Privacy Policy

Dyva, Inc. ("Dyva," "we," "us") is a Delaware corporation. We run dyva.ai — a social AI platform where people create, share, and chat with AI characters.

This Privacy Policy explains what data we collect, why we collect it, who we share it with, and what rights you have over it. It covers everything: the website, apps, API, integrations, embed widgets, and any other Dyva service.

Under GDPR, Dyva is the data controller. Under CCPA, Dyva is the business that determines how your personal information is processed.

We're going to be straight with you in this document. If you don't agree with how we handle data, don't use the service.

2.1 Information You Give Us

• Account data. Email, display name, password. Optionally: avatar, date of birth, gender, bio.
• Conversation data. Every message you send to an AI character — stored for conversation history, memory features, and continuity across sessions.
• Voice data. If you use voice features, we process your audio for speech-to-text transcription and generate spoken responses via text-to-speech. If you upload voice samples for custom cloning, those are stored too (see Section 5).
• Payment data. Billing details go through Stripe. We never see or store your full card number. We get transaction confirmations, subscription status, and the last four digits.
• Content you create. Character configurations, system prompts, knowledge base uploads, scenes, comics, published Marketplace characters, feed posts, profile content — all of it.
• Communications. Support emails, feedback, bug reports — we keep those to help you and improve the service.

2.2 Information We Collect Automatically

• Sign-in history. Each sign-in attempt on your account: whether it succeeded, the method used, the IP address, the user agent, and the device, browser, and OS derived from it. You can review this in Settings, it is included in your export, and it is deleted with your account.
• Share-page views. When someone opens a publicly shared character page, we record that a view happened, the event type, and the referring site. No visitor identifier is stored. Views are not recorded at all for a request carrying a Global Privacy Control signal.
• Crash and error reports. If the app throws an error, we receive the message, stack trace, route, and browser — with tokens, emails, and session values redacted before the report leaves your device. These stop entirely when you choose "Essential Only" in the cookie banner.
• Product usage events. The app emits interaction events, and the endpoint that receives them currently discards them without storing anything. If we ever start retaining them, we will say so here before we do.
• Log data. Access timestamps, referring URLs, and request metadata. IP addresses are used transiently for rate limiting and abuse prevention; where we bind a session or a guest token to a client, we store a SHA-256 hash rather than the address. We do not build advertising or cross-site profiles from IP addresses.
• Cookies. A signed-in flag, your language choice, and — only where they apply — a mobile-subdomain flag, an age-check token, and a record that your browser sent a privacy signal. No cross-site tracking. No ad pixels. The full inventory is in our Cookie Policy.

2.3 Information from Third Parties

• OAuth providers. If you sign in with Google or Discord, we receive your name, email, and avatar — whatever you authorize during the OAuth flow.
• Stripe. Transaction confirmations, subscription status, last four digits, billing postal code.

Here's what we do with your data and why. For users in the EEA, UK, and Switzerland, we've listed the GDPR legal basis for each purpose.

Where we rely on legitimate interest, we've confirmed our interests don't override your fundamental rights. You can request a copy of that assessment anytime.

This is the part most people care about. Here's exactly how AI processes your data.

4.1 What Gets Sent to AI

When you send a message, the AI processing pipeline receives:

• Your current message and relevant conversation history (context window)
• Your display name and profile attributes needed for personalization
• The character's system prompt, personality config, and knowledge base context
• Relevant memories from past conversations (the character's memory of you)

Your email, password, payment information, and IP address are never sent to AI models. Period.

4.2 Memory System

Characters on Dyva have persistent memory. Facts you share — preferences, interests, biographical details — get stored as vector embeddings so the character can recall them in future conversations. A memory belongs to you and to the character that formed it. It is never shared with other users, and never shared with another character unless you turn on shared-room context (below).

4.3 Your Memory Controls

Four separate controls. They are independent — changing one does not change the others — and they do genuinely different things, so it matters which one you reach for.

• Memory master switch. One switch in Settings → Data Controls stops both halves of memory across every character at once: nothing new is learned, and nothing already stored is recalled. It does not delete anything. Existing memories stay exactly where they are, dormant, and become available again if you switch it back. Use the memory list, not this switch, when you want something gone.
• Per-character memory. Every character has its own memory list. You can read it, edit an entry, pin one, forget one, restore one you forgot, or clear that character's memory of you entirely — without touching any other character.
• Per-conversation memory. Each conversation has its own memory switch in the chat settings panel, so you can leave memory on for a character but keep one conversation out of it.
• Forget. Forgetting a memory switches it off and propagates outward: it is removed from caches, from canonical entries derived from it, from quote cards and chips built on it, and from any pending message that was going to reference it. The entry itself is kept in a disabled state so you can restore it, it appears in your data export marked as forgotten, and it is deleted outright when you delete your account.

4.4 Shared-Room Context

When you are in a room with more than one character, those characters do not carry what happened there into your private 1:1 chats unless you allow it. Shared-room context is off by default and is an explicit opt-in in Settings → Data Controls. Turning it on covers room events only — what was said in a room you were in. It never gives one character access to your private conversations with another.

4.5 When a Character Reaches Out First

A character can form a reason to message you before you message it — internally we call it a knock. The capability exists in the product and is governed by the controls below, but delivery is currently switched off: no knock is delivered to a user, and the push notification for it defaults to off. Nothing in this section describes messages you are receiving today.

If and when delivery is enabled, these govern it, and all of them are re-checked at the moment of delivery rather than only when the message was formed:

• Per-relationship cadence. How often a given character may reach out, set per character.
• Do Not Disturb. Suppresses every push category except system notices, either until you turn it off or until a time you pick.
• Quiet hours. A window in your own local time, stored with your timezone so it stays correct across daylight saving.
• Push opt-in. Push for character-initiated messages is its own switch in notification settings and is off unless you turn it on.

All of these settings are included in your data export and deleted with your account.

4.6 AI Processing Infrastructure

We use a combination of proprietary and third-party AI infrastructure for generating responses. Some features like intent classification, content safety, and content analysis use additional model services. Your data is processed for the inference you requested — response generation, not model training (see Section 8 for the training permission, which is off unless you turn it on).

4.7 No Automated Decisions with Legal Effects

We don't use your data for automated decisions that produce legal or similarly significant effects (GDPR Article 22). AI responses are conversational output — not decisions affecting your legal rights, employment, credit, or anything like that.

Voice is one of the more sensitive data categories we handle. Here's the full picture.

5.1 Speech-to-Text (What You Say)

When you speak during a voice conversation, your audio is transcribed to text in real time by our speech recognition provider (Deepgram). The raw audio is discarded immediately after transcription — it is not stored. Only the text transcript is retained as part of your conversation history.

5.2 Text-to-Speech (What the AI Says)

AI text responses are converted to spoken audio by our TTS provider (ElevenLabs). The synthesized audio is streamed to you and not stored after playback. Text inputs are not retained by ElevenLabs after synthesis is complete, per our data processing agreement.

5.3 Custom Voice Cloning

Pro and Creator plans can upload audio samples to create custom character voices. Those samples are processed to build a voice model and retained for the duration of your subscription plus 30 days to allow for model updates. You can delete a voice model and its source samples anytime from your character's voice settings.

5.4 What Voice Providers See

Deepgram receives your raw audio for transcription. ElevenLabs receives AI-generated text for synthesis. Neither provider receives your account information, conversation history, or any other personal data. Both are bound by data processing agreements.

We do not sell your data. We do not share it with ad networks. We do not trade it.

We share data only in these situations:

• Service providers. The companies that help us run Dyva, bound by data processing agreements:

• Legal requirements. When required by law, regulation, legal process, or enforceable government request — including national security or law enforcement.
• Protection of rights. To investigate illegal activity, fraud, threats to safety, Terms violations, or as evidence in litigation.
• Business transfers. If Dyva is acquired, merged, or sells assets, your data may be part of the transaction. We'll notify you of any ownership change.
• With your consent. When you explicitly ask us to — like publishing a shared conversation link or connecting a character to Discord.
• Aggregated data. We may share anonymized, de-identified data that cannot identify you for research or analytics.

6.1 What a Character's Creator Can See

Creators publish characters; they are not given a window into the people who talk to them. A creator receives aggregate reporting only — counts and trends for their character.

• Creators do not see your conversation text.
• Creators do not see quotes, excerpts, or evidence drawn from what a character remembered about you. Where a creator can see that a character reached out with a grounded reason, they see that it happened — never the wording, and never the source it was grounded in.
• Creators cannot target, filter, or address an individual user on the basis of anything held in memory.

We keep data only as long as we need it — or as long as the law requires.

