Privacy Policy

1. Overview

NaughtyBot is operated from the United States. By using our service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the service.

This policy applies to all users of the NaughtyBot platform, including the website, voice chat, text chat, image generation, and administrative features.

2. Information We Collect

2.1 Account Information

We do not require your real name, email address, phone number, physical address, date of birth, or government-issued identification to create an account.

2.2 Usage and Session Data

2.3 Credit and Transaction Data

Payment card details are processed entirely by third-party payment processors. We never receive, store, or have access to your credit card number, CVV, or billing address.

2.4 Information We Do NOT Collect

• Real name, email, phone number, or physical address
• Date of birth or government ID
• Payment card numbers or billing details
• GPS or precise location data
• Device identifiers (IDFA, AAID, etc.)
• Contacts, calendar, or other device data
• Social media profiles or third-party account data

We do not use third-party analytics services (Google Analytics, Meta Pixel, etc.), advertising networks, or tracking pixels. We do not use cookies. We do not track you across other websites.

3. Voice and Audio Data

3.1 How Voice Chat Works

When you use voice chat, the following occurs:

1. Your microphone audio is captured by your browser and streamed to our server via an encrypted WebSocket connection.
2. Our server relays the audio stream to our voice AI provider (xAI) for real-time processing.
3. The AI generates a spoken response, which is streamed back to your browser.
4. Audio data exists only in transit and in volatile memory during the active session. Once the stream ends, the audio data is discarded.

3.2 Transcripts

The voice AI provider generates a text transcript of both your speech and the AI's responses. This transcript is:

• Displayed in the chat interface during your session
• Stored in our database after the session ends for the purpose of AI memory and conversation continuity
• Analyzed by AI to extract conversation summaries, emotional context, and personal facts you share (see Section 5: AI Memory)

You can clear your conversation history and stored memories at any time through the platform settings.

3.3 What the Voice Provider Receives

Our voice AI provider (xAI) receives:

• Your audio stream for speech-to-text processing
• The character's personality prompt and conversation context (including stored memories about you)
• The selected voice configuration

The voice provider does not receive your username, account ID, payment information, or any other account data. The provider processes data according to their own privacy policy.

4. Image Generation Data

4.1 What Happens When an Image Is Generated

When you request an AI-generated image (via chat, voice, or the camera button), the following data is created and stored:

4.2 External Image Processing

Image generation involves two external services:

• Image generation provider (RunPod): Receives the text prompt describing the desired image. Does not receive your username, account data, or conversation history. Returns the generated image.
• Image quality analysis (Anthropic Claude): After an image is generated, it may be sent to Anthropic's Claude Vision API for quality scoring (anatomy accuracy, image completeness). This is used to filter out low-quality or malformed images. Anthropic does not receive your username or account data.

4.3 Image Storage and Access

• Generated images are stored on our server and accessible via your account
• Images are viewable through the in-app gallery
• Administrators can view all generated images for moderation purposes
• Images may be deleted by administrators as part of content moderation

4.4 Safety Monitoring

All image generation requests are automatically scanned for prohibited content (see our Content Policy). This includes:

• Automated keyword filtering to block prohibited content categories
• Mandatory minimum age enforcement (18+) on all generated characters
• Prompt sanitization to remove potentially harmful terms

These safety measures are applied automatically and do not involve human review of your requests unless a violation is detected.

5. AI Memory System

5.1 What Gets Remembered

After each conversation, an AI system analyzes the transcript and may extract facts such as:

• Personal details you voluntarily share (first name, age, occupation, location)
• Preferences and interests you mention (hobbies, favorites, desires)
• Relationship context (relationship status, past experiences you share)
• Emotional states and moods expressed during conversation
• Boundaries or dislikes you communicate

These memories are stored as short text snippets in our database and are included in future conversation prompts so the AI can reference things you've previously discussed.

5.2 Conversation Summaries

In addition to individual facts, each conversation generates:

• A brief summary of the conversation (1-2 sentences)
• An emotional arc descriptor (e.g., "playful to intimate")
• An intensity rating (1-5 scale)
• A mood descriptor

Recent conversation summaries (up to 5) are included in the AI's context for future sessions to provide continuity.

5.3 How Memory Data Is Processed

Memory extraction is performed by Anthropic's Claude AI. The full conversation transcript is sent to Claude for analysis. Claude extracts relevant facts and returns them as structured data. The transcript is processed according to Anthropic's data handling policies.

5.4 Clearing Your Memories

You can delete all stored memories at any time through the platform's settings. This permanently removes all extracted facts and conversation summaries associated with your account. The AI will have no recollection of previous interactions after memories are cleared.

6. Third-Party Service Providers

We use the following third-party services to operate NaughtyBot. Each service receives only the minimum data necessary to perform its function.

Each third-party provider processes data according to their own privacy policies and data handling practices. We select providers that maintain industry-standard security practices, but we cannot guarantee how third parties handle data once transmitted.

6.1 We Do NOT Use

• Google Analytics or any web analytics platform
• Facebook/Meta Pixel or any social media tracking
• Advertising networks or ad exchanges
• Data brokers or data resellers
• Email marketing platforms
• Customer profiling or behavioral targeting services

7. Data Storage and Security

7.1 Where Your Data Is Stored

All user data (account information, conversations, memories, images) is stored on our dedicated server infrastructure located in the United States.

