Privacy Policy

1. Information we collect

Information you provide to us:

• Account information: email address, username, password (stored in hashed form), and, if you sign in with Google or Apple, the identifier and basic profile information those providers share with us.
• Profile information you choose to add: display name, avatar, banner image, bio, gender and similar details.
• Content you create or upload: characters, personas, stories, images, voice samples, mini apps, themes, comments and other creator content.
• Conversations: the messages you send to characters and the AI-generated replies you receive. Conversations are stored so characters can maintain context across sessions and so you can revisit them. Conversations may include sensitive information if you choose to share it; please think carefully before doing so.
• Purchase information: the items you buy, the amount, the payment method type and a transaction identifier. Full payment card numbers are collected directly by our payment processors and never reach our servers.
• Creator payout information (creators only): the details needed to pay you and to satisfy tax reporting obligations, which may be collected by us or by a payout provider on our behalf.
• Communications: the contents of messages you send us, such as support requests, feedback, reports and appeals, and the contact details you include.

Information we collect automatically:

• Device and technical data: IP address, device type and model, operating system, browser type, language settings, app version, and identifiers such as a device ID or installation ID.
• Usage data: the pages and features you use, the characters you view and chat with, session length, clicks, referring pages, and error and performance logs.
• Approximate location: the country, state and city inferred from your IP address. We do not collect precise geolocation.
• Cookies and similar technologies, as described in our Cookie Policy.

Information from other sources:

• Sign-in providers (Google, Apple) when you use them to create or access your account.
• Payment processors and app stores, which confirm your purchases and report refunds, chargebacks and fraud signals.
• Other users, for example when someone reports your content or invites you to the Service.

2. How we use information

We use personal information for the following purposes:

• To provide the Service: creating and maintaining your account, generating character replies and other AI outputs, storing your conversations, delivering purchases and creator payouts, and providing customer support.
• To personalize your experience: recommending characters, remembering your preferences and language, and tailoring content to the categories you have enabled.
• To keep the Service safe: detecting, investigating and preventing abuse, fraud, spam, security incidents and violations of our Terms and Community Guidelines; enforcing age requirements; and handling reports and appeals.
• To improve the Service: understanding how features are used, fixing bugs, and developing new features. Where we use conversation content to evaluate or improve our AI systems, we first remove account identifiers and use it in aggregated or de-identified form, and we do not permit third-party model providers to train on your conversations.
• To communicate with you: sending service, security and billing notices, responding to your requests, and, where permitted, sending news and promotions you can opt out of at any time.
• To comply with law: satisfying legal, tax, accounting and regulatory obligations, responding to lawful requests, and establishing or defending legal claims.

We do not use personal information to make decisions that produce legal or similarly significant effects on you, and we do not sell personal information or use it for targeted advertising.

3. How we disclose information

We disclose personal information in the following circumstances:

• Service providers who process information on our behalf and under our instructions, including cloud hosting and storage, AI model providers that generate character replies and other outputs, payment processors (such as Antom), analytics providers (such as Google Analytics), email and SMS delivery, human-verification (captcha) services and customer support tools. These providers are contractually restricted from using your information for their own purposes.
• Other users, to the extent you make information public. Your profile (username, display name, avatar, bio) and any characters, comments or other content you set to public are visible to anyone, including search engines. Creators can see aggregated statistics about how their characters are used, but they cannot read your private conversations.
• Payment processors and app stores, to complete transactions you initiate.
• Legal and safety: to comply with law, regulation, legal process or governmental request; to enforce our Terms; to detect and address fraud, security or technical issues; or to protect the rights, property or safety of Tokomi, our users or the public. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children as required by law.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of some or all of our assets, in which case the recipient will be bound by this Policy or will notify you of any material changes.
• Affiliates that help us operate the Service, under this Policy.
• With your consent or at your direction.

We do not sell personal information, and we do not “share” personal information for cross-context behavioral advertising as those terms are defined under the CCPA. We do not knowingly sell or share the personal information of anyone under 16.

4. Cookies, analytics and your choices

We use strictly necessary cookies to keep you signed in, remember your language and record your privacy choices. With your permission we also use Google Analytics to understand how the Service is used. We configure analytics to anonymize IP addresses and we do not enable advertising features or data sharing with Google for advertising purposes.

You can turn analytics off at any time on our 你的隱私選擇 page. We also honor the Global Privacy Control (GPC) browser signal: if your browser sends it, we treat it as a request to opt out of analytics on that browser. For more detail see our Cookie Policy.

5. How long we keep information

We keep personal information for as long as your account is active and as needed for the purposes described above. In particular:

• Conversations and content remain until you delete them or delete your account. You can delete individual conversations, characters and comments at any time.
• When you delete your account, we deactivate it immediately and delete or de-identify your personal information within 30 days, with copies removed from backups within 90 days.
• We retain a minimal record of deleted accounts (a hashed device identifier and registration IP address) to prevent abuse of sign-up bonuses and to enforce bans. This record cannot be used to re-identify you through the Service.
• We retain transaction records, creator payout records and related information for as long as required by tax, accounting and anti-fraud laws (generally seven years).
• We may retain information longer where required to comply with a legal obligation, resolve disputes, enforce our agreements or protect safety, including reports of serious abuse.