7.1 What Account Deletion Actually Does

Deleting your account runs immediately, as a single database transaction, and writes a receipt recording how much was deleted, anonymized, and retained. Running it again changes nothing. Your data does not have one fate — it has three.

• Deleted outright. Your private conversations and every message in them. Your memories and everything derived from them — episodes, observations, corrections, a character's model of you, relationship and mood state, goals, open questions, and proactive-message logs. Your credentials, sessions, two-factor secrets, backup codes, push endpoints, API keys, and sign-in history. Your library and activity: follows, blocks, saved and hidden characters, ratings, collections, bookmarks, notification and chat preferences, streaks, XP, achievements, and rewards. And any character or room nobody else engaged with.
• Anonymized — the text stays, your identity comes off it. Messages you posted in shared rooms; messages you authored inside a conversation someone else owns; group posts; community threads and their replies; comments under other people's posts and creator videos; feed posts; highlighted posts in shared spaces; and live-stream chat lines other viewers saw. These stay because deleting them would tear holes in other people's conversations, which are their data too. What is removed is the link to you: the byline becomes "Deleted account" and the user reference is cleared.
• Direct messages are a middle case. The content of a direct message you sent is erased — text, images, audio, and transcript — and the message is marked deleted. The row itself has to survive, because a direct message is a two-party record the recipient's thread points at, and removing it would take their side of the conversation with it.
• Retained, because erasure does not override another legal duty. Under GDPR Article 17(3)(b) — and Article 17(3)(e) for safety reports — we keep: commerce orders and the entitlements they granted; the spark ledger and the credit lots behind it; credit transactions including the processor reference; billing addresses on issued invoices; creator tax information; creator earnings, payouts, payout requests, and adjustments; character and creator subscriptions; tips and gift subscriptions sent or received; age-verification and identity-verification records (the provider name and a one-way reference hash, held as proof the check happened); safety reports you filed, so an investigation into someone else does not die with your departure; and the administrative audit log.

Your account row survives as a tombstone. Email, display name, username, avatar, biography, password hash, date of birth, and linked Google or Discord identities are cleared from it. The row itself cannot be removed, because the payment records we are required to retain are attached to it and would be destroyed with it — and because that row is what makes a second deletion request a safe no-op.

Characters and rooms other people are in stay. A character someone else has chatted with, bought, or subscribed to, and a room someone else joined or posted in, are not yours alone to destroy. They remain, owned by the tombstone rather than by you.

Your data, your rights. Exercise them by emailing [email protected] or using the tools in your account settings. Here's what you can do:

• Access and export your data. Settings → Data Controls → Export data returns a single JSON document, generated on demand, with 24 sections: your profile, preferences, and consent state; your notification and door settings, including Do Not Disturb, quiet hours, and knock push; your per-character preferences; the rules you accepted; the characters you created; every conversation and every message in it; your memories, including the ones you switched off or forgot; your room memberships and the messages you posted in those rooms; your direct messages; orders; entitlements; the spark ledger; credit transactions; trust events; follows; saved characters; ratings; bookmarks; collections; sign-in history; sessions; and age-verification records. Each section reports its own row count, and if a section is truncated or fails, the export says so rather than quietly returning less. (GDPR Art. 15 and Art. 20 / CCPA 1798.100)
• Delete your data. Settings → Data Controls → Delete account, or email us. Section 7.1 sets out exactly what is deleted, what is anonymized with the text kept, and what we are required to retain — read it before you decide. (GDPR Art. 17 / CCPA 1798.105)
• Correct your data. Fix inaccurate or incomplete information. This includes correcting what a character believes about you: edit or forget the memory directly in that character's memory list. (GDPR Art. 16 / CCPA 1798.106)
• AI training is opt-in, and it starts off. Permission to use your content for model training is off for new accounts and was reset to off for every account that already existed — the earlier default had opted accounts in, which is not what "opt-in" means, so we cleared it rather than treat it as consent. Turning it on is a deliberate act in Settings → Data Controls, and turning it back off applies to all future processing. Voice-clone training is a separate switch and is also off by default. (See also Section 4.)
• Global Privacy Control. If your browser or extension sends a Sec-GPC: 1 signal, we honor it across the platform without you having to ask: training permission is forced off on your account and stays off while the signal is present, and we do not record share-page views for your requests. Data Controls shows the signal only when we are genuinely receiving it. We also accept the legacy DNT: 1 header the same way — see the Cookie Policy.
• Object to processing. If we're processing based on legitimate interest, you can object. We'll stop unless we have compelling grounds that override your interests. (GDPR Art. 21)
• Restrict processing. In certain situations — you contest accuracy, processing is unlawful, you need data for legal claims — you can ask us to restrict how we use it. (GDPR Art. 18)
• Withdraw consent. Where processing is based on consent, withdraw it anytime. Doesn't affect the lawfulness of prior processing.
• No sale of your data. We don't sell personal information. We don't share it for cross-context behavioral advertising. If this ever changes, we'll provide a "Do Not Sell or Share" option. (CCPA 1798.120)
• Non-discrimination. Exercising your rights won't affect your pricing, service quality, or access. (CCPA 1798.125)

