1. Who We Are
LegacyX operates the Her mobile application (the "App") available through Google Play and accessible at thegirl.app. This Privacy Policy describes how we collect, use, and share information about you when you use our App.
By creating an account or using the App you agree to this Privacy Policy. If you do not agree, please do not use the App.
2. Information We Collect
2.1 Account Information
- Email address (used to send you a one-time password to log in)
- Google account profile (name, email address, profile photo) if you choose to sign in with Google
2.2 Onboarding and Psychological Profile
When you first use the App, you complete a short onboarding flow. We ask about your communication style, attachment tendencies, banter tolerance, openness, conflict style, interests, and what you are looking for in a companion. We also collect the name you want her to use for you and an optional country preference.
This profile is used to generate a personalised AI companion specifically for you. It is not shared with other users and is not sold.
2.3 Chat and Conversation Data
Every message you send and every reply you receive is stored on our servers. We use this data to deliver the chat service, build and retrieve long-term memory across sessions, and improve our AI models. Conversations are stored in our PostgreSQL database. Daily conversation summaries are stored as vector embeddings (via Voyage AI and pgvector) for semantic memory retrieval.
2.4 Usage and Interaction Data
- Daily message count (used to enforce free-tier limits)
- Your timezone and country, inferred from your device or onboarding answer
- Push notification delivery receipts and open events
- Crash reports collected automatically via Firebase Crashlytics
2.5 Device and Technical Data
- Firebase Cloud Messaging (FCM) token for push notification delivery
- Device operating system and version
- App version
2.6 Subscription and Payment Data
Purchases are processed by Google Play via RevenueCat. We never receive or store your payment card number. We do receive and store your subscription status: your tier (free or unlimited), expiry date, and daily message count. This data is stored in Firebase Firestore and on our servers.
2.7 Training Data (Optional)
We may collect anonymised conversation data to improve our AI models. Before any data is written to our training dataset, your user identifier is irreversibly hashed using HMAC with a private salt. We cannot link training data back to your account. You may opt out by writing to us at privacy@thegirl.app.
3. How We Use Your Information
- To create and manage your account and authenticate you securely
- To generate your personalised AI companion and operate the chat service
- To maintain long-term memory so nothing she learns about you is lost
- To send push notifications when she has a new message or when she decides to check in on you
- To enforce free-tier message limits and process subscription upgrades
- To detect abuse, policy violations, and prevent harm to users
- To improve the App and our AI models using anonymised data
- To respond to your support requests
- To meet our legal obligations
4. How We Share Your Information
We do not sell your personal data. We share it only in the following circumstances.
4.1 AI Inference Providers
Your messages are transmitted to third-party large language model (LLM) providers to generate responses. Current providers include OpenRouter, Fireworks AI, and Baseten. Semantic embeddings for memory are generated by Voyage AI. These providers process your data solely to return a response and are subject to their own privacy policies and data processing agreements.
4.2 Infrastructure and Service Providers
- Firebase (Google): push notification delivery (FCM) and crash reporting (Crashlytics)
- Google Sign-In: OAuth authentication if you use Google login
- Resend: delivery of one-time password emails
- RevenueCat: subscription management and receipt validation
- Cloudflare: DDoS protection, CDN, and edge routing for our servers
- Neon: optional secondary database for anonymised training data storage
4.3 Legal Requirements
We may disclose your information if required to do so by law, court order, or regulatory authority, or where we believe disclosure is necessary to protect the rights, property, or safety of LegacyX, our users, or the public.
4.4 Business Transfers
If LegacyX is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.
5. Data Retention
We retain your account data, psychological profile, and full conversation history for as long as your account is active. If you delete your account we will delete your personal data within 30 days, except where retention is required by law. Anonymised training data is retained indefinitely because it cannot be linked back to you.
6. Security
We protect your data using HTTPS for all data in transit, encrypted database connections, JWT-based authentication, Redis-based rate limiting, and access controls on our infrastructure. We run our servers behind Cloudflare for network-level protection. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
7. Children
The App is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will suspend their account and delete their data. If you believe a minor has created an account, contact us at privacy@thegirl.app.
8. Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate personal data
- Request deletion of your account and associated personal data
- Object to use of your conversation data for AI training
- Receive a copy of your conversation history (data portability)
To exercise any of these rights, email privacy@thegirl.app. We will respond within 30 days.
9. Push Notifications
We send push notifications via Firebase Cloud Messaging. These include new messages from her and proactive check-ins when she decides to reach out. You can disable push notifications in your device settings at any time. Disabling notifications does not delete your account or affect her messages, which will be waiting when you open the App.
10. International Transfers
Our servers are hosted within the European Union. AI inference providers and some other service providers are located in the United States. When your data is transferred outside your country, we rely on standard contractual clauses and equivalent safeguards to protect it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through an in-app notice or push notification. Your continued use of the App after the updated policy takes effect constitutes your acceptance.
12. Contact
For privacy questions, data requests, or to opt out of training data collection, contact us at privacy@thegirl.app.