Privacy Policy

Effective date: October 15, 2026

Cariora ("Cariora", "we", "us") operates the Cariora service (the "Service"), which lets you create or adopt AI companions — pets or people — from a photo or a description, and talk, play, and spend time with them. This policy explains what data we collect, how we use it, who processes it on our behalf, and the choices you have.

If you have any questions, use the address on our Contact page.

AI service providers

The iPhone and Mac apps ask for your agreement before first use of AI features and record the time and disclosure version. You can continue only after your agreement is saved, or sign out if you decline. Only the services needed for a feature receive its data; every request is not sent to every service.

Text and chat. Messages, relevant chat history and memories go through OpenRouter to DeepSeek or Google Gemini to write replies and organize memories. Other text generation may also use OpenAI through OpenRouter, Google Gemini, or kie.ai. When text safety screening is enabled, OpenAI checks text, with SeeAPI as a backup.

Voice and audio. Text to speak, voice descriptions or voice samples you provide go to ElevenLabs or MiniMax (sometimes through fal.ai) for speech, voice design or cloning. Recordings needing server transcription go to ElevenLabs through fal.ai, or to OpenAI through OpenRouter. Song descriptions and lyrics go to Suno models through kie.ai to create songs.

Photos and appearances. Photos, appearance descriptions and necessary generated frames go through OpenRouter to Google Gemini or OpenAI for image understanding, identity, apparent-age and quality checks. kie.ai and fal.ai use the needed images and descriptions to create appearances and clips (including models from Google, OpenAI, MiniMax, Kling and ByteDance). OpenAI screens uploaded originals for safety, with SeeAPI as a backup.

These services may process data outside your country. Their processing and retention follow their own terms. Agreeing alone sends no content; transfers depend on the features you use.

Information we collect

Account information. When you sign up we collect your email address and, if you sign in with Google or GitHub, the display name and avatar those providers share with us. You sign in with a one-time code we email you, or through Google or GitHub. If you choose to set a password, which you can do only with a code sent to your address, we store it only as a one-way hash, never the password itself. We also record that you confirmed you are 18 or older, and when.

Photos and generated assets. Photos you upload — of your pet, of yourself, of someone you know or miss, or of places — and the images, animations, and other assets generated from them.

Photos of people. Upload a photo of a person only if you have the right to use it. A memorial companion's photos are used only for that companion; they cannot be published or used for romance. We do not create face templates or facial-recognition data from your photos.

What you tell your companion. Messages you send your companion, and the memories the Service derives from them so the companion can refer back to what you said.

What you write when making a companion. Its name, how it looks, its personality, private notes about it, and things you ask it to know — for a memorial companion, the memories you share about the person.

Voice messages. When a recording needs server-side transcription, we send it to ElevenLabs Scribe through fal.ai, or to OpenAI’s transcription models through OpenRouter, to turn it into text. We do not store these transcription recordings.

Sensitive details you choose to share. Conversations and memorial companions can include things about health, grief, family, or beliefs. We use what you share only to run your companion, never for advertising, and it is deleted with that companion. Share only what you are comfortable with.

Billing information. When you purchase credits or a subscription we keep records of your plan, credit balance, and transaction history. Payments are processed by our payment partners — Stripe, PayPal or Creem, depending on how you pay. We never receive or store your card number or full payment credentials.

Usage and technical data. Like most web services, we receive your IP address, browser and device information, and records of how you use the Service (for example, which features you use and when). We use an essential session cookie to keep you signed in.

Support messages. If you contact us, we keep the correspondence so we can respond and improve support.

Mac app sign-ups. If you leave your email on our desktop pet page to hear when the Mac app is ready, we keep that address, the language you were reading in, and when you signed up. We use it for one email, on the day the Mac app can be downloaded, and for nothing else: no newsletter, no marketing. You do not need an account to sign up. To be removed, write to us from the Contact page; deleting your Cariora account also removes any sign-up made with its email address.

