This policy explains what Candor stores, who processes it, and how to delete it.

You sign in with Apple, Google, GitHub or Whop, or with a one-time code sent to your email address. We store the account identifier that provider gives us and, only when the provider confirms it is verified or you enter the code we sent to it, your email address, so that one person keeps one account and one balance. Apple private relay addresses are not used to link accounts.

We store your chats, files you attach, images and videos you generate, your credit balance and usage, and the status of any subscription. Payment card details never reach us.

Characters you create (their name, age, description and first message) and your conversations with characters are stored with your account in the same way, so they follow you to every device. To let a character remember a long conversation, we also keep short notes about it with that conversation (for example your first name or your job, if you mentioned them). The conversation menu of a character shows what they remember: you can read the notes about you and about the two of you, correct or delete any of them, erase all of them, or turn note-taking off for that conversation. They are erased with the conversation's account. Only you can see the characters you create. When a character sends you a voice note, or when you choose to listen to one of their replies, the audio is stored with your account like the images and videos you generate, and is erased with them. When you save a character, its description is checked automatically, as described under Who processes it. A portrait you have made for one of your characters is an image the app creates for you from the name, age and looks you gave: it is made, checked, stored and reviewed like any other image you ask for, and it is used as the reference when that character sends you a photo.

Unless you turn it off in Settings, the assistant keeps short notes about you, for example your first name, your work or how you like to be answered, and uses them in later conversations outside characters. Settings shows every note: you can delete any of them or all of them, or turn this off. They are erased with your account.

Notifications are off unless you turn them on. If you do, we store the push address and encryption keys your browser gives us for that device, and use them only to tell you that a character wrote to you. The notification names the character and never contains the message. Turning notifications off or signing out removes the address for that device, and it is erased with the rest of your data when you delete it.

Unless you turn it off, we keep a copy of each chat turn: your message and the earlier message it answers, the reply, messages a character sends you first, the character you were talking to if there was one, the names and types of attached files, the prompts sent to image and video tools, and the words of any voice note a character sends. Our team can also view the images and videos you attach in a chat and the ones the app creates for you. We review all of this to understand how the app is used and to improve it. They are linked to a scrambled identifier, not to your name or email.

A conversation you start as a Temporary chat is not copied to these logs, and its messages are erased from your account an hour after the last one, along with the photos and documents you attached in it; images and videos made in it stay in your library. Logs are deleted automatically after 30 days. Turn off Help improve the app in Account at any time: we stop keeping logs and erase the ones we kept, and we can no longer view your images and videos this way. Deleting your data also erases them. Logs are not used for advertising and are not sold.

Your IP address is used briefly to limit free trials per network. We store only a scrambled value that changes every day.

Apple, Google, GitHub and Whop handle sign-in under their own privacy policies. Cloudflare hosts the app, stores your data and delivers sign-in code emails. Abliteration generates text replies. Every image or video request, including recent messages in that chat, any reference images and still frames of any reference video, is checked for sexual content involving minors by Liquid AI through OpenRouter, or by Abliteration. The description of a character you create gets the same check each time you save it. When the filter at Abliteration blocks a chat message, that message and recent messages in that chat get the same check by Liquid AI through OpenRouter. When an image or video request is sexual, its reference images and frames also go to Sightengine, which estimates from each visible face whether the person is under 18. We keep a fingerprint of each such image and its result for 30 days, never the face data, so the same image is not analysed again. Every finished image and video is read by Sightengine before you can see it, and sexual ones also by Liquid AI through OpenRouter, to look for anyone who may be under 18. For a video, and for a video you attach as a reference, this uses a few still frames. Siray generates images and videos, and the replies of characters. ElevenLabs turns the words of a voice note from a character, or of a reply you choose to listen to, into speech: only those words are sent to it, not the rest of the conversation. In a voice conversation, the speech service of your browser or device (Apple or Google, depending on the device) turns your voice into text before it reaches us, so we receive the text only, and ElevenLabs reads the reply aloud: it receives the words of that reply and nothing else. We do not keep the audio of a voice conversation. Open-Meteo answers weather questions with the place you ask about. When the assistant searches the web for you, only the words it searches for are sent to OpenRouter, which runs the search with OpenAI and Exa; the rest of the conversation is not. When it opens a web page for you, that website receives a request from our server, not from your device. Whop processes payments under its own privacy policy.

Dictation uses your phone's speech recognition, which Apple or Google may process under their own terms.

