Effective Date: 2026-09-18 Version: 1.4.1
Soulio is operated by Everly AI Limited ("Soulio," "we," "us," "our"), which is the controller of the personal information described in this Policy. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Soulio application ("App"). Please read this policy carefully. By using the App, you consent to the practices described herein.
This App is intended for users 18 years of age and older. We do not knowingly collect personal information from individuals under 18.
| Type | Details |
|---|---|
| Account information | Username (nickname), profile avatar, bio |
| Authentication data | Apple ID identifier, Google ID identifier, or email address (depending on sign-in method) |
| User content | Posts (text and images), comments, direct messages |
| World choices | The World you enter, the character you take part as, and the goals you select |
| Purchase data | Coin and Action pack purchase records, Soulio Pro subscription records (no payment card details — see § 2.4) |
| Communication | Feedback, customer support inquiries, and emails you send to us |
| Language settings | Your selected app language |
| Type | Details |
|---|---|
| Device information | Device type, OS, unique device identifier, screen size, locale |
| Log data | IP address, access time, pages/features visited, crash reports |
| Usage data | Features used, Worlds entered, AI characters followed, unlocked, or blocked, posts liked/commented on, interaction patterns, DM activity |
| World progress | Day count, goal, milestones, experience points, level, skills, relationship stages, and unlocked characters for each World, used to operate the World and display your progress (see § 2.8) |
| Subscription status | Soulio Pro subscription state (active / inactive / trial), used for serving the appropriate experience |
| Coin and Action balances | Current Coin balance and Action balances (free, Pro, purchased), used for displaying in-App balances and gating Action-consuming features |
| Location (approximate) | IP-based country/region detection (used for content localization and World/character ordering) |
(Note: subscription status, Coin balance, and Action balance are also sent as event properties to our analytics provider PostHog — see § 5.1.)
When you sign in with Apple or Google, we receive the following data:
| Field | Purpose |
|---|---|
| Stable user identifier provided by Apple | Linking your Soulio account to your Apple ID across logins |
| Email address (real or Hide My Email relay) | Account creation, security notifications |
| Full name | Pre-filling your initial Soulio profile name (provided only on first sign-in by Apple) |
When you choose Hide My Email, Apple provides us a unique relay address ending in @privaterelay.appleid.com. Soulio emails sent to that address are forwarded by Apple to your real Apple ID email; we never receive your real address.
| Field | Purpose |
|---|---|
| Stable user identifier provided by Google | Linking your Soulio account to your Google account |
| Email address | Account creation, security notifications, account recovery |
| Email verification status | Anti-fraud signal |
| Display name | Pre-filling your initial Soulio profile name |
| Profile picture URL | Pre-filling your initial Soulio avatar |
| Locale (optional) | Defaulting your initial language preference |
We do NOT request access to: Gmail messages, Google Drive files, Google Calendar, Apple iCloud data, contacts, photos, search history, location history, or any data outside the standard email address and basic profile information shared during sign-in.
Data from Providers is used solely to create, secure, and operate your Soulio account. We do not sell or trade this data, and we do not use it to train generative AI models.
When you sign in with Email (passwordless verification via 6-digit code), we collect the following:
| Field | Purpose |
|---|---|
| Email address | Account creation, authentication, security notifications, account recovery |
| Verification code | A 6-digit code is temporarily generated and sent to your inbox. The code is stored in encrypted in-memory cache (Redis) for 10 minutes maximum and is deleted immediately after successful verification or expiration. Codes are never persisted in our long-term database. |
| Email send logs | We log metadata about verification email delivery (timestamp, status, recipient domain) for service reliability and abuse prevention. We do not log email content or codes. |
Email delivery is handled by a third-party transactional email service (e.g., SendGrid, Postmark, or AWS SES). The provider receives your email address solely for the purpose of delivering verification codes and operates under a strict data processing agreement. The provider does not use your email address for marketing or share it with third parties.
We do not store passwords because Soulio uses passwordless email verification — there is no password to compromise.
When you make in-app purchases:
We use third-party content moderation APIs. Content submitted for moderation may be processed in accordance with the respective third party's privacy policy.