How we use your information

We use the data above to:

• provide the Service — create your companion from your photos or description and let it respond to you;
• authenticate you and keep your account secure;
• process payments, credits, and subscriptions;
• send transactional email such as sign-in verification and billing receipts;
• prevent fraud and abuse, and enforce our Terms of Service;
• understand aggregate usage so we can improve reliability and features;
• respond to your support requests.

Messages from your companions. A companion may leave you a short message on the site, at most one a day across all your companions; you can turn this down or off under "Between you". Ongoing emails require you to check the permission box, which is off by default. In the United States, if your email is verified and you have not returned, each companion may send one first-meeting follow-up 20–48 hours after you meet, without turning on ongoing emails. Elsewhere, or when the region is unknown, we ask first. A previous refusal, unsubscribe, or disabled messages stops this automatic email. We determine whether prior permission is required from the network country and retain only that policy classification, not your IP address. Every email carries a one-click unsubscribe link that needs no sign-in, and unchecking the box also stops email. We record room visits and each message (which companion, when, and whether it was delivered or opened) to respect these limits and avoid sending the follow-up after you return.

We do not sell your personal information.

Legal bases (EU, EEA, and UK)

Where the GDPR or UK GDPR applies, we rely on:

• performing our contract with you — to run your account and companions, process what you ask for, take payments, and send transactional email;
• your consent — for Analytics and Marketing cookies and Microsoft Clarity, for ongoing emails from your companions where we ask first, and for the written release before a voice is made from a recording. You can withdraw consent at any time; this does not affect what happened before;
• our legitimate interests — to keep the Service safe and secure, prevent fraud and abuse, enforce our Terms, count visitors on our server without cookies, and understand aggregate use so we can fix what is broken. You can object to this use;
• legal obligations — to keep tax and accounting records, answer lawful requests, and report what the law requires us to report.

How AI processes your photos and messages

Photos you upload are processed by third-party AI generation providers acting on our behalf, in order to create and animate your companion. Messages you send your companion are processed by third-party AI text providers for the same reason. The providers are listed under "Service providers".

We send a provider only what a request needs, and only to produce your result. Each provider handles what it receives under its own terms; some keep it for a short time, for example to detect abuse. We do not use your photos, recordings, or messages to train AI models.

Voices

A voice you make. You can give a companion a voice made from a short recording, or one described in words. We make a voice from a recording only after you confirm you have the right to use that voice. The recording goes to our voice provider to create the voice: a recording made while creating a companion is deleted as soon as the voice exists, and a recording made in your voice library is never stored by us. A voice described in words uses no recording at all.

What we keep. The voice itself is kept by our voice provider — ElevenLabs for a voice made from a recording, MiniMax for a voice described in words or made from a recording before we moved to ElevenLabs — and we keep short sample lines in that voice so you can hear it, along with a record of each voice you made: its name and when you confirmed you had the right to use it.

When it is deleted. Deleting a companion deletes the voice it was made with at our provider, unless another of your companions still uses it. Voices in your voice library stay until you delete your account, which deletes every voice you made. A voice that companions others adopted from you on the marketplace still speak with is kept for them. The provider's own short-term processing records are governed by its terms.

Biometric information

What it is. When you make a voice from a recording, our voice provider derives a voiceprint from it — a model of how that voice sounds, which some laws (including the Illinois Biometric Information Privacy Act) treat as a biometric identifier. A voice described in words is not made from anyone's recording and carries no voiceprint of a real person.

Your written release. Before any recording is used, you give two separate confirmations: that you have the right to use the voice, and a written release agreeing that a voiceprint may be created for the one purpose below. We record when you gave the release.

Why we use it. Only so the companion, or the voice in your voice library, can speak in that voice. We never use a voiceprint to identify anyone, and we never sell, lease, trade, or otherwise profit from it. We disclose it only to the voice provider that creates and stores it (ElevenLabs, or MiniMax for an earlier voice, both listed under "Service providers"), or where the law requires.

Retention and destruction. The recording itself is not kept: one made while creating a companion is deleted as soon as the voice exists, and one made in your voice library is sent to the provider without being stored by us. The voiceprint is kept by the provider only while the voice is in use, and destroyed as follows: deleting a companion deletes the voice it was made with, unless another of your companions still uses it; deleting your account deletes every voice you made, right away. A voice that companions others adopted from you on the marketplace still speak with is kept for them until those companions are deleted.

