Last Updated: January 3, 2026
Introduction
Welcome to Bifrost, an AI-powered character chat application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the App.
App Name: Bifrost
Purpose: AI-powered character chat with customizable AI companions
Age Requirement: 9+ (parental consent required for users under 13)
We reserve the right to make changes to this Privacy Policy at any time. We will alert you about any changes by updating the "Last Updated" date of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates.
1. Information We Collect
1.1 Personal Information
We collect the following personal information when you use our App:
- Authentication Data: Email address (for account creation and login), Password (stored securely hashed by Supabase), User ID (UUID assigned to your account)
- Profile Data: Username (3-20 characters, alphanumeric and underscore), Display name
- Usage Data: Total message count (for subscription enforcement), Subscription status (free or premium), Subscription expiration date (for premium users)
- Content Data: Characters you create (personality type, gender, name, language preferences), Affection levels (relationship tracking with characters), Total message counts per character, Conversations and their timestamps, Messages you send and receive (including AI responses), Message reactions, Character memories (extracted context from conversations)
- Device Data: Push notification tokens (for sending character notifications)
- Transaction Data: Subscription data managed by RevenueCat (purchase history, renewal dates)
1.2 Data from Third-Party Services
When you use Sign in with Apple:
- Apple: User ID, email (may be private relay), full name
2. How We Use Your Information
We use the information we collect to:
Provide Core Functionality
- Create and manage your account
- Authenticate your identity
- Generate AI-powered character responses via Anthropic Claude API
- Save your characters, conversations, and messages
- Sync your data across devices via Supabase cloud storage
- Track relationship progression (affection levels) with characters
Manage Subscriptions
- Enforce free tier limits (3 total messages)
- Process and manage premium subscriptions via RevenueCat
- Verify subscription status for unlimited messaging
Send Notifications
- Deliver push notifications when your characters want to talk
- Notify you about important account or subscription updates
Improve Our Service
- Analyze usage patterns to improve the app
- Fix bugs and technical issues
- Develop new features and personalities
3. How We Share Your Information
We share your information with the following third-party service providers:
Supabase (Backend Infrastructure)
Purpose: Backend database, authentication, cloud storage
Data shared: All account, profile, character, conversation, and message data
Privacy Policy →Anthropic (AI Processing)
Purpose: Generate AI-powered character responses using Claude API
Data shared: Your messages and conversation history (for context)
Important: Your messages are sent to Anthropic's servers for AI processing
Privacy Policy →RevenueCat (Subscription Management)
Purpose: Manage in-app purchases and subscriptions
Data shared: User ID, subscription transactions, purchase history
Privacy Policy →Apple Push Notification Service
Purpose: Deliver push notifications to your device
Data shared: Device token, notification content
Privacy Policy →We do NOT:
- Sell your personal information to third parties
- Share your data with advertisers
- Allow other users to see your conversations (all content is private)
4. Data Retention
Active Data
- Messages: Soft-deleted (marked with `deleted_at` timestamp) in production
- Characters, conversations: Retained while your account is active
- Character memories: Stored indefinitely to maintain context
Account Deletion
You can permanently delete your account at any time via Settings → Delete Account. Upon deletion, we permanently remove:
- All messages, conversations, and characters
- User profile and stats
- Push notification tokens
- Character memories
- Your authentication account
This action is irreversible and cannot be undone
5. Data Security
We implement industry-standard security measures to protect your data:
- Encryption: All data transmitted between your device and our servers uses HTTPS encryption. Passwords are securely hashed (never stored in plain text).
- Access Control: Row Level Security (RLS) in database ensures users can only access their own data. Authentication tokens required for all API requests. Server-side API key storage (your device never sees sensitive API keys).
- Third-Party Security: Supabase provides enterprise-grade security and compliance. Anthropic Claude API uses secure connections and data handling practices.
6. Your Rights and Choices
You have the following rights regarding your personal information:
- Access: View all your data within the app (characters, conversations, messages)
- Correction: Update your username, display name, or email at any time
- Deletion: Permanently delete your entire account and all associated data via Settings
- Export: Data export is not currently supported (planned for future release)
- Marketing: We do not send marketing emails; all notifications are service-related
- California Residents (CCPA): You have additional rights under the California Consumer Privacy Act
- EU Residents (GDPR): You have additional rights under the General Data Protection Regulation
7. Children's Privacy
Our App is rated 9+ and appropriate for users aged 9 and above. Users under 13 require parental consent to use the App.
We do not knowingly collect personal information from children under 13 without parental consent. If you believe we have collected information from a child under 13, please contact us immediately and we will delete the information.
8. International Data Transfers
Your data may be transferred to and processed in countries other than your country of residence. We ensure that appropriate safeguards are in place for such transfers in accordance with applicable data protection laws.
Supabase stores data in secure data centers located in South Asia (Mumbai).
9. Cookies and Tracking
We do not use cookies or tracking technologies for advertising purposes. Our App uses:
- Session tokens for authentication (required for app functionality)
- Local storage for app preferences and offline data
- No third-party analytics or ad tracking
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date at the top, posting the new Privacy Policy in the app, or sending a notification if the changes are significant.
Your continued use of the App after changes constitutes acceptance of the updated Privacy Policy.
11. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us: