隐私政策

About This Policy

Shadow Lives (影子人生, the "App") is developed and operated by TBD: legal entity name, place of registration, and mailing address (Section 14 refers back to this) ("we", "us"). This policy explains what information we collect, why, who processes it, how long we keep it, and what control you have over it.

The App is a work of interactive fiction: every "resident" in it is an AI-generated fictional character. So that residents can remember you and keep "living" while you are away, the App stores your conversations with residents, and the memories derived from them, on our servers. Please read this section and Sections 2 and 8 before you start.

This policy applies together with our Terms of Use.

What We Collect

A. Account information

• The App supports Google Sign-In only. At sign-in we verify your identity token with Google and store the verified email address it contains — this is the only identity attribute we use for your account.
• We do not store your Google password, and we do not store your Google name, profile picture, or profile details.
• We store session records to keep you signed in.

B. Content you provide in the App

• Conversations with residents: every message you send (text, image references, timestamps).
• Answers during onboarding: the choices and conversation you give when forming a first relationship.
• Birth details entered in the "parallel life" entry point — collected only if you choose that entry point:
  • What is collected: date of birth (required); place of birth and the city you grew up in (required, free text at city level — no country / province / district field and no coordinates); gender (optional); time of birth (optional). The same form also collects the education, occupation, and family circumstances you enter, the life "branch point" you pick, your answers to a set of situational questions, and an optional free-text passage you may paste in about yourself.
  • What it is used for: to generate a fictional "parallel life" — who another version of you might have become had you chosen differently. The year of birth sets the story's era and the historical openings that genuinely existed then; the city you grew up in sets its regional backdrop; the day of birth is used only to compute an age; the month of birth is turned only into a seasonal turn of phrase; gender is used only to pick the character's pronoun. The time of birth is not used in any computation today.
  • No real-world prediction: this is not fortune telling, and it offers no prediction of or advice about your actual life. The generation rules explicitly forbid wording like "destined" or "bound to happen", forbid any mention of disaster, lifespan, or illness, and give no investment, property, or career advice.
  • Raw birth details are not stored: we do not keep the date of birth, time of birth, or place of birth you enter. They exist only in memory while your request is being processed and are gone when it ends. What we do keep are the derived results: the age computed from your date of birth, the pronoun mapped from gender, and the fictional character and storyline that come out of it. That derived data is deleted along with your account (see Section 8).
  • What leaves our servers: to generate the story, your year of birth, place of birth, city of upbringing, and any text you paste in are sent as part of the prompt to a model provider (DeepSeek by default — see Section 4).
  • The city of upbringing you enter appears in our server-side operational logs.
  • For California residents: date of birth and gender may qualify as sensitive personal information under the CPRA. We use them only for the generation purposes above. We do not sell or share them, and we do not use them for advertising or profiling. See Section 9.
• Feed interactions: your likes and comments on residents' posts.
• What you write into the world: free-text you contribute to the world (such as event prompts).
• "Familiar faces" you describe: the text you write about people you remember from real life, the familiarity you assign, and the real-world place you anchor them to. This may contain information about third parties — please avoid identifying details, as required by Section 7 of the Terms of Use. This content is visible only to you by default; cross-user visibility is currently switched off.
• Photos you upload: used only to turn an old photo into a pixel-art avatar. The App reads the single image you pick through the system photo picker and does not obtain access to your photo library. The original photo is never stored on our servers — it is downscaled in memory, sent to the image model, and only the resulting pixel-art image is kept.

C. Data derived from your content

So that a resident can remember you, we automatically generate and store:

• Memories: objective facts extracted from conversation, plus the resident's subjective reading of them;
• A memory index: facts about you, relationship milestones, and commitments made between you and a resident;
• Relationship state: familiarity, relationship stage, and milestone events;
• Vector embeddings of memory text, so a resident can recall relevant things at the right moment;
• Resident-side state: a resident's mood, needs, and life events — the state of a fictional character, but driven by interaction with you.

D. Settings and preferences

Experience language, notification toggle, push hour and timezone, the "reality overlap" toggle, visual style, and image quality tier.

E. Location

Collected only if you actively enable "reality overlap". See Section 5 — it matters, please read it.

F. Device and technical information

• Push token: if you allow notifications, we store your Apple Push Notification service (APNs) device token in order to deliver them.
• Server logs: for troubleshooting and security our servers record request metadata (time, endpoint, errors, and similar). Our application code does not record your IP address and does not record coordinates, and access logging is not enabled at the reverse-proxy layer. Logs are emitted to standard output and collected by the hosting platform; we do not currently set a fixed retention period for them.
• Generation debug snapshots: to diagnose generation quality, the system temporarily stores the full prompt and raw model output for a generation, which may include your message content. These snapshots are automatically cleared after 14 days (the base record kept afterwards contains no message content).