A voice made without permission. If you believe someone made a voice on Cariora from your recording without your permission, write to the support address on our Contact page with the details. We will look into it and delete the voice if it was made without the right to do so.

Camera games. Some games can use your camera, only after you turn it on. The picture is read on your own device, where the positions of your hand (and, in a game that needs it, whether a face is in view) are worked out and used for that round only. The camera picture and these hand and face points are never uploaded, stored, used to identify anyone, or kept as a biometric template or identifier. Turning the camera off, or leaving the page, stops it. We count only that the camera was turned on or off and how a round was read (for example, “too slow”), never anything from the picture.

Safety

Text safety screening is currently off. If enabled, messages and replies are screened by OpenAI, with SeeAPI as a backup when OpenAI cannot answer. Uploaded original photos are screened by those services; generated derivatives are not screened again for this purpose, but still receive identity, apparent-age and quality checks. We send the necessary text or images, without account identity. When a message suggests someone may be at risk of harming themselves, the companion shows crisis resources instead of an ordinary reply. We count how many times those resources were shown each day, with no account, companion or message attached, so we can report that number where the law requires. When you sign up we record that you confirmed you are 18 or older, and when. More on our Safety page.

Private creations and public links

Group portraits and scene references are stored encrypted for the requested creation only. Approved references expire after seven days; rejected references expire after 24 hours. Deletion removes access immediately and storage cleanup follows after a short in-flight upload grace period. Generated private images remain in your account until you delete them or the account/companion is removed. Inputs and results are checked by automated image review. The generation and review providers receive the images needed to process your request; their own temporary processing retention is governed by their terms and cannot be erased through a Cariora link revocation.

We limit reference-image reviews to 12 per account per UTC day. A review attempt counts even if the image is rejected or later deleted, because the review request may already have reached the provider. The review date and quota claim become eligible for scheduled deletion after 90 days; the claim contains no image content.

A completed, eligible image stays private unless you explicitly publish a public link. Anyone with that link can view and save the reviewed original image; link previews show a smaller AI-marked version. Revoking the link or deleting the creation stops Cariora from serving it, but cannot recall copies already saved by others or cached outside our control. Memorial and minor images cannot be published. A signed-in viewer can report a public image; repeated reports suspend a link automatically. A separate rights or privacy removal request asks for a contact email and explanation and is reviewed before any removal action. We retain that request until it is handled or the account is deleted.

Shared links to memories and clips. You can also open a public link to a photo, a moment or a short clip of your own companion. We store which item the link shows, when you made it, and, for a companion whose look came from a photo of a real person, your confirmation that you are that person or have their permission. The page shows your companion's name and that item, never your name or account. Media is served only through the link while it is live; taking a link down under Settings → Shared links, deleting the item or the companion, or a confirmed removal request (including a TAKE IT DOWN request) stops it at once. Memorial companions cannot be shared publicly.

The plaza

When the plaza is open and you choose to show a companion there, we store a copy made for the plaza: the companion's name, its kind or breed, its personality, the picture and short clip shown, when you shared it, and whether it is under review, shown, turned down, taken down, or withdrawn, with the reason for a decision. That copy never includes your name, your photos, private notes, what you told the companion, its chats, or a voice made from a recording. Anyone visiting Cariora can see a shown companion. We store each like (which account liked which companion, and when) and each report (who reported, the reason, any note, and how it was handled). A note in a report is read only by our moderators.

You can block an author using an independent anonymous author code. We store which accounts you block and when, so their works stay out of your Plaza until you unblock them. Works you report are also hidden from your Plaza. Blocking affects only your view. Block records are removed when either account is deleted.

