Privacy Policy

1. Information we collect

Account and profile information. If you create an account or sign in, we may collect your name, email address, hashed password data, email verification records, selected birth year, plan level, account creation timestamp, and login metadata such as last login time, IP address, and country code when available.

Google sign-in and mobile authentication data. If you use Google sign-in, we and our providers may process Google sign-in tokens and Google account claims such as your verified email address and name to authenticate you. On supported Android builds, we may also process Google Play Integrity request hashes, integrity tokens, verdict details, device/app recognition results, and related anti-abuse metadata to verify that a mobile authentication request came from a legitimate app build and device.

Content you submit. We collect the prompts, messages, attachments, uploads, reference files, generated images and videos, chat titles, saved chat history, and related content you submit or generate through the Services.

AI Friends and character information. If you create or edit an AI Friend character, we may collect the character name, bio, opening message, system prompt, avatar, tags, model selection, visibility setting, related friend-chat history, and moderation or status metadata. If you mark a character as public, certain character fields such as the name, bio, opening message, avatar, tags, status, and visibility may be shown to other users through the Services.

Device-selected media and local exports. On supported mobile builds, if you choose to pick photos or videos from your device, we receive the files you select for upload and processing. If you choose to save generated or uploaded media to your device gallery or downloads, the resulting local copy is stored on your device outside Byta-controlled storage.

Billing and transaction data. If you buy a paid plan or credit pack, payment and billing providers may collect payment details and billing information. We may also receive transaction metadata such as your purchase type, product identifier, entitlement or subscription status, renewal or expiration status, Google Play or Apple App Store purchase metadata, RevenueCat app user identifiers, Stripe customer identifiers, Cryptomus invoice identifiers and blockchain transaction metadata, and related webhook events. We do not store full payment card numbers or crypto wallet private keys on our servers when a processor handles the transaction.

Security, abuse-prevention, and technical data. We may collect IP addresses, forwarded network headers, request IDs, timestamps, approximate country code, guest usage counts, error details, user-agent or app-shell identifiers, device or app integrity results, and operational logs needed to run, secure, debug, audit, and bill the Services.

Browser storage, cookies, native app storage, and local session data. The Byta AI web app stores sign-in session data in browser local storage. Bytagram also uses a host-only, technically necessary secure session cookie for its cross-domain sign-in handoff. The Android app currently stores session and related account-linkage data in app-local native storage and may also rely on WebView or browser-like storage for functionality. The Services may also store product preferences and similar technical data in local storage for functionality and security. The web app also uses a first-party language-preference cookie and may use other technically necessary cookies or similar storage to support core product behavior. For lightweight acquisition measurement, we use a random first-party visitor identifier to retain first- and latest-touch campaign parameters, the external referrer's host name, landing-page path, approximate country code, timestamps, and whether the visitor later links to an account or paid plan. We do not store an IP address, browser fingerprint, full referrer URL, or page-by-page browsing history in this attribution record. We also use Google Analytics, which may set cookies such as _ga and a property-specific _ga_* cookie to distinguish visits and measure site and product usage. Depending on our current analytics-consent setting, Google Analytics either loads immediately or remains completely unloaded until you accept analytics.

Supported Android builds also include Google Analytics for Firebase. Subject to the same analytics preferences, this measures first opens, app sessions, time in the foreground, feature screens, registration, creation milestones, and eligible Google Play purchase events. App-instance and advertising identifiers may be processed for measurement and Google Ads attribution; personalized advertising remains disabled. Our app-event integration does not send prompts, generated media, chat contents, or email addresses to Firebase Analytics. Disabling analytics disables native analytics collection as well as website analytics.

The Android app may offer Google Play's optional rating and review dialog after sufficient use. Google handles any rating or review you submit. We cannot determine from the dialog whether you submitted a review or which rating you chose. Local usage counters limit how often we request a review; reviews are not required to use the Services.

Bot-detection and guest access data. If guest access is enabled, we may track guest usage by IP address and, where configured, require Cloudflare Turnstile or a similar anti-abuse check. Turnstile and similar services may receive browser, device, and network information needed to evaluate abuse or fraud.