If you turn notifications on, they are delivered by the push service of your browser or device (Apple, Google, Mozilla or Microsoft). We send them encrypted, so that service cannot read them.

We do not sell your data and do not show ads in the app. The iPhone and Android apps contain no third-party tracking or analytics SDKs. Our website and the web version of the app use the Google and advertising tools described under Cookies and ad measurement.

On our website and the web version of the app we use Google Tag Manager and Google Analytics, and may use advertising tags from Google, Meta, TikTok and similar ad networks. They help us count visits, learn which ads bring people to us, and measure steps such as signing up, sending a first message, starting a conversation with one of our characters (which one), creating a character of your own (only that you did, never its name or description), opening the plans, starting a checkout and completing a purchase with its amount.

These tools set cookies or similar identifiers and receive your IP address, browser and device details, the pages you visit and those events. They never receive the text of your messages, your files, your generated images or videos, your name or your email. Instead of your account they get the same scrambled identifier described below. When you sign up, start a checkout, a payment is confirmed (including monthly renewals) or an image or video you asked for is ready, our server may also report that step (for media, only that it was an image or a video, never what it shows or what you asked for) and its amount to Google Analytics and to Meta with that identifier (sent to Meta only in scrambled form), together with the Meta cookie identifiers, IP address and browser details from your visit, and only if your cookie choice allows ad measurement. Each provider processes this data under its own privacy policy, and it may be handled outside your country, including in the United States.

In the European Economic Area, the United Kingdom and Switzerland these cookies stay off until you accept them in the cookie banner. Elsewhere they are on unless you turn them off. You can change your choice at any time with Cookie choices on this page, or by clearing this site's cookies.

To understand and improve the app, we record how it is used: sign-ups and sign-ins, sessions, which screens you open, which model, mode and tools a reply used and whether it finished, which of our characters you talk to, when one of them writes to you first, and whether you create or talk to one of your own (never its name or what you wrote about it), whether you turn notifications on, token counts, credits spent, checkouts, purchases and subscription changes, and your country.

If you give a thumbs up or a thumbs down to a reply from a character, we count that thumb with which of our characters it was, or only that it was one of your own. We never record the reply or anything you wrote with it. The thumb itself is kept on that message in your conversation, so you see it again and can take it back.

We also count visits to our website, and the steps from it into the app (using a link that opens the app, the sign-in screen, which sign-in button you choose, and whether an account was created), without a cookie: a random number made for that visit travels in the app's address and is never linked to your account. Where cookies are allowed, as described above, one first-party cookie remembers which link, ad or campaign brought you to Candor, including the click identifier an ad platform adds to its link, and we keep that with your account when you sign up. If you tell us how you found Candor, we keep that answer with your account too.

These records never contain the text of your messages, your files, your generated images or videos, or your name or email. They carry a scrambled identifier instead of your account, are stored by Cloudflare, and are deleted automatically after about three months.

When you report a response, image or video, we keep a copy of that content with your report so it can be reviewed, even if you later delete the chat.

If you ask for sexual content involving someone under 18, or for a sexual image or video from a photo of someone who may be under 18, we refuse and keep a record of it with your account: when it happened, whether it was a chat message, image, video or character, and the result of the automatic check. The record does not contain what you wrote. If a finished image or video is blocked because someone in it may be under 18, we delete it, you are not charged, and we keep the same kind of record, with a picture of each face the check read, cut out so that nothing else shows. If your account has such a record, our team may also see the faces in pictures and videos you sent, cut out the same way after Sightengine finds them. These pictures of faces are deleted after 30 days, or when you delete your data. Our team reviews these records and can suspend the account and report illegal content to the authorities. We keep each record for one year, including if you delete your data before then.

Open Account, then Delete my data. This permanently erases your chats, conversation logs, files, generated media, credits and usage, and signs this device out.

Usage measurements described above are not tied to your name or email and expire on their own within about three months. We keep payment records required for tax and accounting, reports you sent, the child safety records described above, and one-way hashes of the sign-in identity and verified email that received the free credit, so it cannot be claimed again. Deleting your data also cancels your Whop subscription, so you are not charged again. If we cannot cancel it, nothing is deleted and we ask you to cancel it in Manage billing first.

Candor is only for adults aged 18 or over.

You can ask us to access, correct or delete your data, or object to how it is used, by emailing us. You can also complain to your local data protection authority.