Retention and deletion

Saved animal designs and species requests. When you save a design for another small animal, we store its name, the photo, ready-made look or words it came from, what our check read from them (the kind of animal, its body and colors, and a first guess at its sex and age that you can change), your choices of personality and first home, when you saved and changed it, and whether it has been made. To read a photo or description, we send it to Google's Gemini model through OpenRouter; typed words are also checked by our text safety provider (OpenAI). A request for a kind of animal we don't make yet stores only the few words you wrote. Designs and requests are private: our operators see them to decide which kinds to open next. A design that is never made is deleted 90 days after you last changed it, and a closed request 30 days after it closed. You can delete either yourself at any time from the Create page, and all of them are deleted with your account. Saving a design never starts paid work.

Uploaded original photos are deleted 90 days after you upload them, unless the photo is still in use: your profile picture, the photo a companion's look or portrait was made from, a photo pinned on a companion's keepsake board, a photo in a companion you are still creating, or the photo a saved animal design was made from. A photo in use is kept while it is in use and deleted with that companion or your account. Photos you send in a chat are deleted after 90 days like any other upload. Generated assets, chats, and memories are kept while the companion exists.

Deleting a companion deletes its chats, memories, diary, photos, generated files, and the voice it was made with. A file that is also part of someone else's companion stays for them — for example an official companion's pictures, or a companion you shared on the marketplace that others adopted. We keep an empty record of the deleted companion, with no name or content, so that purchases and marketplace records linked to it still add up.

You can delete your account yourself under Settings → Profile. Deletion waits while a paid plan is still running or a marketplace share is still on hold. When you delete your account, we right away delete your companions as described above, your uploads, the voices you made, your drafts, support messages and settings, take your listings off the marketplace, and remove your name, email address and profile picture; you can no longer sign in. Encrypted private images are removed by the next scheduled cleanup. Anything others already adopted from you stays with their copies. We keep order, payment, subscription and credit records for as long as tax and accounting laws require, linked only to an anonymous account number. We also keep the record of which features were used and when — never anything you wrote, said or uploaded — linked only to that same anonymous account number, so we can understand aggregate use. Reports you filed about marketplace listings or public images are kept for moderation.

Support feedback includes your account email, subject, message, and handling status. We use it to answer your request. Resolved feedback is scheduled for deletion after 180 days; unresolved requests remain until handled, or are deleted with the account. Privileged action records contain account identifiers and limited change summaries, without message bodies or secrets, and are scheduled for deletion after 365 days.

Weather

To let a companion mention your local weather, we estimate a rough location from your IP address (to about 1 km) and send only those rough coordinates to MET Norway's weather service. We do not store them. You can turn this off for each companion under "Between you". Weather data comes from MET Norway, licensed under CC BY 4.0.

Service providers

We rely on these providers to run the Service:

• Cloudflare — hosting and running the Service
• Neon — our database, hosted in the United States
• Stripe, PayPal and Creem — payment processing and billing
• OpenAI and SeeAPI — OpenAI screens uploaded original images for safety and, when enabled, text; SeeAPI is the backup when OpenAI cannot answer
• Cloudflare Turnstile — a security check on the email sign-in form, and when you set a password, that tells people from bots
• Cloudflare R2 — storage and delivery of uploaded photos and generated assets
• Resend — transactional email delivery
• MET Norway — weather forecasts, from rough coordinates only, as described above
• OpenRouter — passes text, and the photos a request needs, to the AI models that write companions' replies, read photos and designs, check clips, and turn voice messages into text. The models we use through it are made by Google (Gemini), OpenAI, and DeepSeek
• kie.ai and fal.ai — run the image, video, music, and sound models that make your companion's pictures, clips, and songs, from makers such as Kling, ByteDance, Google, OpenAI, MiniMax, and Suno
• Microsoft Clarity — with your Analytics consent only, as described under "Cookies and consent"
• Google Fonts — delivers some of the fonts on our pages, so your browser sends Google its IP address when it loads one
• Google and GitHub — sign-in, if you choose to use them
• ElevenLabs — speaks companions' lines and makes voices from recordings, as described under "Voices"
• MiniMax — voices described in words, earlier voices made from recordings, and speaking a line when ElevenLabs is unavailable

Each provider receives only the data necessary to perform its function.

