Paramour. Privacy Policy

Last updated 26 October 2026

Paramour is an app for chatting and talking with AI characters on iPhone and iPad. This policy says what we collect, why, who else receives it, how long we keep it and what you can do about it. It describes the complete app: chat, voice messages, live calls, photos, the Journal, calendar, health, weather, widgets, notifications and subscriptions.

Controller: Paramour (a trading name), based in the United Kingdom ("we", "us"). Postal address: 9 Chatteris Way, London SE17 1GY, United Kingdom. Contact: hello@paramour.fun. We have not appointed a Data Protection Officer or a representative in the EU or UK.

In short

• Paramour is for people aged 18 and over.
• Your messages, and what you share with a character, are sent to AI providers so the character can reply and speak. They are listed below.
• Calendar, health, location and photos are optional. Calendar, health and location each need your permission in iOS, and you choose which photos to send, up to three at a time, in the iOS photo picker. Health sharing also needs your agreement in the app.
• We do not sell your data, we do not use it for advertising and we do not track you across other companies' apps or websites. The app has no analytics, advertising or crash-reporting SDK.
• Talking to a companion can reveal personal things about you, including details of your private life, relationships and health. Share only what you are comfortable sending to the providers listed below.

What we collect and why

• Account: how you signed in (Apple, Google or an email code), the email address that sign-in gives us (with Apple this can be Apple's private relay address, or a placeholder if Apple withholds it) and an account identifier. With Google we also receive the name and profile picture on your Google account, which we do not use. We use the email and identifier to create your account and keep you signed in.
• Your name: the name you ask the character to call you, if you give one. We use it in conversation.
• Setup answers: the character you pick and your answers to the short statements at the start. We use them to begin the first conversation.
• Chat messages: what you write and what the character replies, with the time, so the conversation can continue. Messages are the main thing we process.
• What the character remembers: short notes, conversation summaries, a diary, open topics and the state of your relationship with the character, which we derive from your messages so the character can refer back to earlier talks. The notes can include facts about your health, work, family and relationships if you talk about them. You can view, edit and delete memories in the app. Facts taken from your messages are also kept in a separate record that the app does not show yet. You cannot edit or delete single entries in it; it is in your data copy and is deleted with your account. Memory search turns this text into numeric vectors (see the providers below).
• Voice messages: you record a voice message, your phone turns it into text, and only the text and its length are sent. The recording stays on your phone. The character's voice replies are made from text and stored for you (see "Microphone, speech and calls").
• Live calls: your microphone audio is streamed from your phone to a voice provider while a call is open, and the words of the call are saved with the chat (see "Microphone, speech and calls").
• Photos you send: a text description made by Apple's models (in Apple's Private Cloud Compute, or on your phone when that is not available), including a description of any people in the picture, and, only if you opt in, a private copy of the picture (see "Photos").
• Moments from Journaling Suggestions: if you pick a Moment, its title, date, location, song, step count, a reflection of up to 300 characters, the number of photos and videos, and up to three photo descriptions.
• The Journal: a daily entry that the chat model writes from that day's messages, your sleep and the weather. It is on by default and you can turn it off in Settings under Privacy ("Journal from our talks").
• Calendar, health and weather context: see the sections below.
• Reports: if you report a reply, we store the message, the reason and any note you add. Reports are stored with the message for us to review.
• Safety checks: an automated check reads your messages and the character's replies for crisis and prohibited content. We store the type of any flag against your account, without the message text, and the time of any crisis pause.
• Age and consent records: that you confirmed you are 18 or over, how (including the answer from Apple's age range sheet), when, and which version of the AI-processing consent was recorded when you signed in. We do not store your date of birth.
• Purchases: which plan you hold, its dates, and Apple's transaction identifier (see "Purchases").
• Device push token: if you allow notifications, so we can deliver the character's messages as notifications. By default a notification only says that the character sent you a message. If you turn on the Lock Screen preview switch in Settings under Notifications, it carries the start of the message, up to 240 characters.
• Time zone and store country: to know your local day, for the daily message limit and for when the character writes to you.
• Usage state: the days you opened the app, how far through setup you are, your settings (including quiet hours and check-in times), the state of your relationship with the character and when you last read. We use it to make the app work, not to profile you for advertising.
• Server logs: for each request, the method, path, status, duration and your account identifier. The logs can also hold short fragments of the character's lines, the start of an error message returned by a provider and, sometimes, a short fragment (up to 50 characters) of a topic taken from your conversations. Our hosting platform (Supabase, behind Cloudflare) receives your IP address and device type with every request and keeps them in its own logs, and its sign-in records hold the IP address and device of each session. Services your phone connects to directly (the live-call voice provider, Cloudflare R2, which serves pictures, clips, voice audio and photo copies through signed links, Apple, the US National Weather Service, RevenueCat and Google) also see your IP address.
• On this website: paramour.fun is hosted by Vercel, the home page loads an animation library from cdnjs (Cloudflare) and the plans page loads RevenueCat's payment library from jsDelivr and its plans and prices from RevenueCat, so those services see your IP address when you visit. The site has no analytics or advertising scripts. On the plans page you answer an age question, which is not sent to us, then enter your email address and the code we email you. That signs you in and creates your Paramour account for that email address, the same account you reach in the app by signing in with an email code. A purchase on the website is described under "Purchases".

