Privacy Policy

1. Who is responsible for your data

KUN is operated by Anatoliy Belobrovik, a sole trader (autónomo) established in Spain, at Mejía Lequerica 34, Entresuelo 2A, 08028 Barcelona, Spain ("KUN", "we", "us"). We are the controller of your personal information. Some laws call this the "personal information handler" or "business". Our privacy contact, who is also our Brazilian encarregado, Korean Chief Privacy Officer, and Québec person in charge of the protection of personal information, is Anatoliy Belobrovik. You can reach them at support@kun.chat.

This policy covers the KUN apps for iOS and Android, the KUN web app, the kun.chat website, and our waitlist and support emails (together, the "Service").

2. Adults only

The Service is only for people aged 18 or over who have reached the age of majority where they live. We ask for your date of birth before you can chat, and we use it to confirm that you are eligible and to decide which features are available to you. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data. Accounts created before October 17, 2026, when KUN allowed users aged 16 and 17, are paused instead. We tell the user and offer a copy of their data. If the user is still under 18 thirty days later, we delete the account and all of its data. They can delete the account sooner at any time, and they are welcome to create a new account once they turn 18. We keep only what the law requires us to keep, or what we need to prevent the person from signing up again, for example a record that the sign-in identity was blocked. If you believe a minor is using KUN, contact support@kun.chat.

3. Information we collect

Information you give us

• Account information: your display name, your email address and whether it is verified, your profile picture (one of our preset avatars, or the image from your sign-in provider), your bio, and the sign-in method you used (Apple, Google, Discord, an email code, or guest).
• Profile and onboarding: your date of birth, the gender you choose to share, your interests, the characters you select, your language, and app preferences.
• Conversations: the messages you send, the AI characters' replies, your reactions and ratings, your choices in stories, your conversation settings, including mature content settings, and any reports you submit.
• Memories: short facts that KUN extracts from your conversations, such as your name or what you like, so that characters can remember context. Our memory system is told not to store facts that reveal a user is under 18.
• Support communications: what you tell us when you email us.
• Waitlist: if you join the waitlist on kun.chat, your email address, language, referral code, and the referral code that invited you.

Information created when you use KUN

• Generated media: images and short videos that KUN generates for you in chats. We store them privately and show them only to you.
• Safety signals: the results of automated safety checks on messages, such as whether a message was flagged for self-harm, content involving minors, non-consent, or attempts to get around our rules, and any action taken.
• Purchases: your subscription status, the products you bought, transaction and renewal records, and your Shrimps balance and spending history. Apple, Google, or our web payment processor handles payment. We never receive your full card details.
• Device and technical information: your IP address, the country it points to, your device type, operating system, app version, language, and time zone, browser details, session records (sign-in time, IP address, and user agent), and push notification tokens.
• Usage information: when you are active and which features you use. For example, we use your usual chat times to schedule reminder notifications.
• Analytics and diagnostics: see Section 7.

Information from others

• Sign-in providers: if you sign in with Apple, Google, or Discord, they send us an account identifier, your name, your email address (or an Apple private relay address), whether the email is verified, and your profile image.
• App stores and RevenueCat: confirmation of purchases, renewals, cancellations, and refunds.
• Age signals: where available and permitted, an age range or age-verification result from your app store, device, or an age-assurance provider. We receive the result, not your ID documents.

4. Sensitive information

KUN is a romance and roleplay app. Your conversations may reveal sensitive information, such as your sex life, sexual orientation, gender identity, health, or beliefs. You decide what to share. We ask for your explicit consent before processing sensitive information in your conversations, and you can withdraw it at any time in Me → Settings → Privacy choices. When you withdraw consent that chat needs (to AI processing, to sensitive information, or, where we ask for it, to overseas transfer), chat stops and we stop processing your conversations. Your conversations and memories are then deleted 30 days later unless you give your consent again, and you can delete them right away instead.

We use sensitive information only to provide the conversations you ask for, to keep the Service safe, and to meet our legal obligations. We do not use it to infer characteristics about you for advertising or for any purpose beyond providing the Service. Please do not share government ID numbers, financial account details, passwords, or anyone else's private information in chats.

