Privacy Policy
Draft — pending legal review. English translation of the draft (source: 9521def); items marked [TBC] are still to be confirmed.
Heartnest Privacy Policy — private beta draft
Last updated: 2026-10-20 · Version: [TBC: v0.1]
1. Who we are (controller)
Heartnest is an AI companion chat service (friend or Romantic Partner setting, with no sexual content). It is currently in a private beta, open to adults in the United Kingdom, the United States and China. US registration is open without an invite when the invite gate is off (default); an invite may be required in other markets or when the gate is on.
- Controller: [TBC: son E's legal name / company name], address: [TBC: address]
- ICO registration number: [TBC: ZA……] (registration pending)
- Contact: support@heartnest.app
- [TBC – if needed: UK / EU representative: ……]
2. The short version
- Mia is an AI, not a person, and not a therapy or medical service.
- What you say in chat is sent to a third-party AI model provider (accessed via API), located in the United States, to generate replies. We do not use your content to train models. Contact support@heartnest.app for details of the provider's retention terms.
- Mia remembers things you have said until you clear her memories or delete your account. At any time you can ask a character in chat to forget something, clear one character's or all characters' memories, export your data to see what is stored, or delete your account.
- We do not sell your data and do not show ads.
- We use Google Analytics (usage analytics) to understand how visitors use the site (for example page views and sign-ups). Data may be processed by Google, including in the United States. We load Analytics only after you consent. [TBC: opt-out / browser controls — to be refined with counsel.]
- We don't ask for your date of birth, and we don't use your IP address to work out where you are.
3. What data we collect
| Category | What | Source |
|---|---|---|
| Account data | Email; if you sign in with Google, your Google account's unique identifier and email; internal user ID | You / Google |
| Eligibility | Your "I am 18 or older" confirmation and when you gave it; the country you chose (UK, US or China) | You |
| Consent and invite | The versions of the Terms and Privacy Policy you agreed to, and when; the invite code you used | You |
| Chat content | Messages you send and Mia's replies | You |
| Memories | Facts organised from your chats (such as your name, hobbies, recent news, people you mention), events, conversation summaries, Mia's "impressions" of you, and short verbatim snippets | Generated by our system from your chats |
| Safety records | A flag showing whether the system thinks you may be under 18; reason codes for safety events (without chat text) | Generated by the system |
| Usage records | Technical records without chat text: time, model used, latency, whether safety guards stepped in, whether crisis resources were shown | Generated by the system |
| Settings | Your friend / Romantic Partner mode choice | You |
| IP hash for rate limiting | See §5 | Your device's connection |
Sensitive information (special category data): in chat you may talk about your health and mental state, sexual orientation, sex life, religious or political views, and so on. These are special category data under the law. We process them only with your explicit consent [TBC – legal review: confirm which Art. 9 condition applies]. Our system tries not to write this kind of content into long-term memory, but this filtering can never be fully accurate, and to reply to you this content is still sent to the model provider.
Information about other people: if you talk about friends, family or children, that information is processed too. Please share only what you are comfortable with. Our system tries not to write information about your children into long-term memory.
4. Why we process your data (purposes and lawful basis)
| Purpose | Lawful basis (UK GDPR Art. 6) | Special category (Art. 9) |
|---|---|---|
| Creating and managing your account, sign-in, invite codes, 18+ and country checks | Performance of our contract with you (contract) | — |
| Generating Mia's replies | Contract | Explicit consent [TBC – legal review] |
| Long-term memory | Contract [TBC: or consent, if memory can be switched off separately] | Explicit consent [TBC – legal review] |
| Safety: detecting crisis language and showing helplines; identifying possible underage users and limiting them to friend mode; filtering inappropriate content | Legitimate interests (keeping users safe) [TBC – legal review: whether to rely on recognised legitimate interests] | Explicit consent or DPA 2018 Sch. 1 para 18 [TBC – legal review] |
| Preventing spam sign-ups and abuse (including the IP-hash rate limiting in §5) | Legitimate interests | — |
| Operational statistics without chat text (retention, how often safety guards step in, how often crisis resources are shown) | Legitimate interests | — |
| Submitting annual statistics to the California Office of Suicide Prevention (counts only, no personal information) | Legitimate interests (complying with California SB 243) | — |
We do not make fully automated decisions that have legal or similarly significant effects on you. A "possibly under 18" assessment only switches Mia to friend mode and asks you your age [TBC – legal review: confirm the relationship with Art. 22 / 22A–22D].
5. IP address
The following paragraph is owner-approved text, quoted verbatim.
Rate limiting and your IP address: To protect Heartnest from spam and abuse, we limit how many requests – such as sign-in and sign-up attempts and chat messages – can come from one connection. To do this, we briefly process a salted hash of your IP address (a scrambled value that can't be turned back into your IP). We use it only for rate limiting, keep it in memory for no more than 1 hour, and never store it in our logs, databases or your data export. We do not use your IP address to work out where you are; your country is the one you choose at sign-up.
6. Who receives your data
| Recipient | Role | Location |
|---|---|---|
| AI model service: third-party AI model provider (accessed via API) | Generating replies, organising memories, safety review | United States |
| Server hosting: [TBC: provider] | Storing and running the service | [TBC: country] |
| Email delivery: [TBC: provider] | Sending sign-in links | [TBC: country] |
| Only if you choose to sign in with Google | United States | |
| Cloudflare | Image storage and CDN (when your browser loads character images, your IP address and browser details are sent to Cloudflare) | Stored in the EU (Western Europe); delivered via Cloudflare's global network, which may include the United States |
| (Before public launch) Age verification: [TBC: provider] | Verifying that you are an adult | [TBC: country] |
We do not sell or "share" (in the California-law sense of cross-context behavioural advertising) your personal information. If the law requires it (for example, a court order), we may have to disclose data.
