Privacy Policy

1. Introduction

This Privacy Policy describes how OKOKAI PTE. LTD. ("we", "us", "our"), a private limited company incorporated in Singapore (UEN 202447433Z; registered office: 21 Collyer Quay, Singapore 049320), collects, uses, discloses, and safeguards your personal information when you use our products and services, including the HER mobile application, the Kevin mobile application (when launched), and this website (collectively, the "Services").

For the purposes of the GDPR and equivalent laws, OKOKAI PTE. LTD. is the data controller of your personal data. Our Data Protection Officer (DPO) and EU/UK representative contact details are in §12.

By accessing or using the Services, you confirm you are at least 18 years of age and you agree to this Privacy Policy. If you do not agree, do not use the Services.

This policy is designed to comply with the EU/EEA General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and other US state privacy laws, the Singapore Personal Data Protection Act (PDPA), and relevant Apple App Store and Google Play developer requirements.

2. Information we collect

2.1 Information you give us directly

• Account information: email address, optional username, age verification (you must be 18+).
• Payment information: when you purchase credits, payment is processed by Apple App Store or Google Play. We receive transaction confirmations from these platforms but not your full card number or other payment-card details.
• Conversational content: messages, voice notes, and other content you send to HER or Kevin.
• Persona preferences: appearance, voice, personality settings you choose for your AI companion.
• Support communications: emails or messages you send to [email protected].

2.2 Information we collect automatically

• Device information: device model, OS version, language, timezone, app version.
• Usage data: which features you use, session length, error logs (no personal content).
• IP address: for security, fraud prevention, and approximate region detection.
• Advertising identifier (Android version of HER only): your Google Advertising ID (AAID) and related on-device advertising identifiers, read by the Google AdMob SDK bundled in the Google Play build. The app declares the com.google.android.gms.permission.AD_ID permission for this purpose.
• Analytics & diagnostics identifiers (Android version of HER only): a Firebase app-instance ID and a per-installation device identifier, plus crash reports and device state at the time of a crash (Firebase Analytics and Firebase Crashlytics).

We do not use third-party analytics tools (Google Analytics, etc.) on this website. The Android version of the HER app does embed third-party Google SDKs — see §4.1 for the full list and §7.1 for how to opt out.

2.3 Information from third parties

We may receive information from app store providers (Apple, Google) confirming your purchase.

3. How we use it

We use your information to:

• Provide, operate, and improve HER, Kevin, and our other Services.
• Generate AI responses tailored to your conversation history (this is the core feature — long-term memory).
• Process payments and prevent fraud.
• Send service-related emails (account verification, payment receipts, important policy updates).
• Comply with legal obligations and respond to lawful requests.
• Enforce our Terms of Service and content policies (e.g., detecting prohibited content).

We will not:

• Sell your personal data.
• Use your conversations to train publicly-released AI models.
• Share your conversations with advertisers.

4. Sharing & third parties

We share information only in the following limited circumstances:

• AI model providers: To generate responses, your messages may be processed by multiple third-party AI providers (which may include, without limitation, providers operated by OpenAI, Anthropic, Google, and other comparable industry providers). These providers are bound by contract to process your messages only to generate the response you requested and are contractually prohibited from retaining your conversations beyond the inference window or from using them to train publicly-released models. The specific current list of providers is available upon written request to [email protected], and we will notify you of material changes at least 14 days in advance.
• Payment processors: Apple and Google receive only the data necessary to process your in-app purchases.
• Cloud infrastructure: We use reputable cloud providers (which may include, without limitation, Amazon Web Services, Google Cloud Platform, Cloudflare, and equivalent providers) for storage, computing, and content delivery. These providers process data on our behalf under standard data processing agreements (DPAs) incorporating GDPR Article 28 obligations. The specific current list is available upon written DSAR request.
• Legal requests: We may disclose information if required by law, subpoena, or court order, or to protect rights, property, or safety.
• Advertising & analytics providers: the Android version of HER embeds Google SDKs that send device and usage data to Google. Details in §4.1.
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the new entity, subject to this Privacy Policy.