5. How we use your information, and our legal bases

• To provide the Service, including your account, conversations, memories, generated media, stories, purchases, and support. Legal basis: performance of our contract with you, plus your explicit consent for sensitive information in conversations.
• To confirm that you are an adult, and to apply age-based and country-based feature restrictions. Legal bases: legal obligation and legitimate interests (protecting minors and complying with local law).
• To keep KUN safe, including automated safety checks, moderation, review of reports, fraud and abuse prevention, and enforcing our Terms. Legal bases: legitimate interests and legal obligation.
• To support people in crisis: when a message suggests a risk of self-harm, we show you crisis resources. Legal bases: legal obligation, and vital and legitimate interests. Our Safety page lists the crisis lines.
• To send notifications, including character messages and reminders. Legal basis: your consent, given through your device's notification permission and, where required, a separate opt-in.
• Product analytics, to understand and improve KUN. Legal basis: your consent where the law requires it, for example in the EU, EEA, UK, South Korea, and China; otherwise our legitimate interests, and you can opt out.
• Crash reporting and reliability. Legal basis: legitimate interests (keeping the Service working and secure).
• To comply with the law and to establish, exercise, or defend legal claims. Legal bases: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have balanced them against your rights, and you can object (see Section 12). Where we rely on consent, you can withdraw it at any time. This does not affect processing that took place before you withdrew it.

6. How AI works in KUN

• Generating replies and media. To generate a reply, we send your recent messages, the relevant memories, your display name, and the settings of the character and conversation to an AI model provider. To generate an image or video, we send a text description, written by our system and based on the conversation, to an image or video model provider. The providers return the output to us. The providers we use are listed in Section 8.
• Translation and memory. We may use AI to translate text into your language, and to extract and search memories. Searching memories uses numerical representations of text, called "embeddings".
• Automated safety checks. AI classifiers check messages for rule-breaking content and signs of self-harm. Depending on the result, KUN may answer differently, show crisis resources, hide content, or limit a feature. These checks enforce our Terms. They do not produce legal effects about you, and you can ask a person to review a decision by emailing support@kun.chat. Our Safety page describes this protocol.
• No model training. We do not use your conversations, memories, or other personal information to train general-purpose AI models. Our contracts and routing settings require our AI providers not to use your content to train their models. Some providers keep inputs for a short time to detect abuse, as described in Section 10.
• Human review. Our staff do not routinely read your conversations. A person may review specific messages when you report them, when our safety systems flag them, when you ask us for help, or when the law requires it.
• AI labelling. KUN tells you that you are talking to AI, and generated images carry a machine-readable marker that identifies them as AI-generated.

7. Analytics, diagnostics, and tracking

• Product analytics (Mixpanel, hosted in the EU). We record app events, such as screens viewed, buttons tapped, purchase steps, and errors, together with device and app information, your country, and broad profile attributes such as your age band and the gender you selected. When you are signed in, events are linked to a random account identifier. Signed-out and guest usage is linked to an anonymous identifier. Analytics never include the text of your messages, the AI replies, generated images, your name, or your email address. We do not record your screen.
• Your choice. In the EU, EEA, UK, Switzerland, South Korea, and China, and when we cannot tell where you are, analytics stay off unless you turn them on. Elsewhere, they are on unless you turn them off. Wherever you are, you can change this at any time in Me → Settings → Privacy choices → "Help us improve". On the web, the same choice appears in our consent banner and in your settings.
• Crash reports (Sentry, hosted in the EU). When the app crashes or something fails, we collect technical details, such as the error, device and app version, and recent technical events, together with your account identifier. Crash reporting continues when analytics are off, because we need it to keep the Service working. We configure it not to include message text.
• No advertising tracking. We do not show ads, use advertising identifiers (IDFA or GAID), sell or "share" personal information for cross-context behavioural advertising, or track you across other companies' apps and websites.
• Cookies and local storage. The KUN web app uses strictly necessary cookies to keep you signed in. If you consent, it also uses analytics storage. The kun.chat website stores your language choice and referral code in your browser's local storage. If you allow analytics, it also stores an anonymous Mixpanel identifier, your analytics choice, and campaign attribution (UTM tags and ad click IDs) there, so we can understand which pages and campaigns bring people to KUN. The website does not use tracking cookies.

8. Who we share information with

We do not sell your personal information. We share it only with:

• Service providers (processors) that host, run, or support the Service for us under contracts that limit how they can use the data. They are described below.
• Apple, Google, and Discord, when you use them to sign in or to buy something.
• Authorities and others where required: when the law requires it, to respond to valid legal requests, to report child sexual exploitation, to protect someone's life or safety, or to enforce our Terms.
• A successor, if KUN is sold or transferred. We will tell you, and this policy will continue to protect your information.

