christabel

Privacy.

What is stored

• Your email address, to sign you in.
• Your chats: what you type, and the text captions of calls. Call audio is not stored.
• Your companion: the name, personality, voice, face, look and other choices you make for it. This includes what you say it is to you: a friend, a best friend, a partner or a mentor, or a relationship you describe in your own words.
• What your companion remembers about you: short notes it writes from your chats so a later chat can pick up where the last one left off. The next section explains them.
• Your device's time zone is sent with each message and call, so your companion knows what time of day it is for you. It is used for that reply and is not kept.
• Your settings, your call time, your plan and a record of purchases. If you pay, this includes a reference that links your account to the payment provider's records. It does not include your card details.
• A usage record: how much AI processing each reply, call and other use of the AI model took, measured in tokens, with the length of a call, the time and the account it belongs to. It does not contain anything you or your companion said. It is used to work out what the service costs to run.
• If you use a look drawn from a description, where that is offered: the description you wrote and the picture generated from it. They are kept until you remove the look or delete your account.
• A record of when you accepted the User Agreement, with the version, your IP address and your browser type.
• If you switch on two-step sign-in, which is optional: the secret your authenticator app uses, stored encrypted, and your recovery codes, stored only as fingerprints that cannot be read back. Wrong tries are counted, and after several in a row the step is closed for a while.
• Where you are signed in. For each sign-in the site keeps a short description of the browser and system, such as "Safari on iPhone", the country the connection came from, when it began and when it was last used, to the hour. You see the list under Account and can sign any of them out.
• A count for each day you use the site: how many messages there were and how many seconds of calls. It is used for the site's figures and holds nothing that was said.
• A record of each payment: the date, what was bought, the amount and the payment provider's reference. It is kept for our books and does not name your account. The payment provider can match the reference to its own records.
• Flags, reports and support requests about your account, and the reason for a suspension if there is one. The sections below explain each of them.

Your companion's memory

Your companion keeps short written notes about you between chats. An AI model reads your recent messages and writes them. They are used to personalise what your companion says to you.

• What a note can hold: a fact you shared, what the two of you are to each other, how you like your companion to behave, or something it has said about itself.
• What is left out: the model is instructed not to record passwords, card or bank numbers, government ID numbers or home addresses. It is instructed to record details of your health, sex life, religion or politics only when you ask for them to be remembered. An AI follows these instructions and can get them wrong, so check your notes.
• Your controls, under Customize: read every note, add one, delete one, delete them all, or switch memory off. While memory is off, no new notes are written and your companion does not use the ones it has. They stay stored until you delete them.
• Free and paid plans: without a plan, your companion uses only a few of your notes at a time. A plan raises that number, and the largest plan uses every note that is stored. All of your notes are stored and shown to you whichever you are on.
• Limits: there is a cap on how many notes are kept. When it is reached, the notes that have gone longest without being updated are removed to make room.
• Deletion: deleting a chat does not delete notes written from it. Delete those under Customize. All notes are deleted with your account.

How conversations are checked

Every few messages, an AI model reads the newest stretch of your chat. It is the same reading that writes your companion's notes. It also checks what you wrote for a short list of serious things:

• Someone who says, or plainly shows, that they are under 18.
• Sexual content about anyone under 18.
• A credible threat or plan to seriously hurt a real person.
• Seeking real help to commit a serious crime.
• A sustained, deliberate effort across several messages to break your companion's rules or to get harmful content out of it.

The check runs whether or not memory is on. While memory is off, your notes are not sent to the model and no notes are written.

The model is instructed never to report sadness, loneliness, anger, swearing, dark humour, flirting, roleplay or fiction, or a single test of the limits. It is instructed never to report someone who is in distress or thinking of hurting themselves. What your companion wrote is never a reason for a report.

When the model finds one of the things in the list, it writes a flag. A flag is one neutral sentence saying what kind of thing happened. It does not quote your messages, and the model is instructed to leave out names, places and other personal details. The flag also records the account, which chat and which messages it is about, the kind of thing, how serious it is and the time. An AI follows these instructions and can get them wrong. A flag is not a decision. A person looks at it and decides what, if anything, to do.

Administrators see the sentence and which account it is about. They do not see your conversation. There is one exception. For a flag marked serious, or for a reply you reported yourself, an administrator who holds a specific permission can open the messages the flag is about. For a flag from the automatic check, that is the stretch of chat that was read, which is at most 40 messages. For a reply you reported, it is that reply and the message before it. The administrator must give a reason first. The reason and the opening are recorded.

Reporting a reply

You can report any of your companion's replies from the menu on that message. You choose a reason and can add a short note. The reason and your note are kept as a flag on your account, and staff read them.

Suspension

We can suspend an account that breaks the rules. The reason is stored and shown to you when you sign in. While an account is suspended, chats, calls and purchases are off. You can still sign in, download your data, ask for a review under Help and close your account.

