Privacy notice

This page says what Keepcompany stores, why, for how long, and what you can ask us to do about it. It covers this website and the app.

During the beta (from November 2026): 18+ text and the 18+ age check are not switched on yet. The optional turn log is not switched on yet. Explicit passages hidden from you are not stored. Where a section below describes one of these, it says so. Before we switch any of them on, we update this page.

Who is responsible

Keepcompany is run by the person named in the Impressum. Write to us about anything on this page at privacy@keepcompany.ai; we answer within one month.

This website

Visiting this site does not create an account and does not require cookies. We set no advertising or analytics cookies, and there is no tracking of any kind on these pages.

This website is a set of static pages that Cloudflare hosts and delivers for us. We run no web server of our own for it, and we keep no record of visits or of page errors.

Cloudflare acts as our processor for this: it handles your IP address on our behalf to deliver the pages and to protect them from attacks.

The beta waitlist (closed)

There is no sign-up form on this website at the moment, and we collect no email addresses through it. This section applies only to anyone who signed up to the waitlist earlier. Testers get their invitation links from us directly.

Who is responsible. The person named at the top of this page.

What we store. Only the email address you entered, the time you confirmed it, and which version of this consent text you agreed to. To make the links in our emails work, we also keep two scrambled (hashed) codes, never the codes themselves. We don't ask for your name, and we don't store your IP address: to stop automated sign-ups we count sign-ups per network address in memory for at most an hour, and never write it down.

What we use it for. Only to email you an invitation to the Keepcompany beta, and the confirmation email before that. No newsletter, no advertising, no sharing, no selling.

Double opt-in. When you signed up, we sent one email with a confirmation link. Your address only joined the waitlist when you clicked it. If you didn't, we delete it after 7 days.

Legal basis. Your consent (Article 6(1)(a) GDPR), given by clicking the confirmation link. You can withdraw it at any time with the "leave the waitlist" link in our email, or by writing to us. We then delete your address straight away. Withdrawing doesn't affect what happened before.

How long we keep it. Until we invite you (the address then leaves the waitlist; the invitation email itself is deleted 30 days after it's used or expires), until you leave the waitlist, or for at most 180 days after you confirmed if no invitation comes, whichever is first.

Who else handles it. Our servers are run by Hetzner in Germany. The confirmation and invitation emails are sent through Scaleway's email service in France. The website is delivered through Cloudflare, which handles your connection on our behalf.

Your rights. You can ask us what we store about you, to correct it, to delete it, to restrict its use, or to receive it in a portable format, and you can complain to a data protection authority, for example the Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden, Germany. We answer within one month.

Creator enquiries. If you write to creators@keepcompany.ai about bringing your characters or world to Keepcompany, we store your email address, your name if you give it, what you write and any links to your work. This is separate from the waitlist and from any player account. We use it to answer you and to talk about working together. Legal basis: steps you asked for before a possible contract (Article 6(1)(b) GDPR), and after that our legitimate interest in keeping track of the conversation (Article 6(1)(f)). We delete it 12 months after our last exchange, unless we agree to work together; then we keep it for as long as the agreement and the law require.