Our service providers fall into these categories:

• Infrastructure and hosting: network, application servers, database, private media storage, queues, sign-in, and email. United States, with a global content-delivery network.
• AI model providers: generating replies, memories, safety checks, translation, and image and video generation. United States, the EU (France and Spain), and Singapore, and for image-prompt planning only, other countries in Google's global infrastructure. They may not use your content to train their models (see Section 6).
• Payments and subscriptions: purchase and subscription management, and web checkout. United States.
• Analytics and crash reporting: European Union.
• Push notification delivery: United States.

Our service provider list names each provider, what it does, the data involved, and where it processes data. It forms part of this policy. We keep it up to date, and where the law requires, we tell you before a new provider starts processing your data.

9. International transfers

We and our providers process data in several countries, including the United States, EU member states, and Singapore, which may not be where you live. When we transfer personal information out of the EU, EEA, UK, Switzerland, Brazil, or another country with transfer rules, we use a recognised safeguard. These include adequacy decisions (such as the EU-U.S. Data Privacy Framework for certified providers), the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and Brazil's standard contractual clauses. Where the law requires it, for example in South Korea, China, and Japan, we ask for your consent to the transfer and give you the details in Section 8 and Section 13.

10. How long we keep information

• Account, profile, conversations, memories, and generated media: until you delete them or your account. Resetting a conversation deletes its messages, and you can delete memories individually or all at once. After you delete your account, we erase this data from our live systems within 30 days, and from backups within a further 35 days.
• Inactive guest accounts: deleted after 30 days without activity.
• Paused accounts of users under 18 (created before October 17, 2026): deleted with all their data 30 days after the pause, unless the user has turned 18 and accepted the Terms by then.
• Conversations after you withdraw consent that chat needs: deleted with your memories 30 days after you withdraw it, unless you give your consent again before then.
• Inactive registered accounts: deleted with all their data after 24 months without a sign-in. We email you at least 30 days beforehand, and signing in keeps your account. Accounts with an active subscription are not deleted for inactivity.
• Session records (IP address and user agent): deleted 30 days after the session expires.
• Reports and moderation records: up to 1 year after we resolve the report, or longer if we need them for a legal claim or the law requires it. If you reported a message and then delete your account, we may keep the reported excerpt of that conversation for up to 90 days so we can finish reviewing the report.
• Purchase and transaction records: as long as tax, accounting, and consumer protection law requires, usually up to 6 years. After that we delete or anonymise them.
• Analytics: up to 24 months.
• Crash reports: up to 90 days.
• Push tokens: until you turn off notifications, the token stops working, or you delete your account.
• Sign-in email codes: stored only as a hash, and they expire within minutes.
• AI providers: they process content to produce a response. Where we can, we use zero-retention routes. Some providers may keep inputs for up to 30 days to detect abuse, and then delete them.
• Waitlist emails: until you unsubscribe, or 12 months after we last email you.
• Support emails: up to 2 years after your request is resolved.

11. Security

We protect personal information with measures such as encryption in transit, private storage for media, with access only through short-lived signed links, hashed sign-in codes, access controls, and limited staff access. No system is perfectly secure. If a breach affects your rights, we will notify you and the authorities as the law requires.

12. Your rights and choices

Depending on where you live, you may have the right to:

• access your personal information and get a copy of it;
• receive your data in a portable, machine-readable format;
• correct inaccurate information. You can edit your profile in the app;
• delete your information. You can delete your account in Me → Settings → Delete account, reset a conversation, or delete memories;
• restrict, or object to, certain processing, including processing based on legitimate interests;
• withdraw consent, for example to analytics, notifications, or the processing of sensitive information in conversations;
• ask a person to review an automated decision and explain it to you;
• appeal our response to your request, where the law provides for it;
• complain to your data protection authority.

To make a request, email support@kun.chat from the email address on your account, or include your account identifier. We may need to verify your identity. You can use an authorised agent, who must show us that you gave them permission. We respond within the time your law requires, usually one month (45 days in the US and 15 days in Brazil). We will not treat you differently for exercising your rights.

Deleting your account does not cancel an App Store or Google Play subscription. Please cancel it in the store. Data that Apple, Google, or your sign-in provider holds is governed by their own privacy policies.

13. Additional information for your region

European Union, EEA, and Switzerland

Our legal bases are listed in Section 5. We process the sensitive information in conversations on the basis of your explicit consent (GDPR Art. 9(2)(a)). Our lead supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es). You can also complain to the supervisory authority in the country where you live or work.

United Kingdom

You have the rights described in Section 12 under the UK GDPR and the Data Protection Act 2018. You can complain to the Information Commissioner's Office (ico.org.uk).