7.2 Security Measures

• Passwords: Stored as cryptographic hashes. We cannot read or recover your password. If you forget your password, you must create a new one.
• Session tokens: Generated using cryptographically secure random number generators. Tokens expire after 7 days of inactivity.
• Data in transit: All connections between your browser and our server use encrypted protocols (HTTPS/WSS). All connections to third-party APIs use HTTPS.
• Access control: Administrative access to user data is restricted to authorized platform operators only.
• Invite-only registration: New accounts require a valid invite code, limiting access to authorized users.

7.3 Browser Storage

We store the following in your browser's local storage (not cookies):

We do not use HTTP cookies, third-party cookies, or tracking cookies of any kind.

7.4 Security Limitations

No system is 100% secure. While we implement reasonable security measures, we cannot guarantee absolute protection against unauthorized access, data breaches, or other security incidents. In the event of a data breach affecting your personal information, we will notify affected users as required by applicable law.

8. Data Retention

Upon account deletion, we will permanently delete all associated personal data within 30 days, except where retention is required by law (e.g., financial transaction records may be retained for tax or legal compliance purposes).

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

9.1 Right to Access

You may request a copy of all personal data we hold about you. We will provide this in a commonly used electronic format within 30 days of your verified request.

9.2 Right to Deletion

You may request deletion of your account and all associated data. Upon receiving a verified deletion request, we will:

• Delete your user account and login credentials
• Delete all conversation transcripts and AI memories
• Delete all generated images associated with your account
• Delete all usage logs and credit transaction history (subject to legal retention requirements)

Deletion is permanent and cannot be reversed.

9.3 Right to Correction

You may request correction of inaccurate personal data. You can change your password directly through the platform. For other corrections, contact us through our support channels.

9.4 Right to Data Portability

You may request your personal data in a structured, commonly used, machine-readable format (JSON).

9.5 Right to Object

You may object to certain types of data processing. If you object to AI memory extraction, you may clear your memories at any time through the platform, and future conversations will not generate new memories if you request it.

9.6 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time by discontinuing use of the service or deleting your account.

9.7 How to Exercise Your Rights

To exercise any of these rights, contact us through the platform's support channels. We may need to verify your identity before processing your request. We will respond to all verified requests within 30 days.

10. Children's Privacy

We implement the following measures to prevent access by minors:

• Mandatory age verification gate before any content is accessible
• Invite-only registration system
• Automated content safety filters that block any content related to minors

If we discover that we have inadvertently collected personal information from a person under 18, we will immediately:

• Terminate the associated account
• Delete all personal data associated with the account
• Delete all generated content associated with the account

If you believe a minor has accessed our service, please contact us immediately so we can take appropriate action.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

11.1 Categories of Personal Information Collected

11.2 Your CCPA Rights

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Information: You may request that we limit the use of sensitive personal information (such as conversation content) to what is necessary to provide the service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

11.3 Do Not Sell or Share

NaughtyBot does not sell personal information to third parties. NaughtyBot does not share personal information with third parties for cross-context behavioral advertising purposes. We have not sold or shared personal information in the preceding 12 months.

11.4 Sensitive Personal Information

We acknowledge that conversation transcripts and AI memories may contain sensitive personal information, including information about sexual preferences and behavior. This data is used solely for the purpose of providing and personalizing the service. We do not use sensitive personal information for any purpose other than delivering the service you requested.

12. International Users

12.1 European Economic Area (EEA) and United Kingdom

If you access NaughtyBot from the EEA or UK, the following applies:

• Legal basis for processing: We process your data based on your explicit consent (provided when you create an account and agree to these terms) and legitimate interest (service delivery, security, and fraud prevention).
• Data transfers: Your data is transferred to and processed in the United States. By using the service, you explicitly consent to this transfer. We rely on your consent as the legal mechanism for international data transfers.
• GDPR rights: You have all rights described in Section 9, plus the right to lodge a complaint with your local data protection authority.
• Data Protection Officer: For GDPR-related inquiries, contact us through the platform's support channels.

12.2 Other Jurisdictions

If you access NaughtyBot from any other jurisdiction with data protection laws, you are responsible for ensuring your use of the service complies with local laws. We will honor data subject rights requests from any jurisdiction where applicable law requires it.

13. Law Enforcement and Legal Requests

We may disclose your personal information to law enforcement or other government authorities if:

• Required by a valid subpoena, court order, or other legal process
• Necessary to prevent imminent harm to any person
• Required to report suspected child exploitation (we are required by law to report any discovered CSAM to the National Center for Missing & Exploited Children)
• Necessary to protect the rights, property, or safety of NaughtyBot, our users, or the public

Where legally permissible, we will notify you if your data is requested by law enforcement.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Last updated" date at the top of this page
• We will provide notice through the platform (e.g., a banner or notification)
• For significant changes affecting how we handle sensitive data, we may require you to re-acknowledge the updated policy

Your continued use of NaughtyBot after changes take effect constitutes acceptance of the revised Privacy Policy. If you do not agree with the changes, you should discontinue use of the service and request account deletion.