We use this to provide the app and to keep it safe, as set out under "Legal bases" below. If you do not give us your messages, the app cannot work.

Health data

• What the app reads: sleep analysis, step count and active energy from Apple Health, only after you allow it in the iOS permission sheet. The app only reads. It never writes to Apple Health.
• Why: so the character can ask how you slept, notice your day and write your Journal.
• Two steps: the iOS permission, and your agreement to share a summary, which you give by tapping Connect Apple Health during setup or Allow on the card in chat. Sharing is off until then, and you can turn it off or on at any time in Settings under Privacy (the health summary switch). Our server ignores health numbers unless sharing is on. Turning it off stops uploads and clears the stored daily summary at once.
• What leaves your phone when sharing is on: sleep minutes, wake time, steps and active energy in kilocalories, and the sleep sessions of the last three nights for the Journal. They are stored as one daily summary that is overwritten each time. The server ignores a summary older than 36 hours or from a previous local day. Sleep sessions that were already sent are kept until you delete your account, including after you turn sharing off, and they still set where a Journal day ends.
• Who receives it: the AI providers that write the character's replies and your Journal receive these numbers as part of the prompt (see the table below). Health data from Apple Health is not used in live calls.
• What we never do: we never use health data for advertising or marketing, never sell it, never share it with data brokers and never use it to build profiles for other companies.
• The character can also keep health facts you mention in chat, such as "I have a cold", as memories. These are chat content, not Apple Health data. You can delete a memory in the app; the same fact can stay in conversation summaries and in that separate record until you delete your account.

Location and weather

• If you allow location while you use the app, the app asks iOS for an approximate position (reduced accuracy) so the character can mention the weather. You can instead type a city.
• Your coordinates are not sent to our servers. Our servers only receive a short weather phrase, for example "light rain, 10-15C", and a daily weather record.
• The position is sent to Apple WeatherKit. A typed city is turned into a position with Apple Maps, and that position is sent to WeatherKit too. When the chat opens and you have allowed location, the position, rounded to two decimals (about 1 km), is also sent to the US National Weather Service to check for heat alerts. This happens wherever you are; the service only has alerts for the United States.
• If a photo you send has a location, the app sends its coordinates to Apple Maps to find the city and keeps only the city name; the coordinates never reach our servers. The city name is part of the photo description we receive.

Calendar

• If you allow calendar access, the app reads events from all your calendars, or only the ones you tick in the app. It sends the title, start and end time, all-day flag and location (up to 60 characters) of up to 80 events, from now to the end of next Sunday. It does not send notes, attendees, links or calendar names, and it does not change your calendar.
• We keep one stored copy, overwritten each time. Events that ended more than four hours ago are ignored. The titles go into the character's prompt, and each title is also sent on its own to a helper model that labels the event. Calendar event labels are removed once the event is more than seven days past, the next time an event is labelled. Corrections you make to a label, and memories the character forms from events, are kept until you delete your account. In a live call, the title of one upcoming or recent event (up to 24 characters) and when it is can be passed to the call's voice provider, so the character can ask about it.

Microphone, speech and calls

• Permissions: microphone and speech recognition, asked when you first record a voice message or start a call.
• Voice messages: recorded and turned into text on your phone with Apple's speech recognition, which the app runs on the phone only. The recording stays on your phone. We receive the text and the length.
• Live calls: while a call is open, your microphone audio streams directly from your phone to a voice provider. Depending on the call style that is our scene-writing and voice provider, or xAI (directly or through Opper). The call prompt carries the character's persona, your name, the time of day, up to three memories, the last six chat lines and, when you call again, how your last call ended. After a dropped connection it also carries what was said so far (up to 14 lines). During the call the app sends the voice provider short notes that can quote up to three more memories and one calendar event title. Each line you say is turned into text on your phone (or, when that fails, the voice provider's own transcript is used) and sent to our server, where the chat model scores it and checks it against our content rules. When the call ends, the words are saved with your chat and the call record. If the app is interrupted, a recovery copy of the open call's words stays on your phone until the call ends. We have not confirmed whether any call provider keeps audio after the call.
• The character's voice: the text of each spoken line is sent to a voice provider, which returns audio (with our scene-writing and voice provider, together with a one-way hash of your account identifier). Voice notes are stored privately in Cloudflare R2 and shown to you through signed links.