United States

This section applies to residents of California and of other states with consumer privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

• Categories we collect, with their sources and purposes described in Sections 3 to 5: identifiers (name, email, account and device identifiers, IP address); customer records; characteristics of protected classifications (age, gender); commercial information (purchases); internet and network activity (app usage); approximate geolocation (country derived from IP address); audio, electronic, or visual information (generated media); sensitive personal information (account login, and information about sex life or sexual orientation that you choose to share); and inferences, limited to memories and age band.
• Disclosure: we disclose each category to the service providers in Section 8, for the business purposes described in this policy.
• No sale or sharing: we have not sold or "shared" personal information (for cross-context behavioural advertising) in the past 12 months, including that of consumers under 16. We do not engage in targeted advertising or in profiling that produces legal or similarly significant effects.
• Sensitive personal information is used only to provide the Service you request and for the other purposes that the CCPA permits. We do not use it to infer characteristics about you.
• Retention: see Section 10.
• Your rights: to know, access, correct, delete, and port your data, to opt out of sale, sharing, targeted advertising, and profiling (none of which we do), and to appeal a decision on your request by replying to it. If we deny your appeal, you can contact your state Attorney General.
• We do not knowingly process the data of anyone under 18.

Canada

You have rights of access and correction under PIPEDA and provincial laws, and you can withdraw consent at any time. Québec residents also have rights of data portability, of deletion (de-indexation), and of information about automated decisions. Our person in charge of the protection of personal information is named in Section 1. Your information may be processed outside Québec and Canada, as described in Section 9. You can complain to the Office of the Privacy Commissioner of Canada or to the Commission d'accès à l'information du Québec.

Brazil

Under the LGPD (Law 13.709/2018), you have the right to confirmation that we process your data; to access, correction, anonymisation, blocking, or deletion of unnecessary data; to portability; to information about who we share data with; to information about the consequences of refusing consent; to withdraw consent; and to request review of automated decisions. Our encarregado is named in Section 1. You can also complain to the ANPD (Autoridade Nacional de Proteção de Dados).

Japan

Under the APPI, you can request disclosure, correction, suspension of use, deletion, or suspension of third-party provision of your retained personal data, and a record of any third-party provision. We handle personal data with the security measures described in Section 11. The countries where your data is processed, and our providers there, are listed in Sections 8 and 9. Information about each country's data protection system is available from the Personal Information Protection Commission (ppc.go.jp). Our name and address are in Section 1.

South Korea

• Items and purposes: see Sections 3 and 5. Retention and destruction: see Section 10. We delete electronic files irreversibly when their retention period ends.
• Overseas transfer: we transfer the items listed on our service provider list to the providers and countries named there over encrypted networks, whenever you use the Service, for the purposes and periods described in Sections 8 and 10. You can refuse the transfer by not using the Service or by deleting your account, but we cannot provide the Service without it.
• Your rights: you can request access, correction, deletion, or suspension of processing, and withdraw consent, by contacting our Chief Privacy Officer, Anatoliy Belobrovik, at support@kun.chat.
• Remedies: Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).

China

If you are in mainland China, we process your sensitive information and transfer your personal information outside China only with your separate consent. The overseas recipients, their contact methods, the purposes and means of processing, and the data types are listed in Sections 6, 8, and 9. You can exercise your rights against those recipients by contacting us. Under the PIPL, you have the rights to know, decide, access, copy, port, correct, and delete, to withdraw consent, and to ask us to explain our processing rules.

Thailand

Under the PDPA, you have the rights to access, portability, objection, erasure, restriction, and correction, and to withdraw consent. You can complain to the Personal Data Protection Committee.

14. Google user data

If you sign in with Google, we receive only your Google account identifier, name, email address, email verification status, and profile image (the OpenID "profile" and "email" scopes). We do not access your Gmail, Drive, Calendar, Contacts, or other Google data. We use this data only to create and secure your account, sign you in, and show your basic profile in KUN. We do not use it for advertising, sell it, or use it to develop, improve, or train generalised AI or machine-learning models. You can revoke KUN's access from your Google Account permissions page at any time. KUN's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

15. Changes to this policy

We will update this policy when our practices change. For material changes, we will notify you in the app or by email before they take effect, and we will ask for your consent where the law requires it. The date at the top shows when this policy was last updated.

16. Contact

Anatoliy Belobrovik, Mejía Lequerica 34, Entresuelo 2A, 08028 Barcelona, Spain. Email: support@kun.chat.