Privacy

1. Who we are

Sweetling (“Sweetling,” “we,” “us,” or “our”) is the brand operating sweetling.app, an adult (18+) romantic AI companion web app. Sweetling is a new service, and features may change.

Contact for privacy and support: support@sweetling.app

2. Scope: what this policy covers

This Privacy Policy explains how we collect, use, share, retain, and protect personal data when you:

• Visit sweetling.app or related pages;
• Create or use an account, pass the age gate, or use companions, memory, media, search, or billing;
• Contact us at support@sweetling.app.

It should be read together with our Terms of Service. Capitalized terms used here but not defined have the meanings in the Terms where relevant.

If you do not agree with this policy, do not use the Service.

3. What we collect

We collect personal data needed to run Sweetling. Categories include:

3.1 Account and authentication

Email, account identifiers, and the data needed to sign you in. You sign in with Google or with a one-time sign-in code we email to you. We do not use passwords. If you sign in with Google, we receive and keep your name, email address, and profile picture from Google.

3.2 Age gate

We ask for your date of birth once. If you are 18 or older, we store the time you confirmed it. If the date is under 18, we close the account and store that it was closed. We do not store the date of birth itself.

3.3 Profile and preferences

Display choices you set, such as app language, timezone, and companion settings.

3.4 Chat messages and companion outputs

Messages you send and replies generated for you. Adult romantic or sexual content may be processed after you pass the 18+ age gate. Hard blocks for minors and other prohibited categories still apply (see Terms §5).

Private chats are used to provide the Service: replies, memory, safety, and support. They are not sold.

3.5 Memory

Facts the companion treats as true, including facts you add and facts noticed in chat. You can view, add, edit, pin, and delete them in Settings. We store them so the companion can use them when it replies.

3.6 Usage and Sweets

Message counts, and the Sweets balance on a paid plan, so the limits in the Terms can be applied. Sweets are a usage balance, not money. On Free, Settings does not show a Sweets balance.

3.7 Payments and billing

We keep the plan you are on and whether a payment went through. We do not store full card numbers on our own systems.

3.8 Photos you upload

On a paid plan you can upload an image into a thread. We store it so the companion can reply about it. It is chat context only. It is not used as an input to image or video generation. We delete the file from the server after 30 days. The thread can still show that the image expired.

3.9 Photos, clips, and voice we generate

If you confirm an in-chat photo or clip, we keep what you confirmed and the file shown in the thread. Voice is the reply read aloud. Photos, clips, and voice spend Sweets on a paid plan.

3.10 Support communications

Emails and messages you send to support@sweetling.app, and our replies, including attachments you choose to send.

3.11 Device, log, and technical data

IP address, user agent and device type, approximate location derived from IP, timestamps, request logs, error logs, and security events. When you sign in, our bot protection check also receives your IP address and device and browser data, so it can tell people from bots. We keep safety and moderation logs for hard-block hits and related enforcement (see Terms §5).

3.12 What we do not intentionally collect

We do not intentionally collect data from anyone under 18. We do not run third-party advertising trackers.

4. How we use data

We use personal data to:

1. Provide the Service. Authenticate you, run companions, apply plan limits and Sweets, and show your chats and settings.
2. Memory. Store and retrieve facts you can edit, so the companion can remember them when it replies.
3. Safety and hard blocks. Detect, refuse, log, and review prohibited content (especially anything involving minors); escalate and cooperate with authorities where required by law. The Service will not provide real-world methods for suicide or violent harm.
4. Billing. Process subscriptions and Sweets packs, show what you bought, prevent fraud, and handle cancellation and the refund cases in the Terms.
5. Support. Answer messages and fix problems with your account.
6. Run the Service reliably. Understand outages, abuse, and whether a feature worked. We do not sell your personal data. We do not sell private chats.
7. Legal compliance. Meet applicable law, respond to lawful requests, and enforce our Terms.

Adult content may be processed after you pass the 18+ age gate. That does not weaken minor protection or CSAM refusal.

5. Why we process data (plain-language bases)

Hong Kong PDPO focuses on purpose and fairness rather than EU-style “legal bases,” but we state our justifications plainly for transparency (including for users elsewhere):

6. Sharing

Service providers. We share personal data with service providers that help us run the Service, such as AI model providers (to generate replies, photos, clips, and voice), web search providers (for search on paid plans), analytics providers (to measure page visits, performance, and product events), bot protection providers (to check that sign-ins come from people), payment processors, hosting and storage providers, and email delivery providers. We share only what is needed to run the Service.

We may also disclose personal data if required by law, to protect minors or someone’s safety, to enforce our Terms, or in a merger or acquisition with notice where required.

International transfers. Data may be processed outside Hong Kong, including in the United States and other regions. By using the Service you understand that data may leave Hong Kong.

We do not sell your personal data.

