Your conversations and photos are private from other users. This Policy explains the limited processing and access needed to run Dopoxy and meet legal obligations. Private does not mean that data stays solely on your device or is inaccessible to the providers operating the service.
1. Who is responsible
DeLafée International SARL, Case Postale 2145, 2001 Neuchâtel, Switzerland, is the controller responsible for your personal data. For privacy questions or requests, contact contact@dopoxy.com.
2. Information we collect
Account information: the registration and login details you provide, your account identifier and age eligibility information. If you sign in through Apple or Google, we receive the information that login service makes available, such as an email address and account identifier.
Conversations and photos: messages you send, AI responses, photos you choose to upload, and any saved conversation history or preferences used to provide continuity. If memory features are enabled, this includes saved summaries or memories. We request photo or camera permissions when needed; you can manage them in your device settings.
Purchases and support: transaction references, subscription status and purchase information supplied by Apple or Google, plus messages and reports you send to support. We do not receive your full payment-card details from the stores.
We use only the technical information needed for the purposes below. Information needed to create an account or deliver a requested feature is identified when requested; without it, we may be unable to provide that feature.
3. Why we use information
We use your information to create and secure your account, generate AI replies, process uploaded photos for requested features, maintain conversation continuity, recognize paid access, respond to support requests, prevent abuse and meet legal obligations.
Where EU or UK data protection law applies, we rely on performance of our contract for account operation and requested chat features; legitimate interests for proportionate security, fraud prevention, troubleshooting and service reliability; legal obligations for required records and lawful demands; and consent for optional uses requiring it. Swiss processing is subject to the Swiss Federal Act on Data Protection.
Conversations may reveal sensitive information, including health, beliefs or sex life. Avoid sharing unnecessary sensitive details or other people’s private information.
4. Keeping conversations private
We do not publish your private chats or photos or make them available to other users or character creators. We do not sell personal data, use private chats or photos for advertising, or share them for targeted advertising. We and our providers do not use your private chats or photos to train general-purpose AI models unless you separately opt in.
Relevant messages, chat context and uploaded photos are processed by the AI and hosting providers that help deliver the service. Before sending personal data to a third-party AI provider, we explain that sharing and obtain the explicit permission required by the applicable store rules and law. Providers acting for us must follow contractual data protection and confidentiality obligations.
5. Who may access information
Access is limited to what is reasonably necessary. Authorized personnel and providers may process relevant data to run the service, investigate a security or abuse issue, respond to your support request, or comply with law. This can include automated safety checks and limited human review. We do not continuously monitor conversations or guarantee emergency intervention.
Service providers include hosting, storage, AI processing, authentication and support providers. Apple and Google separately handle store transactions under their own privacy notices. We may disclose necessary information in response to valid legal process, to comply with law, or to address serious threats to safety or establish or defend legal rights where legally permitted. Any business transfer must preserve applicable privacy protections and cannot itself authorize incompatible new uses of your conversations.
6. Providers and international processing
Our providers and processing locations are currently:
- Microsoft Azure (Microsoft Ireland Operations Ltd): hosting of the Dopoxy servers, database, account login system and storage of photos and media. Receives all the data described in section 2. Processed in Ireland (North Europe region); Microsoft may provide remote support and maintenance from other countries under its data protection terms. Privacy notice
- SpaceXSI, formerly xAI (SpaceX Super Intelligence LLC), provider of the Grok models: generates character replies and analyzes the photos you upload. Receives the messages, chat context, saved memories and photos needed for each reply, through a direct connection to its API with no intermediary. Processed in the United States and other countries where SpaceXSI and its subprocessors operate. Privacy notice
- PostHog (PostHog Inc.): product analytics, with your consent. Receives usage events, device and app information and your account identifier. Hosted in the EU (Frankfurt, Germany); PostHog personnel may access it remotely from other countries. Privacy notice
- Apple and Google: optional sign-in and app store purchases, as independent providers under their own privacy notices (Apple, Google).
We may add or replace providers, for example to use other AI models. We will update this list before a new provider receives your personal data and, where the law or store rules require it, ask for your permission again.
Your data may be processed outside Switzerland or your home country in the locations listed above. Ireland and Germany are recognized by Switzerland and the United Kingdom as providing an adequate level of data protection. For transfers requiring protection, in particular to the United States, we rely on the European Commission’s Standard Contractual Clauses, with the adaptations required for Swiss data and the UK International Data Transfer Addendum, as incorporated in our providers’ data processing agreements, or on a provider’s certification under the EU-U.S. Data Privacy Framework and its Swiss and UK extensions where applicable. You may contact us for details or a copy of applicable safeguards.
7. Retention, security and deletion
We keep account data, chat history, photos and any saved memories for as long as your account exists. Following account deletion, we remove them from active systems within 30 days; backup copies expire within a further 35 days. The same deletion rules cover related summaries and derived memories, subject to the limited exceptions below.
Security logs and support records are kept for 12 months. Purchase and accounting records are retained for applicable statutory periods. We may keep limited information longer where needed for a legal obligation, fraud investigation or legal claim, with access restricted to that purpose. SpaceXSI stores the requests and responses it processes, encrypted, for up to 30 days to investigate suspected abuse or misuse, then deletes them automatically; it does not use them to train its models.
We apply appropriate technical and organizational safeguards, including restricted access and measures to protect data during transmission and storage. No online service can guarantee absolute security. This Policy does not promise end-to-end encryption.
Delete your account in the app under Settings > Account > Delete account. You can also request deletion and exercise your rights at contact@dopoxy.com. The app does not yet offer separate controls for deleting chat history or saved memories; to have them deleted without closing your account, contact us. Deleting your account does not necessarily cancel an Apple or Google subscription; cancel it through the store as well.
8. Your choices and rights
Depending on applicable law, you may request access, correction, deletion or a copy of your data; object to or restrict processing; withdraw consent; and appeal a decision concerning your privacy request. We may need proportionate identity verification and will respond within applicable legal deadlines. Withdrawing consent does not affect earlier lawful processing. You may complain to the Swiss Federal Data Protection and Information Commissioner or the relevant authority in your country.
We request consent before non-essential tracking where required, and do not require optional tracking to use core chat features. We use PostHog for product analytics, based on the consent you give when you create your account. You can withdraw this consent at any time by contacting contact@dopoxy.com; we will then stop collecting analytics for your account. Device permissions and optional notifications can be managed in device or app settings. Where legally required, you may contest significant automated account decisions and request human review by contacting us.
Dopoxy is for adults aged 18 and over. If we learn that a child has an account, we will restrict access and delete personal data as required by law. Contact us if you believe a child is using the app.
We will post updates here and notify you of material changes. We will obtain fresh consent before introducing a new use that legally requires it.