We use a mobile attribution service to measure the effectiveness of our marketing and to detect install fraud.
| Data Type | Examples | Purpose |
|---|---|---|
| Advertising identifiers | iOS IDFA (when ATT consent granted), Android Advertising ID (GAID) | Attributing installs to advertising campaigns |
| Network identifiers | IP address (truncated for storage) | Install attribution, fraud prevention |
| Install and event metadata | Install timestamps, first-launch events, signup events, purchase events | Campaign performance measurement |
Service provider: This data is processed on our behalf by Adjust GmbH (Saarbrücker Str. 37A, 10405 Berlin, Germany), acting as a data processor under a Data Processing Agreement.
iOS — App Tracking Transparency
On iOS 14.5 and later, Apple's App Tracking Transparency (ATT) framework requires your explicit consent before we may collect your IDFA. You will see a system prompt asking whether you allow Soulio to track activity across apps and websites.
You may change your ATT preference at any time in iOS Settings → Privacy & Security → Tracking → Soulio.
Android — Advertising ID
Android Advertising ID (GAID) is governed by Google Play Services and your device settings. You may:
Regional consent requirements
To make conversations with an AI character feel more consistent, the App may store a long-term memory — salient details derived from your direct message conversation (for example, names, preferences, or facts you mention).
Scope: Long-term memory is limited to the individual conversation. It does not carry over to other conversations, to other AI characters, or across accounts.
Storage and retention: Memory is stored on Soulio's systems and associated with that specific conversation. It does not expire on its own and persists for as long as the conversation exists.
How to remove it: There is no in-app screen for viewing stored memory. To remove what an AI character has remembered, delete the direct message conversation — this permanently deletes the associated long-term memory together with the message history. Deleting your account removes all memory data. See § 8 for your right of access.
World memory: Within a World, AI characters also draw on your activity in that World — your posts, comments, reaction outcomes, milestones, and relationship stages — so that their posts and replies stay consistent with the story. This information is stored as part of your World progress (§ 2.8), is limited to that World save, and is deleted together with the World save or your account.
When you enter and take part in a World (Terms § 4.5), we collect and process:
| Data Type | Purpose |
|---|---|
| World and character selection | Setting up the World for your account |
| Progress data (day count, goal, milestones, experience points, level, skills, relationship stages, unlocked characters) | Operating the World and displaying your progress |
| Your in-World content (posts, comments, direct messages) | Generating AI Character reactions and story events |
| AI-generated World content (AI Character posts, comments, reaction summaries, story events) | Displaying the World to you |
| Action ledger (free, Pro, and purchased balances; consumption records) | Operating the Action system (Terms § 6.3) |
| Block list (per World) | Keeping AI Characters you blocked out of that World |
How it is processed: Your in-World content and relevant progress data are sent to our LLM API providers (§ 5.1) transiently to generate AI Character reactions, next-day content, story events, and optional post suggestions. The results are stored with your World.
Visibility: World content and progress are visible only to you. They are not shown to other users.
Retention: World data is retained until you delete the World save from your World list or delete your account (§ 6).
Characters from earlier versions: If you created AI Characters in an earlier version of Soulio, their settings (profile, persona, appearance settings, and any reference image you uploaded) continue to be stored and processed to operate those characters in your Origin World, and are deleted with your account. Other users' conversations with a character you created are not accessible to you, and your identity as its creator is not displayed to other users.
| Purpose | Legal Basis |
|---|---|
| Provide and operate the App | Contract performance |
| Personalize the World lobby and feeds | Legitimate interests / Consent |
| Enable AI character automated interactions | Contract performance |
| Operate Worlds (track progress, generate AI Character reactions and story events, suggest post drafts) | Contract performance |
| Process in-app purchases and maintain Coin and Action balances | Contract performance |
| Provide direct messaging services within Worlds | Contract performance |
| Content safety moderation | Legal obligation / Legitimate interests |
| Send notifications | Consent |
| Analyze usage for app improvement | Legitimate interests |
| Enforce Terms of Use and policies | Legitimate interests / Legal obligation |
| Comply with legal obligations | Legal obligation |
| Customer support and communication | Contract performance |
| Account recovery and security | Contract performance / Legitimate interests |
Your trust is our priority. We do not use your personal text inputs, uploaded photos, direct messages, or your interaction content with AI characters to train our underlying large language models (LLMs) or third-party AI systems. Your data is processed solely to generate real-time responses and personalize your current feed experience.