We respond within 30 days (extendable by 60 for complex requests under GDPR). For CCPA requests, we verify your identity by matching information you provide with our records. You can designate an authorized agent with written authorization.

Dyva is not for children under 13. We do not knowingly collect personal information from anyone under 13, in compliance with COPPA (15 U.S.C. 6501-6506).

EEA users: The minimum age is 16 (or lower where local GDPR implementing law permits) per GDPR Article 8.

How we check. Age is self-declared. At sign-up we ask for your date of birth and refuse the account if it states an age under 13. We do not verify age at registration — that check is the answer you give us, not a document or a database. Where a jurisdiction or an age-restricted area of the product requires more, we run a separate third-party verification and keep only the provider's name and a one-way reference hash as proof the check happened.

If we discover we've collected data from a child below the applicable age threshold, we delete it. Fast.

Parents and guardians: If you believe your child provided data without your consent, contact [email protected] immediately. We'll verify and delete it. Users aged 13-17 need parental consent as described in our Terms of Service.

Dyva is US-based. Your data is processed and stored on US servers. If you're outside the US, your data crosses borders.

For transfers from the EEA, UK, or Switzerland to countries without adequate data protection (per GDPR Articles 44-49), we use:

• Standard Contractual Clauses (SCCs). The European Commission's SCCs (Decision (EU) 2021/914) with sub-processors, supplemented by transfer impact assessments.
• EU-U.S. Data Privacy Framework. Where applicable, we rely on sub-processors' self-certification under the EU-U.S., UK, and Swiss-U.S. frameworks.
• Supplementary measures. Encryption in transit (TLS 1.2+), encryption at rest, access controls, and pseudonymization where feasible — consistent with the Schrems II requirements.

Want a copy of our SCCs or more details about transfer mechanisms? Email [email protected].

We take security seriously. Here's what we do (per GDPR Article 32):

• Encryption in transit. All data between your device and our servers is encrypted with TLS 1.2 or higher.
• Encryption at rest. Sensitive database data is encrypted at rest with industry-standard algorithms.
• Password security. Passwords are hashed with bcrypt and per-user salts. We never store plaintext passwords.
• IP handling. Where an IP address is used to bind a session or a guest token to a client, we store a SHA-256 hash instead of the address. Your sign-in history is the one place we keep the address itself, so that you can review where your account was accessed from; it is shown to you in Settings, included in your export, and deleted with your account. We do not use IP addresses to build advertising or cross-site profiles.
• Access controls. Personal data access is restricted to authorized personnel on a need-to-know basis with multi-factor authentication.
• Infrastructure security. Firewalls, intrusion detection, and regular security audits.
• Incident response. We maintain a breach response plan. If a breach affects your data, we notify you and the relevant supervisory authority within 72 hours per GDPR Article 33 and applicable state laws.

No system is perfectly secure. We can't make absolute guarantees. But we address vulnerabilities fast and take every incident seriously.

This policy may change as our practices, technology, or legal requirements evolve.

• Non-material changes. We update the effective date and post the revision. We encourage you to check back periodically.
• Material changes. If we change how we handle your data in significant ways — new data categories, new purposes, new sub-processors — we'll notify you by email or in-app notice at least 30 days before the change takes effect.
• Consent where required. If law requires your consent for a material change, we'll get it first. If you disagree, delete your account before the changes take effect.

Continued use after a revision means you accept it, to the extent permitted by law.

Questions about your data? We'd rather you reach out than wonder.

Supervisory Authorities

If you're in the EEA, UK, or Switzerland and believe we've violated your GDPR rights, you can file a complaint with your local supervisory authority (GDPR Article 77). EEA authorities are listed at edpb.europa.eu. In the UK, contact the ICO at ico.org.uk.

But reach out to us first. We want to fix things directly.