Privacy policy

Who we are

This policy explains how Spillch ("we" or "us"), the operator named on our About page, handles your personal data when you use the Spillch website and app. We handle personal data under Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.

What we collect

Account details: your email address, your password in hashed form (if you set one), your confirmation that you are 18 or older, and the version of our terms you accepted.

Profile details you choose to add, such as a preferred name, pronouns, gender and a few words about yourself, which characters use to personalise their replies.

Your chats and characters: the messages you send and the replies you receive, what characters remember about your conversations (summaries and notes), the characters you create, and pictures generated for you.

Payment records: your orders, subscriptions and SpillCoin transactions. Card and UPI details are entered with Razorpay, not with us; Razorpay tells us whether a payment succeeded and the contact details used for it.

Usage and technical data: how much of your allowances you use; product events such as signing up or subscribing, which never include message text; safety flags and reports; and your IP address and browser details in our server logs.

How we use it

To provide the service: running your account, generating character replies, remembering your conversations, generating pictures and processing payments.

To keep Spillch safe: checking messages, replies, characters and pictures against our content policy, handling reports, preventing abuse (for example, limiting how many accounts can share one email inbox) and securing accounts.

To contact you about your account: sign-in, verification and password reset emails, payment notices, and important changes to the service or these policies.

To understand and improve Spillch, using usage figures that don't include your messages. We don't use your chats to train AI models, and we don't sell your personal data.

By using Spillch, you consent to this processing. You can withdraw your consent at any time by deleting your account; this doesn't affect processing that has already taken place.

Who we share it with

We share personal data only with the service providers that help us run Spillch, and only what each one needs:

DeepInfra (United States) runs the AI models. For each reply, it receives the conversation context: the character, your profile details, what the character remembers, and recent messages.

OpenAI (United States) checks messages, replies and pictures for safety, and receives that text or image.

fal.ai (United States) generates pictures. It receives the picture's description, which may include details from your chat, and the character's portrait.

Razorpay (India) processes payments. Zoho (India) sends our emails, and receives your email address and the email's content.

Cloudflare stores files such as pictures, and runs the human verification check (Turnstile) at sign-up, which receives your IP address. DigitalOcean hosts our servers and database in Bangalore, India.

We may also disclose personal data when the law requires it, in response to a court order or a lawful request from a government authority, or to protect the safety of our users or others.

Who can see your chats

Your chats are private to you, and our team doesn't browse them. When our safety checks flag a message, or someone reports a chat, a moderator may see that message and up to five messages before and after it in order to review it. Every such view is recorded.

How long we keep it

While your account is open, we keep your data so your chats and characters are there when you come back. A chat you delete is permanently removed after 30 days.

When you delete your account, it closes immediately: you are signed out everywhere, your email address is removed from the account, and your profile, chats and characters are no longer available on the service (a character's name may still appear in other users' existing chats). We keep the closed account's data securely, out of use, for one year, to meet our legal obligations and to handle safety reports and disputes. Then we permanently erase it.

Some records are kept after that without anything that identifies you: payment and billing records, for as long as tax and accounting law requires; usage and safety records; and pictures generated on the service.

So that deleting and re-creating an account doesn't reset allowances, we keep a one-way, keyed fingerprint of your email address together with your recent usage for 30 days after you delete your account. It can't be turned back into your email address.

Routine backups of our database are kept for up to 14 days. Server logs are overwritten automatically as new entries are written.

Your rights

Download a copy of your data from Account → Privacy → Download your data. It includes your account, profile, chats, memories, characters, purchases and SpillCoin history (one export a day, available for 7 days).

Update your profile at any time from Account → Profile, and delete your account from Account → Privacy → Delete your account.

Under India's data protection law, you can also ask us for information about how your data is processed, ask us to correct or erase it, nominate someone to exercise your rights if you die or become unable to, and raise a grievance. Email the email on our Contact page, or contact our grievance officer. If you're not satisfied with our response, you can complain to the Data Protection Board of India.

Cookies

We use only the cookies needed to run Spillch: one that keeps you signed in securely, and one that remembers you were signed in so pages load correctly. We don't use advertising or third-party tracking cookies. Cloudflare's verification check at sign-up may set its own cookies to tell people from bots.

Security

We protect your data with encrypted connections (HTTPS), hashed passwords, limited and logged access for our team, and two-factor sign-in for administrators. No system is perfectly secure; if a breach affects your personal data, we'll tell you and the authorities as the law requires.

Children

Spillch is only for adults aged 18 or older. We don't knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we close it.

Changes and contact

We'll update this policy when our practices change, and tell you in the app or by email about significant changes. The date at the top of this page shows when it last changed.

Questions about your privacy: the email on our Contact page. All the ways to reach us are on the Contact page.