2. How we use information

We use information for purposes such as:

• providing chat, uploads, AI Friends, public or private character features, Studio, account, billing, and support features;
• authenticating users, managing sessions, verifying accounts, handling Google sign-in, and resetting passwords;
• processing payments, applying credits, restoring purchases, and managing subscriptions, billing portals, and mobile entitlements;
• storing and retrieving chat history, uploads, media generations, and related account data;
• hosting, displaying, recommending, moderating, and enforcing visibility settings for AI Friend characters and related public-facing content;
• providing Android, iPhone, and iPad mobile-shell functionality such as session continuity, native media selection, and saving files to device storage when you request it;
• detecting fraud, abuse, misuse, security incidents, and unauthorized access;
• verifying mobile request integrity, app legitimacy, and device signals where mobile integrity or similar checks are enabled;
• monitoring service performance, debugging failures, and improving reliability and safety;
• measuring acquisition sources and account or paid-plan conversion through limited first-party attribution summaries;
• measuring visits, navigation, approximate location, device and browser characteristics, product interactions, and whether advertising leads to account creation through Google Analytics and our Google tag, so we can understand and improve the Services and campaign performance, subject to the analytics-consent controls currently enabled on the site;
• complying with legal obligations and enforcing our Terms, policies, and billing rules;
• communicating with you about service issues, security notices, support, and account matters.
• sending product updates, offers, and promotions by email only when you separately choose to receive them; recording that choice and honoring marketing unsubscribe requests without affecting account or security email.

3. How AI processing and third-party providers work

Byta routes prompts, chat context, uploaded files, and generation requests through one or more third-party AI, hosting, security, email, and payment providers in order to operate the Services. For example, chat prompts may be sent to configured model providers, Studio requests may be sent to image or video generation providers, billing flows may use Stripe, Cryptomus, Google Play, Apple App Store, StoreKit, and RevenueCat, mobile authentication may use Google sign-in and Google Play Integrity, email delivery may use our SMTP provider, abuse-prevention checks may use Cloudflare Turnstile, and analytics may use Google Analytics. Google may process analytics data under its own privacy terms. We configure Google Analytics without advertising personalization or Google signals.

Depending on the feature you use, your content may therefore be processed outside Byta by those providers under their own terms, privacy notices, and data-handling practices. We try to use providers that support commercially reasonable privacy and security protections, but provider handling is not controlled exclusively by this Policy.

The current implementation also creates operational logs for upstream model interactions and certain generation flows. Those logs may include request payloads, response bodies, token or credit information, request IDs, and provider metadata. Authorized personnel may access those logs when reasonably necessary to operate, secure, troubleshoot, investigate abuse, or audit the Services.

4. When we share information

We may disclose information:

• to service providers and processors who help us run the Services;
• to payment processors and billing vendors to complete purchases, restore purchases, validate billing status, and manage subscriptions;
• to email, anti-abuse, hosting, storage, logging, and infrastructure vendors;
• to Google, Google Play, Apple, and RevenueCat when sign-in, mobile integrity, subscriptions, in-app purchases, or purchase restoration require those services;
• to AI and model providers when your request requires external processing;
• to other users or the public when you choose to publish or otherwise make AI Friend character content public through the Services;
• if required by law, legal process, court order, or lawful government request;
• to protect rights, safety, property, users, the Services, or the public;
• in connection with a merger, financing, restructuring, acquisition, bankruptcy, or asset sale.

We do not knowingly sell personal information for money. We also do not use the Services for cross-context behavioral advertising sharing as those concepts are commonly understood in privacy laws.

5. Retention

We retain different categories of data for different periods, depending on how the Services work and what we need to operate them.

