Privacy Policy

Version 2026-11-04

This policy explains what personal data Taleback ("we") collects when you use Taleback, why, who we share it with, how long we keep it, and your rights. We are the controller of your data. Contact: [email protected].

1. What we collect

If you join our payments waitlist, we email you when payments open; you can unsubscribe any time.

Guests who have not signed up get a temporary anonymous account when they confirm they are 18+ and accept the consent step before their first message, not before; the same data about chats and consents then applies to them.

2. Sensitive data: your chats

Your chats, and which characters and scenes you choose, can reveal details about your sex life or sexual orientation. This is a special category of data under the EU and UK GDPR and Swiss data-protection law, and sensitive data under the laws of many other countries.

Consent countries are the countries where we ask for this consent, currently: the countries of the European Economic Area (the EU with its outermost regions and the Åland Islands, Iceland, Liechtenstein and Norway), the United Kingdom, Gibraltar, Guernsey, Jersey, the Isle of Man, Switzerland, Monaco, San Marino, Andorra, Brazil, Canada, South Korea, Turkey, Ukraine, Mexico, India, South Africa, Thailand, Argentina, the Philippines, Colombia, Peru, Uruguay, Serbia, Taiwan, Vietnam, Russia and Chile. Which rules apply to you depends on the country where you last accepted the processing of your chats (we tell it from your IP address at that moment). If we could not tell the country, the rules for consent countries apply.

We use this data for these purposes:

• To provide the Service (required, everywhere): generate replies, keep your conversation going, and moderate content. We ask for your explicit consent before your first message. You can withdraw it at any time by deleting a chat (it is removed from the Service) or by deleting your account. Without it you cannot chat, because chatting is the Service.
• To improve the Service: chat statistics, outside consent countries. As part of running and improving the Service, a model analyses chats automatically and de-identified into aggregate statistics, such as topics, intents, what kept or put the person off, mood, why a conversation ended and technical failures (see Analytics). The results are counts with no ID. You can opt out at any time in your profile under Privacy & data → Don't use my activity for product analytics.
• To improve the Service: chat statistics, in consent countries. Only with your separate, explicit consent (optional, off unless you tick it). Saying no changes nothing else in Taleback. You can turn it off at any time under Privacy & data → Help improve Taleback.
• To improve the Service: which characters and scenes you choose (optional, everywhere): looking at the characters and scenes a person picks needs your separate consent wherever you are, under Privacy & data → Help improve Taleback.

Who may read your chats. Outside consent countries, our team and the AI tools we use may read chats in full to improve the Service (characters, replies and the product). In consent countries they do this only with the Help improve Taleback consent. Chats that are reported or flagged by moderation, and chats you ask support to look at, may also be read for that purpose. Chats started without an account (guest sessions), which are not linked to a name, e-mail or account, may also be read by our team to check the quality and safety of replies; nothing from them is added to a profile or linked to a person. Every time our team opens a chat in the admin tool, the opening is logged. We do not use your chats for advertising and do not sell them.

Imported chats and the Save to Taleback extension. When you import chats, by file, by pasting, or with our browser extension, we receive the chats and character cards you chose. We keep them in your private archive so you can read and continue them. They are not shown to other users, and you can delete them at any time. The extension reads your chats from the character.ai page you have open, using your existing session in your browser. It does not read, store or send your password, cookies or tokens. It keeps the copy only until our import page takes it, and the copy is erased when you close the browser.