Photos

• You choose photos with the iOS photo picker, so the app does not get access to your whole library.
• The photo is read into a text description, first by Apple's Private Cloud Compute and, if that is not available, by Apple's models on your phone. The description holds what is in the photo, a description of any people in it (where they are in the frame, an estimated age band, expression, pose, clothing, hair, accessories, and whether one of them is you), any visible text, the city it was taken in, the time and which camera took it. Unless you turn on photo backup (below), only that text is sent to our servers. Our AI providers only ever receive the text, never your photo.
• To tell which person in a photo is you, the app keeps up to three photos you sent that look like selfies (taken with the front camera, showing one person who looks 18 or over) on your phone as references. When you send a photo with people in it, Apple's models, on your phone or in Private Cloud Compute, compare it with these references, and the app records only whether one of the people is you. The app does not extract or store face geometry. The references never reach our servers or AI providers, are left out of iCloud backup and are deleted when you sign out or delete your account.
• A private copy of the picture (up to 8 MB each) is uploaded to Cloudflare R2 only if you opt in, with the sheet that appears the first time or the "Back up photos" switch in Settings under Privacy. It lets the Journal keep your photos. Turning backup on also uploads the photos you sent earlier that are still on your phone. The choice is cleared when you sign out, so another account on the same phone has to choose for itself.
• Pictures the character sends come from a library of pre-made pictures. Your own photos are not used to make them. If you save a picture to your Photos, the app can only add to your library.

Widgets and notifications

• Widgets show the character's name, a status phrase, the relationship stage and the latest line the character sent. This is a snapshot kept on your device in an app group container shared by the app and its widgets. It is not sent anywhere.
• Notifications use your push token and Apple's push service. Messages from a character can appear as communication notifications with the character's name and picture; this is processed on your phone. Message text appears only if you turn on the Lock Screen preview switch in Settings under Notifications, and you can turn notifications off in iOS Settings at any time.

Purchases

Subscriptions are sold by Apple through the App Store. Apple handles payment and we never see your card details. We use RevenueCat to manage subscriptions. RevenueCat receives purchase receipts and product identifiers, an anonymous identifier created at first launch and then your account identifier, and standard technical information from its SDK. Our server asks RevenueCat which plan you hold and receives notifications when it changes, and stores the plan, product identifier, environment and Apple transaction identifier. Apple and RevenueCat keep purchase records under their own terms. If you buy a plan on our website (paramour.fun/plans), payment is taken by RevenueCat's checkout with its payment processor, Stripe: they receive your email address and payment details, and we never see your card details. The plans page loads RevenueCat's payment library from jsDelivr.

Who receives your data

These providers process data for us to run the app. Which AI provider handles a request depends on server settings that can change. DeepInfra and the Hugging Face router are alternatives for the same job, and either, or both, may receive a request at any time. We list every provider that may receive data. Several features are optional, and a provider only receives data for a feature you use.

We have not confirmed how long each provider keeps what it receives, or that none of them uses it to improve its own models. What they hold is governed by their own terms. We do not ask them to delete anything when you delete your account, so their own retention applies to data they already received. Write to hello@paramour.fun and we will tell you the name of our scene-writing and voice provider.

You consent to sending your messages to these AI providers when you continue past the sign-in screen, which links to this policy. If you do not agree, do not sign in.

International transfers

DeepInfra, Hugging Face, Featherless AI, Baseten, our scene-writing and voice provider, xAI, Opper, RevenueCat, Stripe, Resend, Cloudflare, Vercel, jsDelivr, the US National Weather Service, Apple and Google may process data outside the UK and the European Economic Area, including in the United States. At the date of this policy we have not confirmed a transfer safeguard for these providers, such as an adequacy decision, the UK-US data bridge, an International Data Transfer Agreement or the UK Addendum. We do not claim one exists. Supabase hosts our database in London; the server code that handles each request runs in Supabase's region nearest to you, which can be outside the UK. By consenting to AI processing you accept this risk for the data you send.

