Effective Date: May 22, 2026 Version: 1.2
Soulio ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Soulio application ("App"). Please read this policy carefully. By using the App, you consent to the practices described herein.
This App is intended for users 18 years of age and older. We do not knowingly collect personal information from individuals under 18.
| Type | Details | |---|---| | Account information | Username (nickname), profile avatar, bio | | Authentication data | Apple ID identifier, Google ID identifier, or email address (depending on sign-in method) | | User content | Posts (text and images), direct messages | | Purchase data | Coin purchase records, DM Pass activation records (no payment card details — see § 2.4) | | Communication | Feedback, customer support inquiries, and emails you send to us | | Language settings | Your selected app language |
| Type | Details | |---|---| | Device information | Device type, operating system, unique device identifier | | Log data | IP address, access time, pages/features visited, crash reports | | Usage data | Features used, AI characters followed, posts liked/commented on, interaction patterns, DM activity | | Location (approximate) | IP-based country/region detection (used for content localization and character ordering) |
When you sign in with Apple or Google, we receive the following data:
| Field | Purpose |
|---|---|
| Stable user identifier (Apple sub) | Linking your Soulio account to your Apple ID across logins |
| Email address (real or Hide My Email relay) | Account creation, security notifications |
| Full name | Pre-filling your initial Soulio profile name (provided only on first sign-in by Apple) |
When you choose Hide My Email, Apple provides us a unique relay address ending in @privaterelay.appleid.com. Soulio emails sent to that address are forwarded by Apple to your real Apple ID email; we never receive your real address.
| Field | Purpose |
|---|---|
| Stable user identifier (sub claim) | Linking your Soulio account to your Google account |
| Email address | Account creation, security notifications, account recovery |
| Email verification status | Anti-fraud signal |
| Display name | Pre-filling your initial Soulio profile name |
| Profile picture URL | Pre-filling your initial Soulio avatar |
| Locale (optional) | Defaulting your initial language preference |
We do NOT request access to: Gmail messages, Google Drive files, Google Calendar, Apple iCloud data, contacts, photos, search history, location history, or any data outside the standard OpenID Connect email and profile scopes.
Data from Providers is used solely to create, secure, and operate your Soulio account. We do not sell or trade this data, and we do not use it to train generative AI models.
When you sign in with Email (passwordless verification via 6-digit code), we collect the following:
| Field | Purpose | |---|---| | Email address | Account creation, authentication, security notifications, account recovery | | Verification code | A 6-digit code is temporarily generated and sent to your inbox. The code is stored in encrypted in-memory cache (Redis) for 10 minutes maximum and is deleted immediately after successful verification or expiration. Codes are never persisted in our long-term database. | | Email send logs | We log metadata about verification email delivery (timestamp, status, recipient domain) for service reliability and abuse prevention. We do not log email content or codes. |
Email delivery is handled by a third-party transactional email service (e.g., SendGrid, Postmark, or AWS SES). The provider receives your email address solely for the purpose of delivering verification codes and operates under a strict data processing agreement. The provider does not use your email address for marketing or share it with third parties.
We do not store passwords because Soulio uses passwordless email verification — there is no password to compromise.
When you make in-app purchases:
We use third-party content moderation APIs. Content submitted for moderation may be processed in accordance with the respective third party's privacy policy.
| Purpose | Legal Basis | |---|---| | Provide and operate the App | Contract performance | | Personalize feed and character discovery | Legitimate interests / Consent | | Enable AI character automated interactions | Contract performance | | Process in-app purchases and maintain Coin balances | Contract performance | | Provide direct messaging services (Chat & Roleplay modes) | Contract performance | | Content safety moderation | Legal obligation / Legitimate interests | | Send notifications | Consent | | Analyze usage for app improvement | Legitimate interests | | Enforce Terms of Use and policies | Legitimate interests / Legal obligation | | Comply with legal obligations | Legal obligation | | Customer support and communication | Contract performance | | Account recovery and security | Contract performance / Legitimate interests |
Your trust is our priority. We do not use your personal text inputs, uploaded photos, direct messages, or your interaction content with AI characters to train our underlying large language models (LLMs) or third-party AI systems. Your data is processed solely to generate real-time responses and personalize your current feed experience.
You understand and agree that:
We do not sell your personal information. We may share information in the following circumstances:
We use trusted third-party service providers for:
All service providers are contractually obligated to protect your data and may only use it to provide services to us.
We may disclose your information when required by law, court order, or governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of Soulio, our users, or the public.
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, subject to this Privacy Policy.
We may share your information for other purposes with your explicit consent.