Cookies and consent

We group cookies and similar technologies into three categories:

• Essential — required to run the Service, including the cookie that keeps you signed in, the cookie that records your consent choice, the Cloudflare Turnstile security check on the email sign-in form and when you set a password (it loads only there), and a note in your browser of whether you last signed in with a code or a password, so the form opens on that step. These are always active and do not require consent.
• Analytics — with your Analytics consent, we set one first-party cookie, cariora_ft, for 30 days. It records only the kind of site or link that first brought you (for example a search engine, a social site, an AI assistant, or a campaign name in the link), the type of page you landed on, and the day. When you accept Analytics on a page that doesn't show where you came from, we fill the cookie from that day's server-side note described below. We read it once when you create an account, to note that source on your sign-up record. You can withdraw your consent at any time in Cookie preferences, which deletes the cookie.
• Analytics (Microsoft Clarity) — with the same consent, we load Microsoft Clarity, which records how pages are used (clicks, scrolling, mouse movement, page views) as heatmaps and session replays so we can find what is confusing or broken. Text you type into fields is masked before it leaves your browser. Clarity sets its own cookies (such as _clck and _clsk, up to one year) and Microsoft processes this data on our behalf under the Microsoft Privacy Statement. Withdrawing Analytics consent deletes these cookies and stops it from the next page.
• Marketing — cookies set by third-party services we embed, such as the Google sign-in prompt. We do not use advertising or affiliate cookies. These load only after you consent.

If you arrive through a friend's invite link, we set one first-party cookie, cr_ref, for 30 days. It holds only that invite code, so that, if you make a first qualifying payment, the invite reward reaches you and your friend; it is part of the reward you followed the link for rather than analytics, so it does not depend on your cookie choices.

When non-essential cookies are configured, we show a consent banner on your first visit. Nothing in the analytics or marketing categories loads until you choose Accept. You can change or withdraw your choice at any time using the Cookie preferences link in the footer.

Separately, we count daily visitors on our server. This is server-side measurement: it stores nothing on your device and runs regardless of your cookie choices. Our server turns your IP address and browser information into a code that changes every day, and notes which kind of site or link brought you. We keep only that daily code and that kind of source, never the IP address, the browser information, or the full address of the page you came from. If you create an account and there is no cariora_ft cookie, we use that code once to add the same note to your sign-up record. This works for a visit on the same day (UTC); if you sign up within six hours after midnight UTC, a visit from the day before also counts.

We honor browser opt-out preference signals: if your browser sends Global Privacy Control (GPC) or Do Not Track, we treat it as a request to reject non-essential cookies and do not show the banner. We do not use your photos or messages for advertising.

Your rights

Depending on where you live (including under the GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Use the address on our Contact page to exercise these rights; you can also download your data and delete your account yourself under Settings → Profile. We will respond within the timeframe required by applicable law. We may need to confirm the request comes from you, usually by replying from your account email.

• Withdrawing consent. You can withdraw any consent at any time, for cookies in Cookie preferences and for emails through the unsubscribe link.
• If we say no. If we decline a request, we tell you why; you can ask us to reconsider by replying. In the EU, the EEA, or the UK you can also complain to your data protection authority.
• US state privacy laws. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We honor Global Privacy Control as described above. You can use an authorized agent to make a request where your state allows it, and we will not treat you differently for exercising your rights.

International data transfers

The Service runs on global cloud infrastructure. Our database is in the United States, and the providers listed above process data in the United States and other countries, so your data may be processed in countries other than your own. Wherever it is processed, we protect it as described in this policy.

Children

The Service is for adults only and is not for anyone under 18. Everyone who signs up confirms they are 18 or older, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has an account or has provided us personal data, contact us and we will close the account and delete the data.

Security

We protect your data with encryption in transit, our storage and database providers' encryption at rest, sign-in codes that expire after 10 minutes, optional passwords stored only as one-way hashes, and access limited to the people who run the Service. No online service can guarantee absolute security, but we work to protect your data with industry-standard measures. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Changes to this policy

We may update this policy as the Service evolves. We will post the updated version on this page and, for material changes, notify you by email or in-product notice before the changes take effect.

Contact

Cariora — operator of the Service Support address: Contact page