7. Retention

• Account. Profile data while your account is active.
• Chats and memory. Kept while the account is active so the companion can reply and remember. You can edit or delete memory facts in Settings.
• Uploaded photos. Deleted from the server 30 days after upload.
• Generated photos, clips, and voice. Kept with the account so the thread can show them.
• Sweets. They follow the plan rules in the Terms. Settings shows a Sweets balance while a paid plan is active.
• After a deletion request. Email support@sweetling.app. We aim to delete or anonymize personal data within a reasonable period, except where backups, legal holds, disputes, or safety and audit needs require longer.
• After you delete your account. We keep a one-way hashed identifier to prevent abuse of free offers.
• Safety and hard-block logs. May be kept longer than ordinary chat when needed for minor protection, abuse investigation, or legal compliance.
• Billing records. Kept as needed for accounting, tax, chargebacks, and legal requirements.
• Support emails. Kept as needed to resolve your request and for a reasonable follow-up period.

When we no longer need data for these purposes, we delete or anonymize it where practicable.

8. Your rights

Subject to applicable law (including the Hong Kong PDPO), you may:

1. Access. Ask what personal data we hold about you.
2. Correction. Ask us to correct inaccurate data. You can also edit or delete memory facts in Settings.
3. Deletion. Ask us to delete your account or certain data, subject to legal and safety retention.
4. A copy. Ask support for a copy of the key data we can reasonably provide. There is no separate export button in the product.
5. Withdraw consent. Where processing relies on consent (for example any future marketing), you may withdraw. That does not undo prior lawful processing.
6. Object or complain. Contact us first at support@sweetling.app. You may also contact the Hong Kong Privacy Commissioner for Personal Data (PCPD) about PDPO concerns. Users in other regions may have additional rights under local law (for example GDPR or CCPA/CPRA). We will consider those requests in good faith where they apply.

To exercise rights, email support@sweetling.app from your account email when possible, and describe what you need. We may need to verify your identity before acting.

9. Cookies, local storage, and analytics

Essential. We use cookies and local storage as needed for authentication, sessions, security, and basic app function (for example keeping you signed in and remembering preference flags).

Analytics. We use privacy-friendly analytics to see how the site is used and how fast it loads. They record the pages viewed, the referring page, browser, operating system and device type, approximate location (country, region, and city), and performance timings such as how long a page takes to load. Page addresses are recorded without account, companion, or room identifiers, and without the rest of the link after the page path. We also record a few product events: a tap on a sign-up button (and where on the page it was), the start of a sign-up (and whether it was Google or email), and a tap on a blog link (and which post and language). These browser events do not include your name, email address, or chat content. They also leave out your account ID, with one exception: when you are signed in, the events for an upgrade prompt being shown or tapped can include your account ID from your session. To connect a visit to a sign-up, the browser keeps a random ID in a first-party cookie for up to 180 days. With it we also record a landing page view and, in the app, when an upgrade prompt is shown or tapped. When you sign in or start checkout, we store that random ID with your account ID, so these browser steps from the same browser can be linked to your account. Some steps are recorded on our servers instead: signing in, finishing the age check, matching a companion, sending your first message, your first photo, clip, or voice, and starting or completing checkout. Those records carry your account ID, so we can see where people stop. They never include message text, prompts, or payment card details. We keep these records for 180 days, and they are removed when the account is deleted. We look at this data in aggregate. Our analytics do not use third-party cookies.

Ads. We do not use third-party advertising trackers.

Do Not Track and Global Privacy Control. If your browser sends a Do Not Track or Global Privacy Control signal, we do not send the funnel steps your browser reports (a landing page view, a tap on a sign-up or upgrade button, or an upgrade prompt view), and we do not set the analytics cookie for them. The server-side steps listed above still apply, because they are part of the service you use.

10. Children (18+ only)

Sweetling is not for anyone under 18 (or under the age of majority where you live, if higher). We do not knowingly collect personal data from children. If we learn that an account belongs to a minor, we will disable it and delete or restrict associated personal data as appropriate, subject to safety and legal obligations. See also Terms §2 and the hard blocks in Terms §5.

11. Security

We use reasonable technical and organizational measures appropriate to the nature of the Service (access controls, encrypted transit where standard, and safety logging). No method of transmission or storage is 100% secure. You are responsible for protecting access to your email and Google accounts.

If we become aware of a personal-data security incident that requires notice under applicable law, we will notify you and regulators as required.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on sweetling.app and revise the “Last updated” date. For material changes, we will provide additional notice (for example email or in-app) where required by law or appropriate for the change.

Continued use after the effective date means you acknowledge the updated policy, except where mandatory law requires a different consent method.

13. Contact

Privacy and support: support@sweetling.app Website: https://sweetling.app Terms: Terms of Service

14. Governing approach

We design this policy around Hong Kong expectations (PDPO: purpose, transparency, retention, access and correction, and an accountable contact). Other regions’ rights may also apply to you (for example EU/UK GDPR or US state privacy laws). Nothing here is intended to waive non-waivable rights.