7. International transfers
If you are in the UK, your chat content (including any sensitive information you choose to share) will be transferred to the United States, where our third-party AI model provider (accessed via API) is located, to generate replies, organise memories and carry out safety review. For questions about this transfer, contact support@heartnest.app.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and consent records | Until you delete your account [TBC: plus any period required by law] [TBC – legal review] |
| Memories (facts, events, summaries, impressions) | Until you clear them or delete your account. If you ask a character to forget something, the memories built from it are deleted (see §9). |
| Chat history | Until you delete your account. Clearing memories does not delete chat history. If you ask a character to forget something, the parts of your chat history that mention it are replaced with "[forgotten]". Often this is the whole message, and the character's reply right after it may be replaced too. |
| Verbatim snippets | 90 days |
| Forget records: when you ask a character to forget something, we keep a record so it isn't learned again. It contains what you said when you asked, the text of the memories that were deleted (up to 500 characters), and the topic word or name. It is never used in replies and is not included in your export. | 180 days, then deleted automatically. Clearing memories (in Settings or by telling a character to delete everything) does not remove it; within those 180 days only deleting your account does. |
| Forgotten words: the word or name you asked a character to forget, kept so we can hide it in replies and in your export | Until you delete your account (clearing memories does not delete it) |
| Chat service records of each turn (no use in replies) | 90 days, or until you delete your account. When you ask a character to forget a topic, these records may still contain what you said about it until they expire; reply drafts that contain the forgotten word are replaced with "[forgotten]". |
| Turns that failed to be saved to memory | For turns that failed to be saved to memory, the chat text is kept until you delete your account. Asking a character to forget something does not remove it from these records. |
| Audit records of memory changes | 365 days. When a memory is forgotten, cleared or deleted, its text in these records is replaced with "[forgotten]". |
| Possible-underage flag, safety logs | Until you delete your account ("delete all memories" does not delete them, so that safety protections stay in effect) |
| Usage records without chat text | 90 days |
| Safety events without chat text | 365 days (deleted immediately when you delete your account) |
| Application logs (no chat text, no IP) | 30 days |
| Backups | We keep database backups. They may still contain data you have deleted, cleared or asked a character to forget, including from before you made that request. We have not yet set a fixed period for keeping backups; we will update this policy when we do. |
| Data at the third-party AI model provider (United States) | Our AI model provider processes chat content to generate replies, organise memories and carry out safety review; contact support@heartnest.app for details of its retention terms. |
| IP hash for rate limiting | See §5 |
9. Your rights
If you are in the UK, under the UK GDPR you have the right to: access your data; receive a portable copy (portability); have it corrected (rectification); have it deleted (erasure); restrict processing (restriction); object to processing based on legitimate interests (objection); and withdraw consent at any time (withdrawal does not affect the lawfulness of earlier processing).
In Heartnest you can directly:
- Export: Settings → Export my data (JSON)
- Correct: tell the character in chat "No, actually it's …"; you can change your country in Settings.
- Ask a character to forget something: say "forget …" in that character's chat. If the topic is clear, or you say "forget everything about …", it is forgotten in the same turn. If you only give a person's name, the character first checks that you want that person forgotten. If nothing or more than one thing matches, the character asks which one you mean. Once forgotten, the character stops using it, and the memories built from it (facts, events and related snippets) are deleted. Conversation summaries and the character's impression of you that mention it stop being used straight away and are rewritten in the background. In your chat history and export, the parts that mention it are replaced with "[forgotten]". Often this is the whole message, and the character's reply right after it may be replaced too. Some information is kept: to stop it being learned again, we keep a forget record (what you said when you asked, the deleted memory text and the topic word or name) for up to 180 days, and the forgotten word until you delete your account. Our chat service's records of each turn may still contain what you said about the topic for up to 90 days; for turns that failed to be saved to memory, the chat text is kept until you delete your account; and our backups may still contain it (see §8). Clearing memories does not remove these. Forgetting only affects that character and is not the same as deleting your data: to delete everything we hold, delete your account.
- Delete: clear one character's memories or all characters' memories (this deletes the memories; your chat history and account stay); delete your account (this deletes your account, your chat history, your memories and all data about you in the chat service; deletion is completed in the background).
For other requests, email support@heartnest.app. We will reply within one month (this can be extended where the law allows).
Complaints: please contact us first; we will acknowledge and handle your complaint. You also have the right to complain to the UK Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/
US users: we probably do not currently meet the thresholds for the California Consumer Privacy Act (CCPA/CPRA) [TBC – legal review], but we offer the access, deletion and export features above to all users.
10. Security
Encryption in transit (HTTPS); [TBC – not yet implemented: encryption at rest for databases and backups]; authentication between services; logs do not record chat text; internal user IDs are hashed in logs; only [TBC: son E] can access production systems. No system is perfectly secure. If a data breach is likely to put you at high risk, we will notify you and the ICO as the law requires.
11. Age
Heartnest is only for people 18 and over. If we find that an account belongs to someone under 18, we will [TBC – owner decision: close the account and delete its data]. If you think a minor is using Heartnest, please contact us.
12. Crisis and safety
If you express thoughts of suicide or self-harm in chat, Mia shows helpline information (UK: Samaritans 116 123; US: 988; China: 12356 / 110 / 120 — pending lawyer review). To detect this kind of message, our system automatically analyses message content. See the Crisis Protocol page for details.
13. Changes
If we make important changes to this notice, we will let you know in Heartnest.