4.1 Third-party SDKs in the mobile apps

The Android (Google Play) build of HER contains the following third-party SDKs, all operated by Google:

• Google AdMob (play-services-ads) — serves the optional rewarded-video ads you can watch in exchange for in-app credits. AdMob receives your advertising ID, IP address, device and app information, and ad-interaction data (impressions, completions, clicks). The SDK initialises when the app starts, not only when an ad is displayed, and may contact Google at that point to fetch its configuration and pre-load ad inventory.
• Firebase Analytics — aggregate product analytics (which screens and features are used, session length). Receives a Firebase app-instance ID, an installation-scoped device identifier, the distribution channel, and event names and parameters. It does not receive the content of your conversations.
• Firebase Crashlytics — crash and error reporting: stack traces, device model, OS version, and app state at the time of a crash.
• Google Play Billing — processes in-app purchases.
• Google Sign-In — optional sign-in method; returns your email address and Google account identifier.

Data handled by these SDKs is processed by Google under Google's Privacy Policy. Your conversations, voice notes and persona settings are never passed to any of them.

The iOS build of HER contains none of these SDKs — no advertising, analytics or crash-reporting SDK is bundled in the App Store version. Kevin has not launched; its SDK list will be published here before release.

5. Storage & retention

Your account and conversational data is stored primarily on servers operated by reputable cloud providers in Singapore, with redundant encrypted backups. AI-inference traffic (the round trip of your message to an AI provider and back) may transit through provider data centers in the United States or the European Union depending on which model is selected — see §9 for cross-border safeguards. Conversational content is encrypted at rest (AES-256) and in transit (TLS 1.2+).

We retain your data:

• Account & conversations: while your account is active. You can delete individual conversations or your entire account at any time — see our Account & Data Deletion page.
• Account-deletion residue: up to 30 days after deletion (for encrypted backup integrity), after which data is permanently purged.
• Transactional records: 5 years under the Singapore Income Tax Act and equivalent local tax laws (some jurisdictions require up to 7 years for VAT/GST audit purposes).
• Anonymized aggregate logs: up to 12 months for system health and abuse detection. Cannot be re-linked to you.

6. Your rights

Depending on your jurisdiction, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate data.
• Deletion ("right to be forgotten"): delete your account and all associated data.
• Portability: receive your data in a machine-readable format.
• Objection / restriction: object to or restrict certain types of processing.
• Withdraw consent: where we rely on consent, you can withdraw it at any time.
• Lodge a complaint: with your local data protection authority (e.g., the PDPC in Singapore, or your EU country's supervisory authority).

To exercise any of these rights, email [email protected]. We will respond within 30 days.

6.1 California residents (CCPA / CPRA)

California residents have additional rights, including the right to know what categories of personal information we collect, the right to delete, the right to correct, the right to opt out of "sale" or "sharing" of personal information, and the right to limit the use of sensitive personal information. We do not sell personal information, and we never disclose your conversations, voice notes or persona settings for advertising.

Because the Android version of HER serves ads through Google AdMob, your advertising ID and ad-interaction data may be used by Google to personalise advertising. Under the CPRA this can qualify as "sharing" for cross-context behavioural advertising. You can opt out at any time by deleting or resetting your device advertising ID (see §7.1), by using the iOS version of HER, or by emailing [email protected].

6.2 Other US-state residents (VA · CO · CT · TX · OR · UT · MT · and more)

If you reside in a US state with applicable consumer privacy law (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, Oregon OCPA, Utah UCPA, Montana MCDPA, and others as enacted), you have rights substantially similar to those above — access, correction, deletion, portability, and opt-out of targeted advertising or sale. We do not sell personal information; for targeted advertising in the Android version of HER, see the opt-out described in §6.1 and §7.1. To exercise these rights, email [email protected].

6.3 EU / EEA / UK residents (GDPR · UK GDPR)

You have all rights listed at the top of this section, plus the right to lodge a complaint with your country's data protection authority. You may submit a Data Subject Access Request (DSAR) by emailing [email protected]; we respond within one calendar month (extendable to three months for complex requests, with notice).

If you are in the EU/EEA, you may also contact our EU representative (GDPR Article 27) — see §12.3 — as an alternative point of contact for any GDPR matter.

6.4 Singapore residents (PDPA)

You have rights to access and correct your personal data and may lodge a complaint with the Personal Data Protection Commission (PDPC). Contact [email protected].

