.
• Your chat persona if you write one (the name characters call you and what you tell them about yourself), and your notification settings.

3. What you do with an account

Your progress in each episode, your choices, endings, list and chat marks (which chats you read, pinned or reacted to, and unsent drafts) are kept with your account, so they follow you to every device. When you first sign in, what your browser kept as a guest moves into your account (never coins).

When chats and calls are open: your messages, your voice messages (the audio and its transcript), the photos characters send you, your calls (transcript and a summary), and what each character remembers about you in its story. A character’s memory belongs to one story; characters never share it across stories.

Daily counts of messages, voice messages, photos and call minutes (for the daily limits and to know what the service costs), and any report you send us.

4. How the AI uses it

To write a character’s reply, voice or photo, we send our AI providers what that reply needs: your message, the story so far as you watched it, your persona, and the character’s instructions. Messages and personas are also checked by an automated moderation model for safety.

We ask the providers not to store these requests, and our own logs record only their size, cost and timing, never their content. Under their terms for businesses, Anthropic and OpenAI do not use them to train their models; each may keep them for up to 30 days to detect abuse, and Anthropic longer only for a request flagged under its usage policies.

5. Who processes it for us

• Anthropic (United States): the characters’ written words (their replies, and the words of their voice notes and calls).
• OpenAI (United States): the characters’ replies when Anthropic is unavailable, their voices and the transcripts of your voice messages when ElevenLabs is unavailable, photos, and moderation.
• ElevenLabs (United States): the characters’ voices in their voice notes and calls, and the words of your voice messages and calls (it hears them to write them down). We delete each voice note and transcript from ElevenLabs as soon as it is made; on calls it keeps no recording and deletes the call’s transcript once the call is over (we keep our own copy with your account).
• Cloudflare (United States, with a worldwide network): hosting the website and the API, storage of files such as voice messages and photos, sign-in emails, logs and the visit counts.
• Amazon Web Services (United States, Oregon): the database that holds your account and its data.

They process data only to provide their service to us. No advertising networks receive anything from Stofy.

6. Cookies and your browser’s storage

We set one cookie, and only when you sign in: it keeps you signed in. It is sent only to our own API, cannot be read by scripts, and lasts 30 days, renewed while you use Stofy. There are no advertising or tracking cookies.

Your browser’s storage keeps your preferences (sound, the swipe hint) and, signed in, a copy of your account’s state so Stofy works offline. Signing out removes that copy; your preferences stay.

7. How long we keep it

• Your account and everything in it: until you delete the account. Deleting it removes it from our database and our file storage at once.
• Sign-in sessions: 30 days after you last used them.
• Email codes: 10 minutes, stored hashed.
• Hosting logs, which include each request’s IP address and rough location but never your messages, email or prompts: up to 7 days.
• Visit counts: up to 3 months.
• Database backups: up to 35 days, after which deleted data is gone from them too.
• Our AI providers: up to 30 days, as above.

8. Your choices and rights

In Profile you can change your persona and language, download everything your account holds (Export my data, a file), sign out everywhere, and delete your account and its data (Delete my data).

Depending on where you live, you may have the right to access, correct, delete or take your data, and to object to how it is used. You can use most of these rights yourself in Profile; for anything else, contact us.

9. Age, security and where data goes

Stofy is not for anyone under 18. We do not knowingly keep data about minors: if we learn an account belongs to one, we delete it.

Passwords are hashed, the sign-in cookie is protected from scripts and sent only over encrypted connections, and our providers encrypt data in transit and at rest.

Your data is processed in the United States and on Cloudflare’s worldwide network.

10. Changes and contact

This notice and the Terms carry one version number. When either changes in substance, we ask you to accept the new version the next time you use your account.

Stofy, Inc. is responsible for your data. Our contact address for privacy questions and requests will be published here before Stofy launches.