Legal bases

Under UK GDPR we rely on:

• Contract: to run your account, the chat, calls, Journal and subscription you asked for.
• Consent: for sending your messages and what you share to AI providers, which you give when you continue past the sign-in screen, and for notifications, microphone, speech recognition, calendar, health, location, photos and Moments, which you give in the iOS permission sheets and the switches in the app. Chat can reveal special category data such as details of your health, private life or beliefs. For it we rely on the consent you give when you continue past the sign-in screen and, for Apple Health data, on the agreement you give on the health screen or card. You can withdraw consent at any time by turning a switch or permission off, by deleting your account or by writing to us. Withdrawal does not affect earlier processing.
• Legitimate interests: security, preventing abuse and keeping people safe, including the safety checks and message limits.

How long we keep it

• Messages, memories, summaries, diary, Journal entries, call records, the character's voice audio, optional photo copies, reports, safety flags, age and consent records, purchase records, settings and usage state are kept until you delete your account. We apply no automatic expiry, because the character needs them to remember you.
• The stored calendar, health and weather summary is one row that is overwritten with each upload. Events that ended more than four hours ago, health summaries older than 36 hours and weather older than six hours are ignored.
• Calendar event labels are removed once the event is more than seven days past, the next time an event is labelled. The sentence text used for memory search is kept for about two local days.
• Sleep sessions and the daily weather record are kept until you delete your account, including after you switch health sharing off.
• Your push token is kept until you sign out or delete your account.
• Server logs are kept by our hosting platform under its own schedule. We have not confirmed it.
• We do not keep separate backups of your data.
• Data on your phone (chat history, memory, Journal and Moments caches, photos you sent, the character's voice files, the open-call record, the reference selfies, the photo backup choice and queue, the widget snapshot and sign-in tokens) is cleared when you sign out or delete your account.

Deleting your account

In the app, open Settings, then Privacy, then Delete my account. Deletion is immediate. We first remove your stored photo copies and voice audio, and if that fails the deletion stops so you can try again. We then delete your sign-in and your database records, including messages, memories, the Journal, calls, sleep sessions, purchase records, reports, and age and consent records. If you signed in with Apple, the app asks you to confirm and we ask Apple to revoke Paramour's Sign in with Apple access; if you signed in with Google, the app asks Google to disconnect Paramour. If either request fails, the deletion still goes ahead.

Deleting your account does not cancel your subscription; cancel it in the App Store (see Terms). Some things remain after deletion: RevenueCat and Apple keep their own purchase records, and we do not ask RevenueCat to delete its customer record; the providers listed above keep what they already received for as long as their own terms say; older hashed sign-in code records keyed by email address are not removed; an account you made on our website with a different email address is a separate account and stays until you delete it; and pictures you saved to your own Photos library stay there.

Getting a copy of your data

Write to hello@paramour.fun from the email address on your account and we will email you a copy of your data as a JSON file. The standard copy covers your account, your characters, messages (with photo descriptions and Moments), memories, conversation summaries, the earlier journal entries, diary, purchases, reports and relationship history. It does not yet include everything we hold, such as Journal days, sleep sessions, calendar and health summaries, safety flags, age and consent records, call records, voice files and photo copies. Ask for anything else in your message and we will provide it, or tell you why we cannot.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or stop our use of it, or move it to another service, and you can object to processing based on legitimate interests. Delete your account in the app, or email hello@paramour.fun for anything else. You can also change or turn off calendar, health, location, microphone, speech, photos and notifications at any time in iOS Settings under Paramour, and edit or delete memories in the app. We aim to answer within one month. If you are unhappy with our answer, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local data protection authority.

Residents of California and some other US states can ask for access, correction or deletion in the same way. We do not sell personal information or share it for cross-context behavioural advertising.

Children

Paramour is for people aged 18 and over. We ask you to confirm your age before you can chat, using Apple's age range sheet where it is available, and store only the result. We do not knowingly collect data from anyone under 18. If we find that a minor has used the app, we may close the account. If you believe a minor has used it, write to hello@paramour.fun and we will delete the account and its data.

Security

Data is sent over encrypted connections and stored with access controls on hosted infrastructure. Sign-in tokens are kept in your phone's Keychain. No system is perfectly secure, so we cannot guarantee absolute security.

Changes

If we change this policy we will update the date at the top and, for material changes, tell you in the app before they apply.

Contact

Paramour
9 Chatteris Way, London SE17 1GY, United Kingdom
hello@paramour.fun

Our terms are on the Terms page. For help with the app, see Support.