7. Cookies & tracking

This website uses only strictly necessary cookies and local storage to remember your preferences (e.g., language) and that you've dismissed the cookie notice. We do not use third-party analytics, advertising, or tracking cookies.

For the full cookie list, retention periods, and how to manage them, see our Cookie Policy.

7.1 Advertising & tracking in the mobile apps

The Android (Google Play) version of HER contains the Google AdMob advertising SDK together with Firebase Analytics and Firebase Crashlytics (full list in §4.1). The AdMob SDK is initialised at app start-up — before and independently of any ad being displayed — and may pre-load ad inventory at that point. Ads are only shown when you deliberately choose to watch a rewarded video in exchange for credits; we never place advertising inside your conversations.

How to opt out on Android: open Settings → Privacy → Ads on your device and choose Delete advertising ID (or Opt out of Ads Personalisation on older versions). Ads may still be shown, but they will no longer be personalised. You can also manage Google's ad settings at myadcenter.google.com.

The iOS version of HER contains no advertising, analytics or tracking SDK. Kevin has not launched; this section will be updated before it ships.

8. Children's privacy (18+)

Our Services are strictly limited to users aged 18 and older, as a matter of contract under our Terms of Service. We do not knowingly collect data from anyone under 18. If we become aware that a user under 18 has provided personal data, we will delete it immediately. If you believe a minor is using our Services, please contact [email protected].

Note on app-store age ratings: Apple's age-rating taxonomy does not include "18+" (its highest band is "17+"); the HER and Kevin apps are rated 17+ on the App Store. The 18-or-older requirement in our Terms is independent of, and stricter than, the platform rating.

9. International data transfers

OKOKAI is based in Singapore. Your data may be transferred to and processed in jurisdictions other than your own, including:

• Singapore — primary account and conversation storage
• United States — AI model inference (OpenAI, Anthropic, etc.) and certain cloud infrastructure
• European Union — some AI inference and CDN edge regions
• Other regions — CDN edge points-of-presence for static content delivery only (no conversational content stored)

For transfers out of the EU/EEA/UK, we rely on:

• The European Commission's Standard Contractual Clauses (SCCs) Decision 2021/914 where no adequacy decision exists;
• The UK International Data Transfer Addendum (IDTA) for UK personal data;
• Singapore PDPA cross-border transfer requirements (Section 26 PDPA).

A copy of the applicable SCCs is available upon request to [email protected].

10. Security

We implement industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest (AES-256), access controls, and regular security audits. However, no system is 100% secure. If you suspect unauthorized access to your account, contact [email protected] immediately.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or in-app notification at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent version.

12. Contact us

12.1 Data controller

OKOKAI PTE. LTD. (UEN 202447433Z), 21 Collyer Quay, Singapore 049320 · [email protected] · +65 8917 7567

12.2 Data Protection Officer (DPO)

OKOKAI's Data Protection Officer can be contacted at [email protected].

The DPO is the primary point of contact for all GDPR and PDPA matters and operates independently from product and engineering decision-making to ensure impartiality.

12.3 EU/EEA & UK Representatives (GDPR / UK GDPR Article 27)

OKOKAI's current focus is on users in Asia-Pacific and the Americas. Formal EU/EEA and UK representatives under GDPR Article 27 are being arranged and will be appointed before any active marketing in the EU/EEA/UK.

In the interim, EU/EEA/UK residents who reach our Services may exercise all GDPR / UK GDPR rights — including access, correction, deletion, portability, objection, restriction, and the right to lodge a complaint with a supervisory authority — by contacting [email protected] directly. We will respond within the statutory one-month deadline (extendable to three months for complex requests, with notice).

Once representatives are appointed, their full contact details will appear here.

12.4 Channels

• Privacy / DSAR: [email protected]
• General support: [email protected]
• Legal / DSA: [email protected]
• Postal: OKOKAI PTE. LTD., 21 Collyer Quay, Singapore 049320
• Phone: +65 8917 7567

You also have the right to lodge a complaint with your local data protection authority — e.g., the Personal Data Protection Commission (PDPC) in Singapore, the Information Commissioner's Office (ICO) in the UK, or your country's GDPR supervisory authority in the EU/EEA.