The app

What we store, and why

• Your login — username, email address, password (stored only as a hash by our own login service), and login events with IP address and browser, which are kept for 90 days. To let you in and keep your account secure. Basis: our contract with you (Article 6(1)(b)); security logs, legitimate interest.
• Your account — an internal identifier, your display name, pronouns, anything you write about yourself, and the invitation you arrived with. Basis: contract.
• Your age confirmation — that you confirmed being 18 or older, the wording you saw and when. Basis: our legal obligation and our interest in an adults-only service.
• Your conversations — every message, every reply, the characters' memories of you, and the characters you create. This is the service itself: the characters remember you. Where you choose to share sensitive things — health, relationships, sexuality, beliefs — that needs your explicit consent, which we ask for before your first conversation (Article 9(2)(a)).
• Pictures the characters send you. Pictures are made from the look you describe: the appearance you write for a character you create or import, and your own look and species in your profile. We add our own picture settings (the scene, mood, framing and style, from fixed lists). Your chat messages, the characters' replies and the Journal are never used to make a picture. Before a description is used, our checks remove or refuse anything that reads as a child, a real person or an instruction.
• Usage records — which models answered, how many tokens, what it cost, how many pictures a day — to keep the service within its limits and to stop abuse. Basis: legitimate interest.
• Reports you send with "Report a problem" — the message, the two before it, and your note — so we can look into it.
• Technical records and delivery. Visits to the website and the app are delivered through Cloudflare, which processes your IP address to deliver the pages and protect them from attacks (Cloudflare is listed under who else handles your data). Our own servers, which run the app, keep a short technical record of the connections and of which page or function was called and whether it worked. It can include your IP address. We use it to keep the service secure and to find faults, and we delete it after 14 days. Basis: our legitimate interest in a working, secure service.
• Read aloud — your browser can read a reply aloud, with a voice you choose in Settings. Voices on your device send nothing anywhere. If you switch on online voices, your browser sends the text of each reply you ask it to read to its maker (for example Google or Microsoft), which turns it into speech under its own privacy terms, possibly outside the EU. This happens only after you switch online voices on and press Read aloud, and the text goes from your browser to its maker, not through our servers. Your Read aloud settings (the voice, the speed, how actions are read, and whether online voices are on) are kept only in this browser.

Training. We don't use your conversations to train AI models. If that ever changes, we will ask you first, and it happens only if you say yes.

Signing in with Discord or Google (optional)

Where the sign-in page offers it, you can sign in with your Discord or Google account instead of an email address and password.

• Discord tells our sign-in service your Discord user ID and, if Discord has verified it, your email address. Its answer also carries your Discord name and picture; our sign-in service does not keep them. We don't get your servers, friends or messages, and we never post anything to Discord.
• Google tells our sign-in service your Google account ID and, if Google has verified it, your email address. We don't ask Google for your name, picture or anything else in your Google account.

We use these only to sign you in and to recognise your account. When you sign in with Discord or Google, we keep the connection that goes with it, including the access key and the refresh key the provider gives us. They only allow reading the same basic details you agreed to share at sign-in. We do not use them after you have signed in. We delete them when you delete your account. We send Discord and Google nothing about you. Discord (Discord Inc., USA) and Google (Google Ireland Ltd. for users in the EU, Google LLC, USA) handle the sign-in on their side under their own privacy policies. Basis: our contract with you (Article 6(1)(b)). To remove the connection earlier, write to privacy@keepcompany.ai, and we remove it.

Tester Discord (beta, optional)

Beta testers can join a private Discord server by invitation, and we may invite you there to talk about a report you sent. If you join, we see your Discord name and what you post there, and we use it only to talk with you about the beta. Discord is a separate service (Discord Inc., USA) under its own terms and privacy policy, and it stores what you post there. We don't move your conversations to Discord, and we ask you not to post them there. You can leave the server at any time; to have your posts removed, delete them in Discord or write to privacy@keepcompany.ai.

Turn log (not switched on yet)

We plan an optional log, which you could switch on for each character, to help us find and fix mistakes in our checks. It is not available yet, and nothing is logged this way. Before it is, we add its details to this page and ask for your consent in the app.

What you agree to before your first conversation

You are asked once for an explicit consent, and it is recorded with the date and the exact wording you saw:

> I explicitly agree that Keepcompany may process sensitive information I choose to share in my conversations and my profile, such as my health, relationships, sex life or sexual orientation, and beliefs, so that the characters can respond to it and remember it. I can withdraw this at any time on this page.

If you withdraw it, you cannot keep chatting — the characters would still be reading and remembering what you write. Your conversations stay as they are until you ask us to delete your account.

We do not

We do not sell your data. We do not show you ads. We do not use your conversations to train anyone else's models, and we do not use them to train ours unless you switch that on yourself.

Who else handles your data

• Hetzner (Germany) — the servers everything runs on.
• Cloudflare — hosts and delivers the website, delivers the app, and stores pictures in an EU bucket.
• Mistral AI (France) — writes the characters' replies.
• Scaleway (France) — safety checks and memory.
• DeinServerHost (Germany) — draws the pictures characters send you from the look descriptions you wrote (a character's appearance, your own look and species) and our fixed scene settings, and hands them back to us. Its helpers for hardware repair, attack protection and domain services are in Germany and the Netherlands. A data processing agreement is in place, the picture work area is encrypted, and nothing is kept on the server after the picture is made.

