Privacy Policy

Updated 10 September 2026. The short version: we store your account details, your conversations and the memory built from them, because her memory does not work without them. We do not sell your data and we do not hand it to anyone to train their own models. You can delete the account whenever you like and the data goes with it.

What we store, and why

• Account data - email address, a hash of your password, sign-up date, and the plan you are on. Needed to let you in and to bill you.
• Conversations and companion state - your messages, her replies, and the memory, mood and relationship data derived from them. This is the product: without it she starts from zero every time.
• Characters you build and images generated for you - kept so that they are there when you come back.
• Payment records - amount, currency, time, provider and the provider's reference. We never see or store card numbers.
• Technical logs - IP address, user agent, request times. Needed for security, abuse investigation and debugging.
• First-touch source - which page you arrived on and which site referred you, so we know what works.

Legal basis

Contract, for everything needed to give you the service you asked for: the account, the chat, the memory, the payment. Legitimate interest, for security, abuse prevention and aggregate statistics. Legal obligation, for financial records and for reports the law requires. Consent, only where something is genuinely optional - and withdrawable at the same place you gave it.

Who else processes it

We use a small number of processors and no data brokers: a hosting provider for the servers; a GPU provider that runs the image and language models; an email provider that delivers account mail; and payment providers that take the money. Each gets only what its job needs - the GPU provider gets the prompt, the mail provider gets your address, the payment provider gets the amount. None of them gets your conversation history for their own purposes.

How long

Account data, conversations and companion memory live as long as the account does. Delete the account and they are removed. Technical logs are kept for a short operational window and then rotate away. Payment and tax records are kept for as long as financial law requires, which is longer than the account itself - this is the one category deletion does not clear.

Deleting everything

Settings has an account deletion control, and it is real: the account, the chats, the memory and the generated images go. You can also write from the account address to support@girli.app. If you want a copy first, ask and we will send an export.

Security

Traffic runs over TLS. Passwords are stored as hashes, never in the clear. Administrative access is limited and audited. No system is perfect: if a breach ever affects you, we will tell you and the relevant regulator within the time the law sets.

Children

Girli is for adults and we do not knowingly hold data about anyone under 18. If you believe a minor has an account, write to us and it will be closed and wiped.

Your rights and contact

Access, rectification, erasure, restriction, portability and objection are described with the exact procedure in Data Subject Rights. Cookies are listed one by one in the Cookie Policy. For anything on this page write to support@girli.app.