Privacy policy

1. Who we are

Ignis AI Limited (“Yomi AI”, “we”, “us”) operates the Yomi AI service at yomi-ai.com and is the controller of the personal data described below.

You can reach us about anything in this policy at [email protected].

2. What we collect

We collect only what the service needs in order to work.

• Account information. If you sign up with email, we store your email address and a hashed form of your password — never the password itself. If you sign in with Google, we receive your Google account identifier and the email address on that account. We never receive your Google password. If you use Sign in with Apple in the Yomi app for iPhone, we receive an identifier for your Apple Account and the email address Apple shares with us, which is a random relay address if you choose Hide My Email. We don't ask Apple for your name. Apple also gives us a token that we keep only so that we can revoke Yomi's access to your Apple Account when you delete your account.
• Content you create. The messages you send to characters, the replies generated for you, the player name you choose, the stories and characters you write, images you upload or generate, and the feedback signals you produce by retrying, editing or rating a reply.
• Technical information. Your IP address, browser and device type, operating system, and language preference. We may infer approximate (city- or country-level) location from your IP address. If the Yomi app crashes or hits certain errors, Firebase Crashlytics collects a report: the error, the app's state at the time, your device model and operating system version, and installation identifiers.
• Usage data. Which stories you open, when you start and reset chats, how many messages you send, how much of your allowance you consume, and timestamps for those events.
• Purchases. When you buy diamonds in the Yomi app for Android through Google Play, the Google Play order ID, the product, the time of the purchase and the diamonds added to your account. To tie a purchase to your account, the app gives Google Play a one-way hash of your account ID, never the ID itself. The purchase token Google Play returns is sent to Google only to verify and complete the purchase. When you buy diamonds in the Yomi app for iPhone through the App Store, the App Store transaction ID, the product and quantity, the price and currency Apple charged, the time of the purchase, whether it was a test purchase, and the diamonds added to your account. The app gives Apple an identifier derived one-way from your account ID, never the ID itself. We send the transaction ID to Apple only to verify the purchase and check whether it was refunded, and Apple tells us when a purchase is refunded or a refund is reversed. Google Play or Apple handles the payment: we never see your card or other payment details. When you subscribe to a membership, we also record the store order ID, the product, the tier, whether the plan is monthly or yearly, the purchase and expiry times, whether it renews automatically, and the subscription diamonds added to your account. The identifier given to Google Play or the App Store is still derived one-way from your account ID, never the ID itself. The purchase token is sent only to that store to verify the subscription. The store tells us whether the purchase succeeded, whether it renewed, and whether it was refunded or a refund was reversed. We never see your card or other payment details. Google's or Apple's own terms and privacy policy apply to that payment.
• Cookies and local storage. A signed session cookie that identifies your account or your guest session, and a cookie remembering your language. See section 7.
• To generate chat photos and videos, external AI providers receive relevant conversation context, character reference images, selected original dialogue, voice directions and generation settings. We keep the requests, results and generation/payment records with your account in our database and private cloud media storage. Account deletion and retention follow this policy.

3. Why we use it

• To run the service: generate character replies, keep your chat history across visits, and remember your settings.
• To authenticate you: sign you in, verify that you control an email address, and keep your session attached to the right account.
• For safety and moderation: screen content against our community guidelines, and block content involving minors or real-world harm.
• To prevent abuse: enforce rate limits, free-usage caps and allowances, and detect automated or fraudulent use.
• To deliver the diamonds you buy, prevent payment fraud and keep accounting records.
• To improve the product: aggregate usage statistics, rank recommendations, and evaluate reply quality.
• To contact you about the service: verification codes, security notices, and important changes. We do not send marketing email without your consent.
• To meet legal obligations and to establish, exercise or defend legal claims.

4. Legal bases

Where the GDPR or a comparable law applies to you, we rely on: performance of our contract with you (providing the service and your account); our legitimate interests (security, abuse prevention, product improvement); your consent (where we ask for it, such as optional marketing); and compliance with legal obligations.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that already happened.

