Privacy Policy

1. Scope and contact

This policy applies to the ShyAI Android app, related services, support, and this website. For privacy questions or rights requests, email support@dublikmax.helioho.st.

ShyAI is for adults aged 18 or older. We record your age self-attestation but do not collect your birthdate for the initial release.

2. Data we handle

• Account: email, display name, account ID, password hash, age attestation, verification, and recovery records.
• Content: characters, avatars, prompts, chat messages, reports, appeals, blocks, and moderation state.
• Usage and device: quota usage, app interactions, version, device and network metadata, consent state, Firebase identifiers, optional notification token, and advertising identifiers when allowed.
• Security and operations: sessions, rate-limit events, request IDs, audit events, diagnostics, crash data, deletion tombstones, and service logs.
• Support and rights: messages, request details, verification steps, export records, and deletion status.

Do not put unnecessary real-world sensitive information in prompts, characters, reports, or support messages.

3. Why we use data

• Provide and secure accounts, conversations, history, characters, quota, and support.
• Moderate public content, investigate reports, prevent fraud and abuse, and enforce rules.
• Send verification, recovery, support, policy, operational, and enabled notification messages.
• Diagnose failures and measure app reliability without using message text as analytics or advertising context.
• Keep required consent and audit evidence and honor legal obligations.
• Serve permitted AdMob inventory. Personalized requests occur only after required affirmative consent.

Depending on location and activity, processing relies on the service contract, legitimate security and reliability interests, consent, or legal obligations.

4. AI and private chat

ShyAI sends content and context needed for a chat request to OpenRouter, which routes generation to the configured model provider. Character text and avatar uploads are checked before publication.

Private conversation text is not routinely shown to human reviewers. Minimum necessary evidence may be reviewed after your report or appeal, during a narrowly authorized safety investigation, or when law requires access.

Prompts, chat text, character definitions, and reports are not supplied to advertisers as targeting context.

5. Providers and disclosures

• Railway: application hosting, PostgreSQL, and Redis.
• Cloudflare: DNS, public website, and avatar storage and delivery.
• OpenRouter and model providers: AI text generation and character or avatar checks.
• Email provider: verification, recovery, and service messages.
• Google Play: app distribution and platform services.
• Google AdMob and UMP: advertising and consent management.
• Google Firebase: analytics, crash diagnostics, performance monitoring, and optional notifications.

Providers process only the data needed for their function under their terms and our service arrangements. Data may be processed in countries different from yours, including the United States, using applicable contractual or legal safeguards.

6. Advertising and tracking

ShyAI does not sell personal information for money. Personalized AdMob activity may qualify as sharing for cross-context advertising under some laws. Where required, we ask for consent before a personalized request. You can reopen privacy options in the app and refuse or withdraw personalization.

Refusal results in a permitted non-personalized or limited ad, or no ad. The public website does not use advertising, analytics cookies, or cross-site tracking.

7. Retention and deletion

Active account and content data remains while your account or content is in use. Account deletion anonymizes identity, revokes sessions, clears consent and export records, blanks conversation, character, and report details, and schedules avatar deletion. Deleted personal content leaves active systems within 7 days.

A limited tombstone prevents restored backups from resurrecting erased data. Minimal audit, security, fraud-prevention, legal-hold, or transaction records may be retained longer when necessary and lawful.

See Account Deletion for in-app and external instructions.

8. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive portable personal data; withdraw consent; opt out of qualifying sale or sharing; and complain to a privacy authority.

The app provides a JSON data export and account deletion. You may also email support@dublikmax.helioho.st. We may verify the request to protect the account. We do not discriminate against users who exercise privacy rights.

9. Security

ShyAI uses encrypted transport, salted password hashing, rotating sessions, access controls, rate limits, separated environments, audit trails, and restricted operator access. No system is perfectly secure; contact us if you believe your account or data is at risk.

10. Changes and questions

We update this policy when practices, providers, product behavior, or legal requirements materially change. The version and effective date above identify the current policy. Send questions or requests to support@dublikmax.helioho.st.