Privacy Policy

1. Information we collect

• Account information: the email address and display name you register with, and, if you choose to provide it, your gender and the character genders you're interested in.
• Password: we never store your password itself. We store a salted cryptographic hash of it (used only to verify a login attempt) and use it to derive an encryption key, described below.
• Conversations: the messages you exchange with characters, games, and groups on Oasy.
• Token & billing data: your token balance, the history of grants and charges tied to your account, your subscription plan, and — if you subscribe or buy tokens — identifiers Stripe (our payment processor) gives us to manage your subscription or purchase. We never see or store your full card number: Stripe collects payment details directly.
• Reports: if you or someone else reports a message or a character, the reported content and the report note are kept so our moderators can review it (see Section 3).
• Technical data: your IP address is processed transiently to prevent abuse (e.g. rate limiting login and signup attempts) and is not stored long-term or linked to your profile.

2. Your conversations are encrypted

Your messages are encrypted with a key derived from your password before they're stored. We cannot read your conversations, and we have no way to recover them if you forget your password — this is a deliberate trade-off between convenience and privacy that you accept when you register.

3. The one exception: reports

If you report a message, or someone reports a message you sent (or a character you're talking to), the reported content is stored separately, in readable form, so a moderator can review it. This is the only circumstance in which staff can read the content of a specific message — never your conversations as a whole, and never without a report having been filed. You're shown a clear warning about this before you submit a report.

4. AI processing (Google Gemini)

To generate a character's reply, the relevant parts of your conversation are sent to Google's Gemini API, which processes them to produce a response. Google acts as a data processor for this purpose under its own terms. We don't send your email, real name, or payment details to this API — only what's needed to generate the reply (the conversation itself, and the character it involves).

5. Payments (Stripe)

Subscriptions and one-time token purchases are processed by Stripe. Stripe handles your card details directly; we only receive confirmation of payment and identifiers needed to manage your subscription (for example, to let you cancel it). See Stripe's own privacy policy for how it handles your payment data.

6. Where your data is stored

Oasy's database is hosted in the European Union (Frankfurt, Germany).

7. Cookies

Oasy uses a single essential cookie to keep you signed in. We don't use advertising or third-party tracking cookies.

8. How long we keep your data

We keep your account data for as long as your account exists. If you'd like your account and associated data deleted, contact us at [privacy contact email — to be completed] — we don't yet have a self-service deletion option in the app. Reported content is kept as long as needed to review and act on the report.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict some of its processing. To exercise any of these rights, contact us at [privacy contact email — to be completed]. If you're in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority (in Italy, the Garante per la Protezione dei Dati Personali).

10. Age requirement

Oasy is intended for users who are at least 18 years old. We don't knowingly collect data from anyone younger, and creating an account requires confirming you meet this requirement (see Terms of Service).

11. Changes to this policy

We may update this policy as the service changes. If we make a material change, we'll make that clear within the app before it takes effect.

12. Contact

Questions about this policy? Reach us at [privacy contact email — to be completed].