5. Who else processes your data

We use third-party providers to deliver the service. They process data on our instructions and are not permitted to use it for their own purposes. Service providers that process personal data on our behalf are bound by contract to protect it at least as well as this policy does, and to use it only to provide their services to us.

• Google — Google Sign-In, if you choose to sign in with Google; and Firebase Crashlytics, which receives the crash and error reports described in section 2 and keeps them for 90 days.
• Google Play and Apple. Google Play processes the payment when you buy diamonds in the Yomi app for Android, and the App Store when you buy them in the Yomi app for iPhone. Each tells us whether the purchase succeeded and whether it was refunded, and receives the identifier derived from your account ID described in section 2; Apple also tells us when a refund is reversed. Google's or Apple's own terms and privacy policy apply to the payment. If you use Sign in with Apple in the app for iPhone, Apple confirms your identity, and when you delete your account we ask Apple to revoke Yomi's access.
• Twilio SendGrid — delivery of transactional email such as verification codes.
• Large language model providers, currently including DeepSeek and Alibaba Cloud (Qwen) — they receive the conversation context needed to generate each reply.
• Image generation providers — they receive the prompts and settings you use to generate images.
• Hosting, database, and infrastructure providers — they store the data described above and our backups.

6. What this means for your conversations

Content you send to an AI character leaves our servers: it is transmitted to the model provider that generates the reply. Do not put information in a chat that you would not want a third-party provider to process — in particular passwords, payment details, government identifiers, or other people's private information.

We do not sell your personal information, and we do not share it with advertisers.

Our providers and our servers may be located outside your country, so your data may be transferred internationally. Where required, we rely on appropriate safeguards such as standard contractual clauses.

7. Cookies and sessions

We set a signed session cookie so the service knows which account or guest session a request belongs to. It is required for the service to function and cannot be turned off while you use the site. We also set a cookie recording your chosen interface language.

We do not use third-party advertising or cross-site tracking cookies.

If you are using the service as a guest and you clear cookies, we can no longer connect you to your previous guest session, and that history becomes unreachable.

8. How long we keep it

• Account data and content are kept while your account exists, and are deleted or anonymised after you ask us to delete the account.
• Records of diamonds added to or taken from your balance and of purchases are kept, without any content, for fraud prevention, accounting and legal obligations, including after an account is deleted.
• Guest session data is kept while the guest session is reachable and may be cleared after a period of inactivity.
• Email verification codes are stored only as a one-way hash and expire within minutes.
• Technical logs are kept for a limited period for security and debugging, and then discarded. Firebase Crashlytics deletes crash and error reports after 90 days.
• Deleted data may persist in encrypted backups for a short retention window before those backups rotate out.

9. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to object to or restrict certain processing, and to withdraw consent.

If you have a registered account, you can delete it yourself: in the Yomi app, open Me > More settings > Delete account and confirm; on the web, sign in at yomi-ai.com, open More settings (yomi-ai.com/settings) and tap Delete account. You are then signed out on every device, the stories you published are taken off the service, and your data is handled as described in section 8. Guest sessions can't be deleted this way. If you use the service as a guest, can't sign in or need help, email [email protected] (from the address on your account, if you have one) and we will handle the request.

If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

10. Children

Yomi AI is an adult fiction service and is not intended for anyone under 18. We do not knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we close it and delete the associated data.

If you believe a child has given us personal data, contact [email protected] and we will act on it.

11. Security

Traffic to the service is encrypted in transit. Passwords are stored only as salted hashes, and verification codes only as one-way hashes. Access to production data is limited to the people who need it to operate the service.

No online service can promise perfect security. If a breach affects your data, we will notify you and the relevant authority where the law requires it.

12. Changes to this policy

We will update the date at the top of this page when the policy changes. If a change materially affects your rights, we will give notice in the product before it takes effect.

13. Contact

Questions, requests, or complaints about this policy: [email protected].