Each of these acts only on our instructions. AgeVerif, which will run the optional 18+ age check, is not one of them: it says it is a separate controller. See "The 18+ age check" below. Discord and Google handle sign-in and the tester server under their own terms, as described above.

How long we keep things

• Your account and conversations: until you delete them, or you ask us to.
• Technical records about your visits and use of the app on our servers: deleted after 14 days.
• Creator enquiries: six months after our last message if nothing comes of it, or earlier if you ask. If a contract follows, the correspondence is kept as business records for six years, as German commercial law requires.
• Records we must keep by law — invoices and tax documents — for as long as the law requires, which is up to ten years. A deletion request does not reach those.

Deleting and exporting

You can export your conversations, memories and characters, and you can delete them, from inside the app. Deleting your account removes your data from the app. Records we must keep by law are the exception, and they are kept for nothing else.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to receive it in a portable form, and you can object to uses based on legitimate interest. You can withdraw any consent at any time; that does not affect what we did before.

You can also complain to a supervisory authority. Ours is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Maternistraße 17, 01067 Dresden. If you live in Austria, you may complain to the Austrian Data Protection Authority instead.

Age

Keepcompany is for adults. You must be 18 or older. We ask you to confirm this when you first sign in, before anything else, and we keep that confirmation.

If you answer at sign-up that you are under 18, we remove the account at once. What we cannot remove ourselves is your login at our login service, so we keep one thing — the internal identifier of that login, with the date and the reason, on a list of logins to delete. It carries no email address, no name and no link to the removed account. We delete the login within seven days, and that entry goes with it. Until then your email address still sits in the login service, because deleting the login is what removes it.

The 18+ age check (not switched on yet)

18+ text is not switched on at the start of the beta, so nobody can take this check yet. When we switch it on, it is optional: it applies only if you choose to verify your age for 18+ text. Nobody has to.

Who runs it. The check is run by AgeVerif, a service of PlanetSeason – Unipessoal Lda, Rua Encosta dos Piornais Nº 4, 9000-683 Funchal, Portugal. AgeVerif does not work on our instructions. It says it acts as a separate data controller, and its own privacy policy applies. We are confirming the exact roles with our lawyer. AgeVerif says its own page may show advertising in some cases; that is AgeVerif's page, and our statement that we do not show you ads is about our own site.

The method you pick has its own controller, according to AgeVerif's policy.

• Selfie: PlanetSeason (AgeVerif). AgeVerif says the image is analysed on your own device and is not sent to its servers or to us. Its biometric data policy.
• Credit card: Stripe, Inc. AgeVerif says this is a small one-off payment whose price is shown before you confirm. Stripe's privacy policy.
• AgeGO: Age Verification Technology, SL. AgeVerif says AgeGO works by selfie and may ask you to scan a valid ID. AgeGO's privacy policy.

What we send. We send AgeVerif no name, no email address and no account details. Your browser goes to AgeVerif's page, with our site's ID, a random one-time code, your language and the list of methods. Because your browser connects to AgeVerif directly, AgeVerif sees your connection data, such as your IP address.

What we get back and keep. We get the result: that you passed the age threshold, the assurance level, the country, and how long the proof lasts. We also get an identifier AgeVerif uses for you with us. We check the country and do not keep it. We keep on your account: that you are verified, the time, the method, the assurance level, the date the proof ends (at most one year), and a scrambled (hashed) copy of the identifier, used only to match a revocation. We never receive or keep your ID, your date of birth, your card details or your picture.

How long. We remove the hashed identifier after the proof ends, and we delete the log of check events and the records of check attempts when we no longer need them for this purpose. How long AgeVerif and the method providers keep your data is for their own policies.

Legal basis. We are confirming the legal basis for the check with our lawyer, and we state it here before 18+ text is switched on.

Hidden explicit passages

While this feature is off, explicit passages hidden from you are not stored. If you verify later, passages hidden before that cannot be shown.

Changes

If this notice changes in a way that matters, we tell you in the app before it applies.

Last updated: 4 November 2026.