G. What we do not collect

• ❌ No third-party analytics, advertising, or crash-reporting SDKs (no Firebase / Crashlytics / Sentry / Amplitude / Mixpanel, and so on).
• ❌ No advertising identifier (IDFA), no ad tracking, no cross-app tracking.
• ❌ No access to your contacts, camera, microphone, or health data.
• ❌ No payment information (the App currently has no paid content).

How We Use This Information

• To provide the core experience: generate residents' replies, proactive messages, posts, and images; let a resident remember you and continue a relationship with you.
• To keep the world continuous: residents go on living according to their own persona and existing memories even while you are away.
• To deliver notifications: push a resident's proactive messages to you (see Section 6).
• For safety and moderation: automatically detect and block violating content; trigger a safety response on wording associated with self-harm or crisis (see Section 6 of the Terms of Use); handle reports and abuse.
• For troubleshooting and quality: diagnose generation failures, evaluate output quality, and tune prompts and parameters. We do not carry out routine human content review — nobody reads your conversations with residents as a matter of course. Internal quality tuning is based on aggregate signals and automated evaluation (programmatic metrics plus model-scored assessments), not on reading messages one by one. The App does include a debug export tool, but it only exports the conversation context of your own relationship and cannot be used to read anyone else's conversations; the admin backend has no endpoint that reads user conversations at all. The only human review queue is for reported "familiar face" character cards, and it contains neither the reporter's identity nor any chat content. Retained item: if we ever introduce human spot-checking in any form — even small-sample or de-identified — this section must be updated first to state the scope, whether the data is de-identified, and whether users can opt out.
• To meet legal obligations: retain or disclose information where the law requires it.

Where the GDPR applies, our legal bases for the purposes above are: providing the core experience and keeping the world continuous — performance of a contract; delivering notifications and location features such as "reality overlap" — your consent, which you may withdraw at any time; safety and moderation, troubleshooting, and quality improvement — legitimate interests in keeping the service safe and available; retaining or disclosing information where required — legal obligation. Whether the App is offered to EU / UK users is addressed in Section 9.

Who Processes Your Data

• Model providers' data terms. The following reflects each provider's public terms as we read them on 2026-08-02. Those terms can change, and the provider's current terms govern.
  • DeepSeek (default provider for conversation generation): its Privacy Policy (last updated 2026-02-10) states that DeepSeek "directly collect[s], process[es] and store[s] your Personal Data in People's Republic of China", and lists "to improve and develop the Services and to train and improve our technology, such as our machine learning models and algorithms" among its purposes; the same policy states that users have the right to opt out of the use of their personal data for training models or optimizing technologies. Its Open Platform Terms of Service (released 2026-04-22, effective 2026-04-29) assign rights in Outputs to the caller, but do not separately carve API input out of training use and do not publish a retention period for input. So please understand: your conversations with residents are sent to DeepSeek, and under its current public terms that content may be used to improve its models and is processed and stored in mainland China.
  • Google (AI Studio / Gemini API): its Gemini API Additional Terms of Service (effective 2026-03-23) treat the free and paid tiers differently. This App uses the paid tier, for which the terms state that "Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products", and that "Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy". The free-tier terms, by contrast, allow Google to use submitted content to improve its products, and state that "human reviewers may read, annotate, and process your API input and output". The paid-tier protections above hold only for as long as we keep billing enabled on that API.
  • fal.ai (text-to-image): per its official documentation "Data Retention & Storage", request inputs and outputs (the JSON data) are stored on their platform for 30 days by default to power the request history in their dashboard, and that storage can be switched off with the request header "X-Fal-Store-IO: 0". We do not currently set that header, so the image prompts (scene description text) we send to fal are subject to the 30-day default. We do not send fal the photos you upload, and we do not send it your message text. TBD — needs pinning down: fal's Terms of Service contain a broadly drafted "Usage Data" clause, and their public terms do not clearly exclude standard-tier inputs and outputs from the development of their AI models (the "never trains on your data" commitment appears in their enterprise-facing material). Before launch, get written confirmation from fal about training use on the standard tier, and consider setting "X-Fal-Store-IO: 0" by default.
• Accessibility of generated images: generated images live on our own servers, addressed by content hash, served over links that are unguessable but require no sign-in. Anyone who knows the exact link can open the image, and the links do not expire.
• Amap: the codebase retains the Amap place service for mainland-China cities (Beijing, Shanghai, Guangzhou, Shenzhen). No Amap API key is configured in production, so the service is not called today. If it is enabled later, place lookups for those cities would be handled by Amap; those lookups contain place names and coordinates, not your personal information.
• Apart from these providers, we disclose information only: where required by law or a competent authority; to protect someone's physical safety; to investigate violations and abuse; and in connection with a merger or transfer of assets (we will give notice if that happens).