The help chat

The help chat is answered by an AI. What you type there is sent to Google's Gemini service, together with the help guides. You can use it without signing in.

• If you are signed in, details of your account are sent with it: your plan and when it renews or ends, your time left, your last few purchases and uses of call time, whether two-step sign-in is on, whether the account is suspended and why, and any support requests you have open. Your chats and your companion's notes are not sent.
• The help chat is not stored on our servers unless it is passed to a person. That happens when the assistant cannot settle something, such as a refund or an account you cannot get into.
• When it is passed on, it is kept as a support request with the conversation so far. Staff read it and answer by email. If you are signed in, you can follow the request and add to it under Help, in Your requests. If you are not signed in, you are asked for an email address so that staff can answer, and it is kept with the request.
• Use of the help chat is counted each day so that it can be limited. For someone signed in, the count is kept against the account. For someone not signed in, it is kept against a one-way mark made from their network address and the date. The mark cannot be followed from one day to the next, and it is thrown away the next day.

Safety notices

The page reminds you that your companion is an AI at the start of every sitting and again every three hours. It suggests a break after an hour. It shows crisis lines when certain words are typed or spoken. That check is made in your browser. Whether a notice was shown is not sent to us and is not stored. The message itself is kept in your chat like any other.

What our staff can see

The people who run the site work through an administrators' portal. An administrator can do only what their account has been given permission for, and must use two-step sign-in.

• What the portal shows about an account: the email address, when the account was made, the plan, the time left, whether the current User Agreement has been accepted, whether two-step sign-in is on, whether the account is suspended and why, flags and support requests about the account, how many chats, messages, notes, looks and signed-in devices it has, and its daily activity counts. An administrator who deals with billing also sees what was bought.
• What the portal never shows: your chats, the titles of your chats or your companion's notes. They are counted and that is all. The one exception is the recorded opening of the messages behind a flag, described above.
• What an administrator can do to an account: suspend it or lift a suspension, sign it out everywhere, send a sign-in link to its address, switch off two-step sign-in for someone who is locked out, add call time and answer support requests.
• A record is kept of everything an administrator does. Each entry holds who did it, the account it was done to, what was done and any reason that was given. It does not hold what anyone said in a chat. The record is kept for good, and it is kept after the account is deleted.
• Administrators can ask an AI assistant inside the portal to run reports and look up accounts. What it looks up is sent to Google's Gemini service for that: the account details listed above, the sentences of flags and the text of support requests. Chats and notes are not sent.

Outside the portal, chats, notes and looks are held in our database, and the few people who maintain it can reach them. We do so only where that is reasonably needed to investigate abuse, keep people safe, fix faults or comply with the law.

Who else sees it

• Google, because your messages, your companion's description, your companion's notes about you, the time of day where you are and your call audio are sent to its Gemini service to produce the replies, to write the notes and to carry out the automatic check. What you type in the help chat is sent to it too, with the account details listed under The help chat. When an administrator uses the portal's assistant, what it looks up is sent to it as well. If you use a look drawn from a description, your description and the picture are sent to Gemini to generate it.
• Cloudflare, which hosts the site and its database.
• Stripe, the payment provider, when you buy time or start a plan. Card details go to Stripe and never reach this site. Stripe is given your email address and keeps its own records of your payments.

Nothing is sold, and there is no advertising or tracking.

Cookies

One cookie keeps you signed in. Your light or dark choice is kept in your browser.

Getting and deleting your data

Download a copy of your data under Account: your companion's settings, your chats, its notes about you, the agreements you accepted and your purchases and use of call time. If you have used a look drawn from a description, the download holds your descriptions and not the pictures.

The download also holds the places you are signed in, your support requests, any flags about your account as our staff see them, and your daily activity counts.

Delete any chat from History. Delete one note or all of them under Customize. Delete your account under Account, which removes your companion, chats, notes, looks, settings, agreement record, sign-ins, two-step sign-in, flags and remaining time at once. Deleting a chat does not delete a flag raised from it, or the activity counts for those days.

Deleting your account also ends any plan you are on and stops future charges. If a charge still appears afterwards, write to us. Stripe keeps its own records of your payments after your account is gone.

Some records are kept after your account is deleted:

• The usage record, for our accounts. The link to your account is removed from it, so it no longer says whose it was, and it never held anything that was said.
• The daily activity counts, for the site's figures. They are added to a shared total, without the link to your account.
• The record of payments, for our books. It never named your account.
• The record of administrators' actions. Entries about your account stay, and they refer to it by an internal identifier.
• Support requests. The request and the conversation in it are kept, with the link to your account removed. If you made a request without signing in, the email address you gave stays with it.
• The daily counts of help chat use.

Contact

christabel.app is run by Zachary Kane, trading as HumanityZ, in Pennsylvania, USA. Write to hello@christabel.app.