3. Why we use your data

Analytics

• From our servers, without content. We count what happens in the Service, such as sign-ups, messages sent, features used, payments and errors, to see what works. While payments are not open, this includes which plan and payment method people pick on the payment screens; you never enter card details there. These events carry a pseudonymous ID derived from your account with a secret key, and never your email, IP address, the text of your chats or which characters and scenes you pick. We keep them for 13 months. This relies on our legitimate interest; you can opt out at any time in your profile under Privacy & data → Don't use my activity for product analytics.
• In your browser. In the EEA, the UK, Switzerland and similar countries, and where we cannot tell your country, PostHog cookies and similar tools run only if you accept them in the cookie banner. Elsewhere there is no banner: PostHog runs in your browser on our legitimate interest, never when your browser sends the Global Privacy Control signal, and you can stop it under Privacy & data → Don't use my activity for product analytics. We do not use advertising pixels. If you came from an ad and allow Advertising in the cookie banner, we keep the id of that ad click and, once, when you sign up, send it to the ad network so it knows the ad worked; see Who we share data with.
• Your chats, by region. From time to time, a model labels conversations, for example by topic, intent, what kept or put the person off, mood, why a conversation ended and technical failures. The model runs through OpenRouter with data collection by the model provider turned off, so the provider does not keep the text or train on it. The labels are de-identified, and what we keep is daily counts per character, opening and label, with no text and no user ID. Which rules apply depends on the country where you last accepted the processing of your chats (see consent countries).
• Outside consent countries your chats are included unless you opt out under Privacy & data → Don't use my activity for product analytics.
• In consent countries your chats are included only with the optional product-improvement consent (Privacy & data → Help improve Taleback). Without it they are not analysed.
• Your choices, only if you agree. Which characters and scenes a person picks is looked at only with the optional product-improvement consent, wherever you are. It is kept under a pseudonym and shown only in groups of 5 or more people.
• AI costs per character, in total. To control costs we add up what AI replies cost for each character across all users. The total is never broken down to a person, and a character or period with fewer than 5 people is not shown. This relies on our legitimate interest.
• Session recordings. Where browser analytics runs (see above), we also record how you use the pages as a replay of what happens on screen: clicks, scrolling, page changes and layout. What you type in input fields and all text in chats (your messages, replies, openings and suggestions) are masked in the recording and never stored; private photos, the photo viewer, scenes and all video are left out entirely, and recording pauses on the account, settings and support pages. For now we record only visits that came from an ad, and only a share of them. Recordings are made by PostHog, which keeps them 30 days, and by our own recorder on our server, which keeps them 14 days. They run only under the same rule as browser analytics: in the EEA, the UK, Switzerland and where we cannot tell your country, only after you accept in the cookie banner; and never when your browser sends the Global Privacy Control signal. We use them to find broken screens and confusing steps. People on our team may watch them for that purpose only. If you refuse, nothing is recorded.
• Ad visit log. If you open Taleback from an ad, we record, for each visit: your IP address, the network (ASN) it belongs to, your country, the technical parameters of the ad link (such as the campaign and the ad network's click id), a visit ID and the pages you open. We use it for two things only: to filter out bots and fraudulent clicks, and to see how people from each ad move through the site. The log is kept in PostHog (our processor) and is not used for anything else, not for advertising to you, not to build a profile of you, it is not linked to your account, and it never contains the text of chats. We keep it for 90 days, then delete it. Reading your IP address from the request needs no cookie; if PostHog's browser cookies or similar tools are used for this log, the rules of Analytics apply to them (consent where cookie consent is required). You can object at [email protected]; if you do, we delete your visit log unless we need it to stop a fraud we can show.
• Anonymous totals. Counts that carry no ID at all, such as how many conversations a character had in a day or how many visits arrived from each ad and from which country (the country code your connection reaches us from, never your IP address), are anonymous and are not personal data.
• What we never do: use chats for advertising, sell them, or send chat text to analytics or advertising services. Where our team reads chats to improve the Service (see Sensitive data), the reader sees a pseudonymous ID, not your name or e-mail, and every opening is logged.

4. AI processing

To write a reply, we send the recent part of your conversation, the character's description and your profile to an AI model. To decide when a character sends a photo, video or voice message in chat, a model reads the latest messages of the conversation the same way; its answer is used once and is not stored with your account. Models are provided through OpenRouter, Inc. (USA), which routes each request to the provider of the chosen model, for example DeepSeek, MiniMax, Z.ai (GLM) or Meta. These providers may process the text outside your country, and their own terms and data policies apply. We do not send your email or payment details to them. Generated scene images are produced the same way by image models available through OpenRouter.