Location ("Reality Overlap")

• Permission scope: we request "while using the app" location only. We never request "always", and the App does not obtain your location in the background.
• Accuracy: the client requests roughly 100-metre accuracy with a minimum-distance threshold. There is no fine-grained tracking.
• Nothing is kept on your phone: the App holds only the latest coordinate in memory. It is never written to local storage or files, and latitude/longitude never appears in logs. It disappears when the App closes.
• No coordinates are stored on our servers: coordinates sent to us are used for two immediate checks — whether you are within the bounds of a resident's city, and whether you are near one of their meaningful places (within about 100 metres). The coordinates are discarded right after that check; our database stores no latitude or longitude.
• What is retained: the start / last-active / end timestamps and status of an overlap session; the city place (POI) an unlock is tied to and the content unlocked; and the city-level fact that you and a resident were in the same city.
• Withdrawing: switch "reality overlap" off in settings at any time, or revoke the location permission in iOS Settings.

Push Notifications

• This is a deliberate design choice: the notification is the line they said. If you would rather that content not appear on your lock screen, set this App's notification previews to "When Unlocked" or "Never" in iOS Settings, or turn off proactive messages in the App.
• We request notification permission only after you have formed a first relationship. You can turn notifications off in the App or in system settings at any time.
• Notifications are delivered through Apple's Push Notification service, so the notification body passes through Apple's servers.
• You can choose the hours and timezone in which you would like to receive proactive messages, and proactive messages are subject to frequency caps.

What We Will Not Do

• We do not sell your personal information (including "sale" and "sharing" as defined under California law).
• No advertising: we run no ads, do no profiling for ad targeting, do no cross-app tracking, and integrate no ad SDKs.
• We do not make your conversations public, and we do not share your conversations or memories between users.
• We do not give your data to data brokers.

Retention and Deletion

How long we keep things

• Account and conversations: kept until you delete them. Memories have no automatic expiry — over time they become harder for a resident to recall, but they are not deleted automatically.
• Generation debug snapshots (which may contain message content): cleared automatically after 14 days by a daily job (what is cleared is the snapshot itself; the base record, which holds no message content, remains).
• Daily state snapshots: the configured retention is 90 days, but that cleanup job is not yet running automatically, so they may in practice be kept longer; they are deleted along with your account or the related relationship data. Milestone snapshots are kept long-term.
• Sign-in sessions: expire 90 days after issue and can no longer be used once expired; signing out deletes that session record immediately. Expired session rows are not yet physically purged on a schedule, but they are deleted along with your account.
• Location coordinates: not retained (see Section 5).
• Database backups: at most the 14 most recent database dumps are kept, and deleted data ages out with that rotation.

What you can delete

Under Settings › Privacy in the App:

• Delete conversation history — a real, irreversible deletion.
• Delete memories — a real, irreversible deletion.
• End this relationship — opens a farewell period (cancellable); afterwards that resident no longer appears, but the associated story and memory data remains in your account, and a cooldown applies.
• Sign out — deletes that sign-in session immediately.

Deleting your account

In the App: the "us" tab → the gear icon in the top right → Settings → Delete account, confirmed with a three-second press and hold. Letting go before it completes cancels.

What is deleted: your account and verified email; every sign-in session and your push device token; all of your residents and their personas; every message between you and them, proactive messages included; all memories, the memory index, vector embeddings, and relationship state; residents' moods, needs, schedules, and life events; residents' posts, footprint pieces, and generated-image records; your likes and comments; the "familiar faces" you described; your reality-overlap sessions and unlocks; your onboarding and creation conversation records, including everything derived from the "parallel life" flow; and your background job records.

About "familiar face" residents: a familiar-face resident witnessed only by you is deleted along with your account. If the same resident was also described by another user, they remain in the world, but your own record of them is deleted.

What may still remain afterwards — stated plainly:

• The image files themselves: the database references are deleted, but the generated image files in storage are not removed at the same time. Those files are addressed by content hash and readable without signing in (see Section 4).
• Copies in database backups: kept in at most the 14 most recent dumps, ageing out with the backup rotation.
• One operational log line recording that the deletion happened. It contains the account's internal identifier, not your email address.
• Content already sent to model providers: governed by each provider's own retention terms (see Section 4). Deleting your account does not trigger deletion on their side.

Data export: there is no one-tap self-service export today. You can request a copy by writing to the address in Section 14; we handle these manually and will reply within the window stated in Section 9.

Beyond that, we may retain limited records for a limited time where the law requires it, or to handle disputes and abuse.

Your Rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct inaccurate information, delete your information, obtain a copy / port your data, object to or restrict certain processing, and withdraw consent (for example by turning off reality overlap or notifications).

