Privacy, in plain English.

TalkHereNow is built privacy-first. Most of what makes us privacy-first is structural: we don't collect names, we don't collect government-issued identification, we don't sell data, and we don't run third-party advertising trackers. This document describes everything we do collect, why we collect it, where it goes, and how to remove it.

We do not sell or share your personal information with data brokers, advertisers, or any third party for advertising or commercial profiling. The service providers listed below process data on our behalf, under contracts that prohibit them from using your data for their own purposes. To the best of our knowledge, none of them sell data either, but we cannot warrant their downstream practices. If you have a specific concern about a category of provider, contact legal@talkherenow.com and we'll tell you who that provider is and link to their policy.

The following never leaves your phone or tablet during a session:

To run the Service, we store the following encrypted, keyed to a server-side identifier rather than to a name or email:

• A session identifier. A random opaque string assigned to your browser the first time you visit. Used to associate conversations and memory with your usage.
• Conversation memory. Facts an AI Friend has learned about you across visits. Stored encrypted at rest using AES-256-GCM. We never train any third-party model on this data.
• Email address (only if you claim an account). Stored encrypted. Used to recover your memory across devices and to contact you for support.
• Subscription state (if applicable). Whether you have an active subscription, when it renews, and your payment processor's customer ID. We do not store card numbers.
• A non-identifying device fingerprint. Browser type, operating system, screen size. Used for hardware-tier detection and abuse prevention.
• IP address (truncated). We retain only the network prefix (the first 24 bits for IPv4, the first 48 bits for IPv6), enough for fraud and abuse detection, not enough to identify an individual.
• Show & Tell audit log. Text of any prompt that produced or attempted an AI-generated image, the outcome (allowed / blocked / quota-limited), and a timestamp. Image bytes themselves are never stored on our servers, they stream directly from our image-generation provider to your device.
• Voice tone signals. While you speak, your browser computes a few low-detail summary signals locally (rough volume, rough pace, pause patterns) and sends those summary values, not your voice, to the chat service so the AI Friend can match your energy. The raw audio of your voice is not sent to any AI provider for tone analysis. Speech recognition for converting your words to text uses the speech-recognition feature built into your browser.
• Vision-feature audit log. When you tap the eye button, or enter Roast or Object Story mode, we keep a short record (provider name, request time, output length) so we can defend against abuse and reconcile billing. The frame bytes themselves are not retained by us or by the scene-analysis provider after the request completes.

The following categories of processors handle parts of the Service. Each operates under a contract that limits them to processing on our behalf. They each have their own privacy practices. If you would like to know who a specific provider is, contact legal@talkherenow.com.

The AI Friends in the Service are artificial intelligences, not human beings. They are not licensed therapists, doctors, lawyers, or financial advisors. They will state this when sincerely asked.

Every three hours of accumulated session time, an active AI Friend will note in voice that they are an AI and confirm the elapsed time. A persistent visual indicator labeled "AI" appears in the experience.

The Service is for adults eighteen years of age and older. We use date-of-birth self-attestation at first visit. A server-side classifier monitors conversation for self-disclosure of being under eighteen; any such disclosure ends the session immediately and applies an account-level block.

We do not knowingly collect data from anyone under eighteen. If we learn we have, we delete it on identification.

We set a single session cookie used to identify your browser to our servers. The cookie is Secure, HttpOnly, and SameSite=Lax.

We do not set advertising or third-party tracking cookies. Local browser storage is used to cache UI preferences and a count of accumulated session time for the AI-disclosure reminder; nothing in local storage identifies you.

You may at any time:

• Access the data we hold about you. Email legal@talkherenow.com.
• Correct information you have provided.
• Delete all data associated with your account. Request via legal@talkherenow.com or from the Account menu inside the Service. We honor deletion requests within thirty (30) days, including from server backups within the next backup-rotation cycle.
• Export your memory and account data in a machine-readable format on request.
• Opt out of any non-essential processing.

California residents (CCPA), residents of the European Economic Area, the United Kingdom (GDPR), and other jurisdictions with comparable data-protection laws may have additional rights. We honor those rights for all users regardless of location.

Memory and email are encrypted at rest with AES-256-GCM using industry-standard cryptography. All client-server traffic uses TLS 1.2 or higher.

Encryption keys are isolated from the systems that store your data, so anyone with access to one cannot decrypt the other. Backups are encrypted with a separate key from the live system. We follow the principle of least privilege across our infrastructure.

Our primary servers and data processing are located in the United States, though we may use infrastructure in other regions to operate the Service reliably. By using the Service from outside the United States, you consent to the transfer and processing of your data in the United States and, where applicable, other countries.

We may revise this Privacy Policy. Material changes will be posted on this page with a new effective date. If you have an account on file, we will notify you by email at least fourteen days before material changes take effect.

For privacy questions, data-access requests, or anything else covered by this policy, please reach out at the appropriate address below.