You understand and agree that:
We do not sell your personal information. We may share information in the following circumstances:
We use the following named third-party service providers. All are contractually bound by Data Processing Agreements (DPAs) and may only process data on our instructions.
| Provider | Location | Purpose | Data Categories Shared |
|---|---|---|---|
| Adjust GmbH | Germany (EU) | Mobile attribution, install fraud prevention | Advertising IDs, IP, install/event metadata |
| PostHog Inc. | United States | Product analytics, A/B testing | Pseudonymized user ID, event names, event properties (including subscription status, Coin balance, and Action balance), session metadata |
| Firebase (Google LLC) | United States | Crash reporting, app performance monitoring, push notification delivery | Device info, crash logs, push tokens |
| Cloud hosting providers | (various) | Infrastructure, content storage | All operational data |
| LLM API providers | (various) | AI character text generation, content moderation | Direct message content, post and comment content, World progress and story context (transient processing) |
| Image generation API provider | (various) | AI-generated character and post images | Generation parameters (transient processing) |
| Transactional email service | (e.g., SendGrid, SES) | Verification code delivery | Email address (transient) |
| Push notification platforms | Apple (APNs), Google (FCM) | Notification delivery | Device push tokens |
Notes on specific providers:
International transfers: When we transfer your data outside your country of residence (e.g., EU users' data to US-based providers), we rely on appropriate safeguards including standard contractual clauses (SCCs), adequacy decisions, and supplementary measures as required by applicable law.
We may disclose your information when required by law, court order, or governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of Soulio, our users, or the public.
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, subject to this Privacy Policy.
We may share your information for other purposes with your explicit consent.
We retain your personal data only as long as necessary to provide Soulio and for the limited additional periods described below:
| Data Category | Retention Period |
|---|---|
| Account profile (name, avatar, email, Provider link) | For the lifetime of your active account |
| Authentication tokens (refresh tokens, session records) | Up to 60 days after last use |
| Email verification codes | Redis cache, 10 minutes maximum; deleted on use or expiration |
| Email send logs (metadata only) | 12 months |
| User-generated content (posts, comments, including inside Worlds) | Until you delete it or your account |
| Direct message content | Until you delete it or your account; LLM context window: last 20 messages |
| Long-term memory data (conversation-scoped) | Until you delete the conversation or your account; does not expire on its own |
| World progress data (day count, goal, milestones, experience points, level, skills, relationship stages, unlocked characters) | Until you delete the World save or your account |
| AI-generated World content (AI Character posts, comments, reaction summaries, story events) | Same as World progress data |
| Action balances and Action transaction history | For the lifetime of your active account |
| Block list (per World) | Until you unblock, delete the World save, or delete your account |
| Character settings from earlier versions (profile, persona, reference image) | For the lifetime of your active account |
| Coin and Action pack purchase records | 7 years (tax/financial compliance) |
| Coin balance & transaction history | For the lifetime of your active account |
| Security audit logs (sign-ins, sign-in failures, revocations) | 12 months |
| Content moderation records | Up to 24 months |
| Account-deletion confirmation records | 30 days |
| Legal compliance records | As required by applicable law |
| Soulio Pro subscription records (transaction ID, plan, renewal events) | 7 years (tax/financial compliance) |
| Soulio Pro subscription state (active/inactive) | For the lifetime of your active account |
| Adjust attribution data (raw events) | 12 months; aggregated data may be retained longer for statistical purposes |
| PostHog analytics events | 24 months at event level; aggregated indefinitely |
When you delete your Soulio account, all personally identifiable data is irreversibly deleted from our active systems within 30 days. Encrypted operational backups containing your data are purged on a rolling 90-day cycle. Aggregated, anonymized analytics that cannot be tied back to you may be retained for statistical purposes.
We may retain limited records longer where required by law (e.g., financial transaction records for tax purposes, hashed abuse records to prevent re-registration of banned accounts).
You may delete your Soulio account at any time, with full removal of your personally identifiable data.
Deletion is immediate and irreversible. You will be signed out from all devices, your data will be queued for hard deletion (completed within 30 days), and any further sign-in attempts with the same Provider account will require creating a new Soulio account.
If you cannot sign in (e.g., you revoked Provider access, lost your device), email us at support@soulio.ai from the email address associated with your account. We will verify your identity through reasonable means and complete deletion within 30 days of verification.
Upon account deletion, any Coin and Action balances are forfeited and cannot be refunded.
You have the following rights regarding your personal data, subject to your jurisdiction:
If you use Soulio in guest mode, your data is linked to an anonymous device identifier. You may permanently delete your guest data and reset your profile at any time by going to Settings → Delete Guest Data, or by uninstalling the App.
To exercise any of these rights, email support@soulio.ai. We respond to verified requests within 30 days (or as required by applicable law).
Long-term memory: The memory an AI character builds within a conversation is not viewable through a dedicated in-app screen. To remove it, delete the direct message conversation — this permanently deletes the associated memory together with the message history (see § 2.7). Deleting your account removes all memory data. Your right of access above still applies: you may request a copy of the memory data we hold about you by emailing support@soulio.ai.
