Privacy, in plain English.

TalkHereNow is built privacy-first. Most of what makes us privacy-first is structural: we don't collect names, we don't collect government-issued identification, we don't sell data, and we don't run third-party advertising trackers. This document describes everything we do collect, why we collect it, where it goes, and how to remove it.

We do not sell your personal information, and we do not share it with data brokers or for building a profile of you.

The one exception: if you arrive from an ad and later subscribe, we tell that platform their ad worked, using the click identifier they created plus the time and amount. No name, no email, no phone, no conversation, nothing from your device. They already knew you clicked; we are only closing the loop.

The service providers listed below process data on our behalf, under contracts that prohibit them from using your data for their own purposes. To the best of our knowledge, none of them sell data either, but we cannot warrant their downstream practices. If you have a specific concern about a category of provider, contact legal@talkherenow.com and we'll tell you who that provider is and link to their policy.

The following never leaves your phone or tablet during a session:

To run the Service, we store the following encrypted, keyed to a server-side identifier rather than to a name or email:

• A session identifier. A random opaque string assigned to your browser the first time you visit. Used to associate conversations and memory with your usage.
• Conversation memory. Facts an AI Friend has learned about you across visits. Stored encrypted at rest using modern authenticated encryption. We do not train any model, ours or anyone else's, on your conversations.
• Memory snapshots. When your account is claimed or merged, or when your memory is corrected at your request, we keep an encrypted copy of your memory as it stood so the change can be reversed. Removed when you delete your data.
• Email address (only if you claim an account). Stored encrypted. Used to recover your memory across devices and to contact you for support.
• Subscription state (if applicable). Whether you have an active subscription, when it renews, and your payment processor's customer ID. We do not store card numbers.
• A non-identifying device fingerprint. Browser type, operating system, screen size. Used for hardware-tier detection and abuse prevention.
• IP address (truncated). We retain only the network prefix (the first 24 bits for IPv4, the first 48 bits for IPv6), enough for fraud and abuse detection, not enough to identify an individual.
• Ad click identifier. When you arrive from an ad, the identifier that platform placed in the link (for example gclid or twclid). Held for up to 90 days so a later subscription can be attributed to the ad that led to it, and deleted sooner, usually within 7 days, if you do not return. Deleted immediately if you delete your account. Never combined with your conversations and never used to profile you.
• Daily limit code. To apply free daily limits fairly, we calculate a one-way code from your network address, browser, screen size and pixel density. We store only that code and a daily count, both of which expire within 36 hours.
• Idea Lab audit log. Text of any prompt that produced or attempted an AI-generated image, the outcome (allowed / blocked / quota-limited), and a timestamp. Image bytes themselves are never stored on our servers, they stream directly from our image-generation provider to your device.
• Voice tone signals. While you speak, your browser computes a few low-detail summary signals locally (rough volume, rough pace, pause patterns) and sends those summary values, not your voice, to the chat service so the AI Friend can match your energy. The raw audio of your voice is not sent to any AI provider for tone analysis. Speech recognition for converting your words to text uses the speech-recognition feature built into your browser.
• Vision-feature audit log. When you tap the eye button, or enter Roast or Object Story mode, we keep a short record (provider name, request time, output length) so we can defend against abuse and reconcile billing. The frame bytes themselves are not retained by us or by the scene-analysis provider after the request completes.

The language, speech and vision models behind the Service run on infrastructure we operate, not a third party's. The inference, voice-synthesis and scene-analysis rows below apply only when we have to fail over. Image generation uses an outside provider; its row shows what we send.

The following categories of processors handle parts of the Service. Each operates under a contract that limits them to processing on our behalf. They each have their own privacy practices. If you would like to know who a specific provider is, contact legal@talkherenow.com.

The AI Friends in the Service are artificial intelligences, not human beings. They are not licensed therapists, doctors, lawyers, or financial advisors. They will state this when sincerely asked.

Every three hours of accumulated session time, an active AI Friend will note in voice that they are an AI and confirm the elapsed time. A persistent visual indicator labeled "AI" appears in the experience.

The Service is for adults eighteen years of age and older. We use date-of-birth self-attestation at first visit. A server-side classifier monitors conversation for self-disclosure of being under eighteen; any such disclosure ends the session immediately and applies an account-level block.

We do not knowingly collect data from anyone under eighteen. If we learn we have, we delete it on identification.

We set a single session cookie used to identify your browser to our servers. The cookie is Secure, HttpOnly, and SameSite=Lax.

We do not set advertising or third-party tracking cookies. Local browser storage is used to cache UI preferences and a count of accumulated session time for the AI-disclosure reminder; nothing in local storage identifies you.

You may at any time:

• Access the data we hold about you. Email legal@talkherenow.com.
• Correct information you have provided.
• Delete all data associated with your account. Request via legal@talkherenow.com or from the Account menu inside the Service. We honor deletion requests within thirty (30) days across the systems that serve the product. Backups are held on a rolling schedule and are not edited individually; they age out in the ordinary course.
• Export your memory and account data in a machine-readable format on request.
• Opt out of any non-essential processing.

California residents (CCPA), residents of the European Economic Area, the United Kingdom (GDPR), and other jurisdictions with comparable data-protection laws may have additional rights. We honor those rights for all users regardless of location.

Opting out of ad conversion reporting. If you reach us by clicking an ad, our servers report back to that platform whether the click led to a subscription. You have the right to opt out of the sale or sharing of your personal information, including this reporting. We process opt-out preference signals in a frictionless manner: if your browser sends a Global Privacy Control (GPC) signal we honor it automatically, at no cost to you, with no change to how the Service works and without asking you anything. You can turn one on by using a browser or browser extension that supports GPC; the current list is kept at globalprivacycontrol.org. You can also opt out at any time by emailing support@talkherenow.com.

Memory and email are encrypted at rest at the field level using modern authenticated encryption. All client-server traffic uses TLS 1.2 or higher.

Encryption keys are isolated from the systems that store your data, so anyone with access to one cannot decrypt the other. Backups are encrypted with a separate key from the live system. We follow the principle of least privilege across our infrastructure.

Our primary servers and data processing are located in the United States, though we may use infrastructure in other regions to operate the Service reliably. By using the Service from outside the United States, you consent to the transfer and processing of your data in the United States and, where applicable, other countries.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• European Union (EU)
• United Kingdom (UK)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: app.prighter.com/portal/16031450759.

How we change this policy. We may revise it and post the updated version on this page with a new effective date. Changes that do not materially affect your privacy rights or how we handle data take effect when posted.

Material changes. We will show a prominent notice, normally inside the WebAR experience, summarizing what changed and linking to the updated policy, before the affected practices begin applying to your personal information.

How we reach you. Our usual channel is inside the Service rather than email. We will use email or another method where the law requires it, and we will honor any advance-notice period we are required to give.

Where consent is needed. If a change requires your consent, we will obtain it before applying that change to your personal information. Acknowledging this policy is not by itself consent to new uses of your personal information.

For privacy questions, data-access requests, or anything else covered by this policy, please reach out at the appropriate address below.