Server logs and analytics data are retained for up to 14 months in identifiable form and may be kept longer in aggregated form.

6. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit, access controls, hashed passwords and monitoring. No system is completely secure, and we cannot guarantee the security of your information. Please use a strong, unique password and keep your credentials confidential. If we become aware of a breach affecting your information we will notify you as required by law.

7. Your privacy rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access / to know: to confirm whether we process your personal information and to receive a copy of it, including the categories collected, the sources, the purposes, and the categories of third parties to whom it was disclosed.
• Correction: to correct inaccurate personal information.
• Deletion: to have your personal information deleted, subject to legal exceptions.
• Portability: to receive your personal information in a portable and, where feasible, readily usable format.
• Opt out: to opt out of the sale or sharing of personal information, targeted advertising, and certain profiling. We do not engage in these activities, but you may still turn off analytics on our 你的隱私選擇 page.
• Limit use of sensitive personal information: we use sensitive personal information (such as your login credentials and the contents of your conversations) only to provide the Service and for the purposes permitted by law, and do not use it to infer characteristics about you.
• Non-discrimination: we will not deny you services, charge different prices or provide a different level of quality because you exercised your rights.

How to exercise your rights. You can exercise many rights directly in the Service: edit your profile, delete conversations and content, and delete your account from Settings. Step-by-step account deletion instructions are on our Delete your Tokomi account page. For anything else, email [email protected] with the subject line “Privacy Request”. We will verify your request by asking you to confirm control of the email address associated with your account, and may ask for additional information where necessary to protect your account. An authorized agent may submit a request on your behalf if they provide proof of your written authorization and we can verify your identity. We respond within 45 days and may extend that period once by a further 45 days where reasonably necessary, in which case we will let you know.

Appeals. If we decline to act on your request, we will explain why. You may appeal by replying to our decision or emailing [email protected] with the subject line “Privacy Appeal” within 60 days. We will respond to appeals within 45 days. If your appeal is denied, you may contact your state Attorney General, for example through the Colorado, Connecticut, Virginia or Texas Attorney General’s office, as applicable.

8. Additional disclosures for California residents

This section supplements the rest of this Policy for California residents. In the preceding 12 months we have collected the following categories of personal information as defined in the CCPA, from the sources and for the business purposes described in Sections 1 and 2, and disclosed them for business purposes to the categories of service providers and other recipients described in Section 3:

• Identifiers (name, username, email address, IP address, device and account identifiers).
• Customer records information (name, contact details, payment method type, transaction identifiers).
• Commercial information (purchases, Stars balance and usage, memberships, creator earnings).
• Internet or other electronic network activity (usage data, interaction with the Service, log data).
• Geolocation data (approximate location derived from IP address only).
• Audio, electronic, visual or similar information (images, voice samples and other media you upload; character voice outputs you play).
• Inferences drawn from the above to personalize recommendations within the Service.
• Sensitive personal information: account login credentials, and the contents of your conversations with characters, which may reveal information you choose to share.

We do not sell personal information and have not done so in the preceding 12 months. We do not share personal information for cross-context behavioral advertising. We retain each category of personal information for the periods described in Section 5. We do not offer financial incentives in exchange for personal information; promotional credits for check-ins or invitations are not conditioned on your providing personal information beyond what is needed to operate the program.

California’s “Shine the Light” law (Civil Code § 1798.83) permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures. California residents may exercise their CCPA rights, including the right to know, delete and correct, as described in Section 7. To designate an authorized agent or to request information about our processing, contact [email protected].

9. Children

The Service is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 in violation of the Children’s Online Privacy Protection Act. If you believe a minor has created an account or that we have collected information from a child, contact us at [email protected] and we will delete the account and information promptly.

10. International data transfers

Tokomi is based in Singapore and uses service providers in the United States and other countries. Your personal information may therefore be transferred to, stored and processed in countries other than the one you live in, which may have different data protection laws. We take steps to ensure your information receives appropriate protection wherever it is processed, including contractual safeguards with our service providers.

11. Third-party services

The Service links to and integrates with third-party services, including sign-in providers, payment processors and app stores. Those services collect and use information under their own privacy policies, which we encourage you to read. We are not responsible for the privacy practices of third parties.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and update the “Last updated” date. If a change is material we will notify you in the Service or by email before it takes effect. Your continued use of the Service after the effective date means you acknowledge the updated Policy.

13. Contact us

You can reach our privacy team at [email protected] or by mail at Starloom Interactive Pte. Ltd., Attn: Privacy, 25 Seah Street, #02-01, Singapore 188381.