World memory: The World progress and story context that AI characters draw on inside a World is stored with that World save (see § 2.7 and § 2.8) and is deleted when you delete the World save or your account. Your right of access applies: you may request a copy by emailing support@soulio.ai.
Attribution and Analytics Opt-Out
In addition to the rights above, you have the following choices regarding attribution and analytics:
Opting out of attribution and analytics does not affect your ability to use Soulio. Core App functionality (account, posts, DMs, subscription) does not depend on attribution or analytics data.
If you are located in the EU, UK, or another GDPR-covered jurisdiction:
Legal basis for processing: We process your data based on (a) your consent (for OAuth sign-in, attribution data, analytics, and optional features), (b) contract performance (operating your account, processing purchases), (c) legal obligations, and (d) legitimate interests (fraud prevention, security, service improvement).
Attribution and analytics consent: For attribution data (§ 2.6) and analytics (§ 5.1 PostHog), our legal basis is your consent, obtained via a consent banner at first launch. You may withdraw consent at any time by emailing support@soulio.ai, without affecting your ability to use core App functionality.
Right to lodge a complaint: You have the right to lodge a complaint with your national data protection authority.
International transfers: Soulio operates servers in the United States. Data transferred from the EU/UK is protected by Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
Data Protection Officer: For GDPR inquiries, contact support@soulio.ai.
To exercise any GDPR right, email support@soulio.ai. We respond within 30 days (extendable by 60 days for complex requests, with notice).
If you are a California resident:
To exercise any CCPA right, email support@soulio.ai with the subject "California Privacy Request". We respond within 45 days (extendable by 45 days with notice).
If you are located in Japan, you have rights under the Act on the Protection of Personal Information (APPI), including the right to access, correct, and delete your personal information, and to opt out of certain data processing.
If you are located in South Korea, you have rights under the Personal Information Protection Act (PIPA), including the right to access, correct, suspend processing of, and delete your personal information.
Separate consent: We obtain your separate explicit consent for the collection of attribution data (§ 2.6), analytics (§ 5.1 PostHog), and long-term memory data (§ 2.7) at first launch or when you first use the relevant feature, presented as a consent screen with itemized choices. You may withdraw consent at any time by emailing support@soulio.ai; for long-term memory, you may also remove it by deleting the relevant conversation.
Itemized consent: Consent items are presented separately and may be agreed to independently. Refusal to consent to optional items does not affect your ability to use the core App.
Overseas transfer: We do not transfer your personal information to overseas entities other than the named service providers in § 5.1, and we obtain your consent for such transfers as required by PIPA.
Privacy Officer (PIPA-required):
We honor equivalent rights for users in Brazil (LGPD), Canada (PIPEDA), and other jurisdictions where applicable. Contact support@soulio.ai with your request.
We implement industry-standard technical and organizational measures to protect your information:
No system is completely secure. We are not liable for breaches outside our reasonable control.
Soulio is intended exclusively for users 18 years of age or older. We do not knowingly collect personal data from anyone under 18.
At sign-up, you confirm you are at least 18. This is a precondition of using Soulio.
If we become aware that we have collected personal data from a person under 18, we will:
Soulio is not directed at, and does not knowingly serve, children under 13 in the United States. If you believe we have collected information from a child under 13, please contact us at support@soulio.ai for immediate review.
Parents or legal guardians who believe a minor has provided data to Soulio may contact support@soulio.ai to request immediate deletion. We respond within 7 business days.
Your information may be transferred to and processed in countries other than your country of residence. We implement appropriate safeguards for such transfers in accordance with applicable privacy laws (e.g., Standard Contractual Clauses under GDPR, where applicable).
The App may contain links to third-party websites or services (e.g., FAQ pages, support pages). This Privacy Policy does not apply to those third parties. We recommend reviewing each third party's privacy policy.
We use your IP address to detect approximate country or region, for the purposes of:
We do not use IP data to track your precise location.
We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification or email (if provided). The updated policy takes effect upon posting. We encourage you to review this policy periodically.
Controller: Everly AI Limited.
For any privacy-related question, request, complaint, or concern, contact us at support@soulio.ai. Use a clear subject line such as "Delete Account", "California Privacy Request", or "GDPR Request" for faster handling.
We acknowledge all privacy inquiries within 5 business days and resolve them within 30 days (longer where allowed by law for complex requests, always with notice).
Last updated: 2026-09-18