To exercise these rights, contact us at teveillan@gmail.com. We will respond within 30 days and may need to verify your identity (usually via the email address on your account). We will not discriminate against you for exercising your rights.

California residents (CCPA / CPRA)

• The categories of personal information we collect are in Section 2; our purposes are in Section 3; disclosures to service providers are in Section 4.
• We do not sell your personal information and do not share it for cross-context behavioural advertising, and have not done so in the preceding 12 months.
• You have the right to know, access, correct, and delete, and to limit the use of sensitive personal information. There is only one place we may collect sensitive personal information: if you choose the "parallel life" entry point, that form collects your date of birth and gender (gender being optional). They are used solely to generate the fictional parallel-life narrative described in Section 2B, the raw values are not stored, and we neither sell nor share them nor use them for advertising or profiling — so there is no secondary use for you to limit. Deleting your account erases everything derived from them.
• You may use an authorized agent to submit a request.

EU / UK users

TBD — confirm whether the App is offered to EU / UK users. If so, add the controller's identity and address, an EU representative and DPO where applicable, the route to complain to a supervisory authority, and the transfer mechanism (SCCs, etc.); the legal bases per purpose are already stated at the end of Section 3. If the EU / UK are out of scope, state the service's geographic scope here.

Security

• All traffic to and from our servers is encrypted with HTTPS/TLS.
• API access requires a valid session, and sessions can be revoked at any time by signing out.
• We limit internal access to production data.
• We do not store your location coordinates on our servers, and we do not store the original photos you upload (see Sections 2 and 5).

This page makes no specific commitment about encryption at rest, backup encryption and location, internal access auditing, or the breach-notification process and deadline. Those are operational matters still to be settled, and they are listed under open items.

No system can be perfectly secure. Please protect your Google account — it is the only key to yours.

International Transfers

Our providers operate in different countries, so your information — including your message content — may be transferred and processed outside where you live, in places whose data protection laws differ from your own.

Per each provider's public terms as of 2026-08-02: DeepSeek collects, processes, and stores data in the People's Republic of China; Google and fal.ai process data in the United States and on their global infrastructure; notifications are delivered over Apple's global infrastructure. In practical terms: if you are outside mainland China, your conversations with residents are still transferred there for processing.

TBD: the region our own servers are hosted in, and (if EU / UK users are in scope) the cross-border transfer mechanism relied on, such as SCCs.

Children and Age

• The App is intended for people aged 16 and over and is planned for release on the App Store with a 17+ rating. The final rating must match what is entered in App Store Connect and Section 2 of the Terms of Use — see open items.
• We do not knowingly collect personal information from anyone under 16. The age restriction is enforced through the App Store rating.
• If you believe someone under 16 has given us personal information, tell us at teveillan@gmail.com and we will verify and delete it.

Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page, and for material changes — such as a new category of data or a new purpose — we will give advance notice in the App or by email.

Contact

Questions about this policy, or to exercise your data rights: teveillan@gmail.comBefore launch, switch to a domain address (for example privacy@ your own domain); a personal Gmail address is not a suitable long-term legal contact.

Operating entity and mailing address: see Section 1 (to be completed).

Open Items Still to Be Decided

Everything else on this page has been checked line by line against the implementation and against each provider's public terms. Below is what remains undecided, grouped by who decides. Delete this section when the page is finalized.

A. For counsel / the operating entity

• Top of page · effective date.
• Section 1 · legal entity name, place of registration, and mailing address (Section 14 refers back to this).
• Section 9 · whether the App is offered to EU / UK users; if so, add controller details, EU representative / DPO, and the complaints route.
• Section 11 · the region our own servers are hosted in, and the cross-border transfer mechanism (SCCs, etc.).
• Section 14 · whether the public contact email moves to a domain address.

B. To confirm in writing with a provider

• Section 4 · whether fal.ai uses standard-tier inputs and outputs to develop its AI models, and whether to set "X-Fal-Store-IO: 0" by default.

C. For the founder to establish or decide (no commitment is made on this page)

• Section 10 · encryption at rest, backup encryption and location, internal access auditing, and the breach-notification process and deadline.
• Section 12 · the final App Store age rating (must match App Store Connect and Section 2 of the Terms).
• Section 3 · if human spot-checking is ever introduced in any form, this section must be updated before it ships.

D. Disclosed truthfully here, but worth fixing before launch

• Section 8 · deleting an account does not remove the generated image files from storage (only the database references).
• Section 4 · generated-image links require no sign-in and never expire.
• Section 8 · the 90-day cleanup job for daily state snapshots is not yet running automatically.
• Section 2 · the "parallel life" form invites users to enter a time of birth by suggesting it makes the reading sharper, while that field is not used in any computation — the prompt copy should be corrected before launch.