StyleSoul Privacy Policy

Version: 0.2-draft-20261030 · English (United States) · NOT EFFECTIVE

Operator: NOVAVERSE INTERACTIVE LIMITED (新星宇宙有限公司). Business address: RM 1006, 10/F., PO YIP BUILDING, 23 HING YIP STREET, KWUN TONG, HONG KONG. Privacy contact: [email protected]. Effective date and launch territories: [TO BE CONFIRMED]. This draft describes implemented controls separately from configuration and review still required. It must be checked against the deployed release before it becomes effective.

Data and purposes

• Guest access: a random app session identifier, hashed access token, invitation redemption, rights and usage counters support authentication, downloads and cost limits.
• Apple accounts, when enabled: Apple subject identifier, server account identifier, random purchase-account token and encrypted Apple refresh token support authentication and revocation. This implementation does not request your name or email from Apple. Account activation is currently disabled pending Apple configuration and published policies.
• Consent: adult confirmation, exact policy version and content hashes, language and server time document your choice. We do not collect full birth dates for this confirmation. The confirmation is not independently verified age assurance.
• Chat: the selected character, recent text conversation and optional explicit interest labels are sent through our server to Microsoft Azure OpenAI to generate and check responses. Automated input and output checks also process this text. The application does not intentionally write raw conversations into server analytics or moderation logs; model-provider handling is separate. The app keeps chat history on the device.
• Reports: only the character, selected reason and details you choose to type are submitted. Chats, photos and recordings are not automatically attached. Reports are accessible to authorized operators for review. Avoid adding unnecessary personal information.
• Optional activity sharing: event identifiers, times, character/look/action identifiers, version, device language and locale region may be sent. These events are pseudonymous and linked to your session; they are not anonymous to the server. No raw chat, images, recordings, GPS location or advertising identifier is included. Explicit interest categories may be used for personalization only when separately enabled.
• Purchases: verified Apple transaction identifiers, product, environment, expiration and revocation state support purchases, restoration and fraud prevention. We do not receive your full payment-card details.

Camera, microphone and providers

Camera/photo permission is requested for user-created Moments. Current photo composition and storage are local; AI photo editing is not yet connected. Do not infer that a future external image service is covered without a new disclosure. Voice input uses Apple Speech and may involve Apple's servers; recognized text may be sent as a chat message. Raw voice recordings are not sent to Azure by this implementation. Character clips are pre-generated media; a gift does not automatically upload your image or create a new PixVerse job.

Service providers currently include the hosting provider, Cloudflare for proxied HTTPS protection, Microsoft Azure OpenAI for generation/checks, and Apple for platform sign-in, purchases and speech features as enabled. Provider locations, contract terms, retention configurations and subprocessors must be documented before launch. `store: false` is not a promise that every provider uses zero retention. The app server is currently in the United States; end-to-end localization of all processing has not been established.

Controls and retention

Optional server activity sharing is off by default. Turning it off deletes stored server activity for that session/account. Turning server personalization off removes stored explicit-interest events and stops deriving those preferences. The scheduled cleanup removes server activity and moderation decision metadata older than 30 days. Device activity has its own local setting and clear/export control.

In-app deletion requires confirmation. It invalidates sessions and removes account, consent, activity, report, block, quota and access rows from the live database. When an Apple refresh token exists, encrypted revocation work is queued and retried; temporary provider failure can delay Apple-side revocation. The client also removes device chat, Moments and recordings. Minimal de-identified transaction records remain to prevent replay, together with deletion tombstones used during backup recovery. Transaction retention duration and lawful requirements remain to be set before commercial launch.

Backups are currently private server snapshots, not a completed off-site disaster-recovery service. A production backup-retention policy and tested deletion-tombstone replay must be in place before making an erasure-time guarantee. Shared/exported files, third-party provider records and other devices are not automatically erased by local deletion. App deletion alone may leave Keychain entries and does not notify our server.

Rights and security

You can review report status, block characters, disable activity sharing, request deletion, and use the device export control. Additional access/correction/export requests need an operational privacy contact before launch. Rights and response procedures depend on residence; U.S. state and Canadian requirements need review for the actual territories. Do not interpret this draft as a statement that all regional obligations have already been met.

HTTPS, server-side access checks, hashed session tokens, encrypted media/refresh-token storage and limited operator access reduce risks; no system is perfectly secure. StyleSoul does not use this implementation's activity for advertising or sell it. Contact and incident-response procedures: [TO BE CONFIRMED].

Source version: 0.2-draft-20261030
Source SHA-256: 3853a0b2dc623b655b74f719bafdc475815bb6209151deaab65ad5ec8c9e9854