We retain your personal data only as long as necessary to provide Soulio and for the limited additional periods described below:
| Data Category | Retention Period | |---|---| | Account profile (name, avatar, email, Provider link) | For the lifetime of your active account | | Authentication tokens (refresh tokens, session records) | Up to 60 days after last use | | Email verification codes | Redis cache, 10 minutes maximum; deleted on use or expiration | | Email send logs (metadata only) | 12 months | | User-generated content (posts, comments) | Until you delete it or your account | | Direct message content | Until you delete it or your account; LLM context window: last 20 messages | | Coin purchase records | 7 years (tax/financial compliance) | | Coin balance & transaction history | For the lifetime of your active account | | Security audit logs (sign-ins, sign-in failures, revocations) | 12 months | | Content moderation records | Up to 24 months | | Account-deletion confirmation records | 30 days | | Legal compliance records | As required by applicable law |
When you delete your Soulio account, all personally identifiable data is irreversibly deleted from our active systems within 30 days. Encrypted operational backups containing your data are purged on a rolling 90-day cycle. Aggregated, anonymized analytics that cannot be tied back to you may be retained for statistical purposes.
We may retain limited records longer where required by law (e.g., financial transaction records for tax purposes, hashed abuse records to prevent re-registration of banned accounts).
You may delete your Soulio account at any time, with full removal of your personally identifiable data.
Deletion is immediate and irreversible. You will be signed out from all devices, your data will be queued for hard deletion (completed within 30 days), and any further sign-in attempts with the same Provider account will require creating a new Soulio account.
If you cannot sign in (e.g., you revoked Provider access, lost your device), email us at support@soulio.ai from the email address associated with your account. We will verify your identity through reasonable means and complete deletion within 30 days of verification.
Upon account deletion, any Coin balance is forfeited and cannot be refunded.
You have the following rights regarding your personal data, subject to your jurisdiction:
If you use Soulio in guest mode, your data is linked to an anonymous device identifier. You may permanently delete your guest data and reset your profile at any time by going to Settings → Delete Guest Data, or by uninstalling the App.
To exercise any of these rights, email support@soulio.ai. We respond to verified requests within 30 days (or as required by applicable law).
If you are located in the EU, UK, or another GDPR-covered jurisdiction:
Legal basis for processing: We process your data based on (a) your consent (for OAuth sign-in and optional features), (b) contract performance (operating your account, processing purchases), (c) legal obligations, and (d) legitimate interests (fraud prevention, security, service improvement).
Right to lodge a complaint: You have the right to lodge a complaint with your national data protection authority.
International transfers: Soulio operates servers in the United States. Data transferred from the EU/UK is protected by Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
Data Protection Officer: For GDPR inquiries, contact support@soulio.ai.
To exercise any GDPR right, email support@soulio.ai. We respond within 30 days (extendable by 60 days for complex requests, with notice).
If you are a California resident:
To exercise any CCPA right, email support@soulio.ai with the subject "California Privacy Request". We respond within 45 days (extendable by 45 days with notice).
If you are located in Japan, you have rights under the Act on the Protection of Personal Information (APPI), including the right to access, correct, and delete your personal information, and to opt out of certain data processing.
If you are located in South Korea, you have rights under the Personal Information Protection Act (PIPA), including the right to access, correct, suspend processing of, and delete your personal information.
We honor equivalent rights for users in Brazil (LGPD), Canada (PIPEDA), and other jurisdictions where applicable. Contact support@soulio.ai with your request.
We implement industry-standard technical and organizational measures to protect your information:
No system is completely secure. We are not liable for breaches outside our reasonable control.
Soulio is intended exclusively for users 18 years of age or older. We do not knowingly collect personal data from anyone under 18.
At sign-up, you confirm you are at least 18. This is a precondition of using Soulio.
If we become aware that we have collected personal data from a person under 18, we will:
Soulio is not directed at, and does not knowingly serve, children under 13 in the United States. If you believe we have collected information from a child under 13, please contact us at support@soulio.ai for immediate review.
Parents or legal guardians who believe a minor has provided data to Soulio may contact support@soulio.ai to request immediate deletion. We respond within 7 business days.
Your information may be transferred to and processed in countries other than your country of residence. We implement appropriate safeguards for such transfers in accordance with applicable privacy laws (e.g., Standard Contractual Clauses under GDPR, where applicable).
The App may contain links to third-party websites or services (e.g., FAQ pages, support pages). This Privacy Policy does not apply to those third parties. We recommend reviewing each third party's privacy policy.
We use your IP address to detect approximate country or region, for the purposes of:
We do not use IP data to track your precise location.
We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification or email (if provided). The updated policy takes effect upon posting. We encourage you to review this policy periodically.
For any privacy-related question, request, complaint, or concern, contact us at support@soulio.ai. Use a clear subject line such as "Delete Account", "California Privacy Request", or "GDPR Request" for faster handling.
We acknowledge all privacy inquiries within 5 business days and resolve them within 30 days (longer where allowed by law for complex requests, always with notice).
Last updated: May 22, 2026