• Account records are generally retained while your account remains active and as needed afterward for legal, billing, fraud-prevention, dispute, security, and recordkeeping reasons.
• For signed-in users, non-temporary chats are generally saved to account history until you delete them, your account is removed, or we need to retain them for legitimate legal or operational reasons.
• AI Friend characters and related character metadata are generally retained until you delete them, your account is removed, we take them down, or we need to retain them for legitimate legal, security, abuse-prevention, or operational reasons. Public characters may remain visible until changed to private, deleted, or removed by us.
• Uploads are retained until you delete them, your account is removed, or the system prunes older uploads to enforce account storage limits.
• Generated media and generation-history records may remain in your account until deleted, removed under retention rules, or no longer needed for service operation or compliance.
• Verification codes, password-reset records, and similar transient authentication artifacts are generally short-lived and pruned periodically.
• Purchase, subscription, entitlement, webhook, and related billing records may be retained as needed for accounting, dispute handling, fraud prevention, compliance, and service operation.
• Operational, security, mobile integrity, and upstream interaction logs may be retained until rotated, archived, deleted, or no longer needed for the purposes described in this Policy.
• First-party acquisition attribution summaries are automatically removed after approximately 400 days without a new recorded touch.
• Google Analytics data and cookies are retained according to our Google Analytics property settings and Google's applicable controls. Browser cookie lifetimes may be renewed when you revisit while analytics is active.

6. Your choices and controls

• You can delete saved chats and uploaded files through available product controls where those controls exist.
• You can create AI Friend characters as private or public, and you can later change visibility, delete characters, or remove related account content through available product controls where those controls exist.
• You can use temporary chat mode to avoid saving certain conversations to your account history.
• You can manage web subscriptions through the billing portal when that billing flow is enabled for your account, and you can manage mobile subscriptions and in-app purchases through Google Play or your Apple App Store account.
• You can use purchase restoration controls in supported mobile builds to relink eligible Google Play or Apple App Store purchases to your Byta account.
• You can sign out of the web app and supported mobile app builds through available product controls, which removes locally stored session data from that browser or app instance.
• You can update selected account preferences such as language, theme, and birth year through Settings. Some of those choices may also update corresponding local storage or cookie values used by the product.
• When the analytics-consent prompt is enabled, you can decline analytics when prompted or change your choice later. Declining or withdrawing consent prevents first-party attribution collection, disables Google Analytics, and removes Google Analytics cookies that our site can access. When the prompt is disabled, analytics applies directly and you can block or remove analytics storage through your browser controls.
• Marketing email is optional at registration. If you opt in, you can unsubscribe using the link in a promotional email; account, billing, and security messages continue separately.
• If you save files to your device gallery or downloads, you can manage or delete those local copies through your device controls.
• You can request or initiate account deletion through available product controls or by contacting us, subject to legal, security, billing, fraud-prevention, chargeback, and recordkeeping exceptions.
• You should use caution on shared devices because the current web app stores session data in browser local storage and supported mobile builds may store session data in app-local storage.

7. Privacy rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or portability of certain personal information, or to object to certain processing. Those rights are subject to legal exceptions and verification.

To make a privacy request, contact [email protected]. We may need information from you to verify the request and to understand what action you want us to take.

8. California-specific disclosures

If California law applies to you, we generally use the categories of information described above for the business and commercial purposes described in this Policy. We do not knowingly sell personal information and do not knowingly share personal information for cross-context behavioral advertising through the Services.

The Services are not currently designed to respond to browser "Do Not Track" signals in a standardized way because no uniform standard exists.

9. International transfers

Byta and its service providers may process information in countries other than where you live. Cross-border transfers may occur whenever we use vendors, infrastructure, payment providers, email systems, or model providers located in other regions. Where required by law, we will use appropriate safeguards for such transfers.

10. Security

We use technical and organizational measures designed to help protect information, but no service can guarantee perfect security. You are responsible for maintaining the confidentiality of your account credentials and for using shared devices carefully. Because the current web app stores session data in browser local storage, anyone with access to your unlocked browser profile may be able to access your session. Supported mobile app builds may also store session and related account-linkage data in app-local storage. If you export or save files to your device, those local copies are protected according to your device's own security settings.

11. Children

The Services are not directed to children under 13, or the higher minimum age required by applicable law in the user's jurisdiction. We do not knowingly collect personal information from children below the applicable minimum age.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date. If we make a material change to how we use or disclose personal information, we will provide additional notice where required by law. We do not intend to retroactively apply a materially more permissive data-use policy to previously collected personal information without notice and any consent required by law.

13. Contact

Byta AI is operated by ByteMe Digital Creation Studio. For privacy questions, requests, or complaints, contact [email protected].