We also run automated moderation on messages, replies and images. Content that the system flags, or that someone reports, may be reviewed by our staff.

If a message suggests thoughts of self-harm, the system uses that signal only to answer with care and show crisis resources (Safety and Crisis Protocol). The message stays in your chat history like any other. The conversation is then marked for 24 hours so the character stays in care mode; the mark is deleted with the conversation. Your device keeps a similar note for 24 hours, so the chat does not offer photos, videos, voice messages or flirty reply ideas. For reporting we count only how many times a day crisis resources were shown, without the message or who sent it.

We do not make decisions with legal or similarly significant effects about you based only on automated processing, except blocking content that the automated system flags as clearly prohibited; you can ask for human review at [email protected].

5. Who we share data with

We do not sell your personal data. We share it with service providers who process it for us under contract:

If you came from an ad and Advertising is on, we also send the id of that ad click, once, when you sign up, to the ad network that showed the ad (TrafficStars). Nothing else about you goes with it: no email, name, account ID, IP address or chats. The ad network uses it under its own privacy policy. In the EEA, the UK, Switzerland, Canada, or a country we cannot tell, Advertising is off unless you turn it on in the cookie banner. Elsewhere it is on unless you turn it off, in the cookie banner or with "Do not sell or share my personal information" at the bottom of the page. We tell where you are from your country as our network provider reports it. (The separate ad visit log described under Analytics does hold your IP address, for 90 days.) If your browser sends the Global Privacy Control signal, nothing is sent anywhere.

The sign-in and sign-up check (Cloudflare Turnstile) sends signals about your browser to Cloudflare; Cloudflare processes those signals as an independent controller under its Privacy Policy.

We may also disclose data when the law requires it, to protect people from harm (for example, reports about child sexual abuse material to the competent authorities), or in a sale or merger of our business under the same protections.

6. International transfers

Some providers are outside the EU/UK. When we transfer personal data there, we rely on adequacy decisions or on the European Commission's Standard Contractual Clauses with additional safeguards where needed. Our servers are in the United States. Cloudflare handles traffic on a global network; for transfers from the EU, UK or Switzerland to the United States it relies on its certifications under the EU-U.S. Data Privacy Framework and its extensions, and on Standard Contractual Clauses if those certifications lapse.

7. How long we keep data

Encrypted backups of our database and stored media are kept with Cloudflare (R2 storage); they are encrypted on our server before upload and Cloudflare cannot read them. Backups are kept for 14 days.

When you delete your account (Profile → Privacy & data → Delete account, after signing in again), we delete your chats, profile, photos and account right away. While a report about the account is open or evidence is held for the law, deletion waits until that is resolved. Records we must keep (payments, consents, safety) are kept without your email or name.

8. Your rights

Depending on where you live, you can ask us to:

• give you a copy of your data or send it to another service;
• correct inaccurate data;
• delete your data (you can also do this yourself in your profile);
• restrict or object to some processing;
• withdraw consent at any time, without affecting processing before the withdrawal.

Write to [email protected]. We answer within one month. You can also complain to your data protection authority. If you live in California, you have similar rights under the CCPA. We do not sell your personal information. While Advertising is on, we share the id of the ad click that brought you with that ad network, once, when you sign up. This may count as "sharing" under California law. You can opt out at any time with "Do not sell or share my personal information" at the bottom of the page or in cookie settings, and we treat the Global Privacy Control signal as an opt-out.

9. Children

Taleback is only for adults. We do not knowingly collect data from anyone under 18. If you tell us you are under 18, we close the account immediately. If you believe a minor is using Taleback, report it at Support.

10. Security

We protect data with encryption in transit, access controls and least-privilege access for our staff. Explicit images are kept in private storage and are shown only through short-lived links after an access check. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

11. Cookies

See the Cookie Policy.

12. Changes

We may update this policy. If a change is material, we will ask you to accept the new version before you continue. The version and date are shown at the top of this page.

Last updated: 28 October 2026.