Privacy Policy — Portosera

This policy explains what data the Portosera app uses, why, where it goes, how long it stays and how you can control it. It applies to the app on iPhone and on Android, and to this website.

In short

We do not ask for your email, phone number or a password. The first time you open the app, it creates an anonymous account by itself.
The characters are fictional and their replies are written by AI. To write them, we send your messages to OpenAI, the company that provides the models. OpenAI does not use them to train its models.
The app has no advertising and no analytics from other companies. We do not track you across other apps or websites and we do not sell your data.
You can see what the characters remember about you, delete it and stop new memories.
You can delete your account from the app whenever you want: Tu, then Privacy e account, then Elimina l'account.
Portosera is only for adults, 18 or over.

1. Who is responsible for your data

The controller of your data is the developer named as the seller of Portosera on the App Store and as its developer on Google Play, called we or us in this policy.

For any question about privacy, or to exercise your rights, write to [email protected].

2. What data we use and why

2.1 The account and the phone

The first time you open the app, it creates an anonymous account. On our server this creates:

a random code that identifies your account;
a fake email address, which receives no mail and is only used by the sign-in system;
a sign-in session. With the session we save the IP address the app connected from when the session was created, and the technical label the app sends to the server, which can show the phone's system and the app's version;
your phone's time zone and language, to write to you at the right time and in the right language.

With every request the app also sends the app's version, the system, iOS or Android, the language, the time zone and a phone identifier.

The phone identifier is a random code the app creates the first time and keeps in the phone's protected storage. It is not the advertising identifier and it does not come from the system. We use it for one thing only: to give the welcome gift once per phone. When the gift is given, we save a fingerprint of the code, a transformation from which the code cannot be recovered, and not the code itself.

Why: to create and run the account, and to protect the service from people who create accounts in bulk to get more gems.

2.2 What you tell us about yourself

At the start, the app asks you for:

your date of birth, to check that you are at least 18. Once sent, it cannot be changed;
the name you want the characters to call you. It does not need to be your real name;
who you want to meet, women, men or everyone, and at least three kinds of stories;
if you want, whether you are a man or a woman, so the characters address you correctly;
if you want, a couple of lines about yourself, the bio, which the characters read before writing to you.

We also save when you confirmed your age and accepted the pact and the terms, and which version you accepted.

You can change your name, gender, bio, who you want to meet and the kinds of stories under Tu, Impostazioni. The bio goes through the content checks described in section 2.5.

Who you want to meet, together with your gender, may suggest your sexual orientation, which the law treats as sensitive data. You never have to reveal it: you can always choose everyone, Tutti, and not say your gender. If you choose women or men, you give us your explicit consent to use that choice, and we use it only to choose which characters to show you and to write to you in the right way. You can withdraw that consent at any time by switching to everyone under Tu, Impostazioni.

If your date of birth shows that you are under 18, the app stops. The date stays only on the phone, to keep the block, and never reaches our server.

Why: to provide the service, adapt it to you and respect the age limit.

2.3 Stories, dates and memory

On the server we keep:

the messages you write and those of the characters, including the photos and voice notes you receive and your reactions;
dates: the scenes, the answers you choose or write in your own words, what you ask for when you propose a date yourself, and how it went;
likes, passed cards, stories you paused or muted, levels and progress;
the characters you reported;
the characters you create: the draft while you write it, the description, the faces created and the one you choose. Characters you create are visible only to you.

Memory. From time to time a model rereads part of a story and notes some things you said about yourself, for example that you work in a studio or that you run by the sea on Saturdays. It keeps at most 40 of them per character. We ask it not to note health, sexual orientation, religion, politics, phone numbers, emails or addresses, and a filter discards notes that mention them. From the same reading, the character also writes a private diary of your story, which you do not see and which helps them remember what happened between you.

In the app, under Tu, you can:

see what each character remembers;
delete a memory: the character stops using it immediately, and it disappears completely from the server within a little over an hour;
clear all the memories of a character;
turn off Ricorda cose nuove: from then on we note nothing new and the characters no longer use their memories or diary.

Clearing memories does not delete the conversation: to reply to you, the character always rereads the latest messages of your story. Today the only way to delete conversations is to delete the account.

In your stories you write freely, within the terms. We recommend that you do not write very personal things, such as information about your health, or other people's data. If you choose to write them, you give us your explicit consent to use them only to reply to you as described here, and you can withdraw it by deleting the account.

Why: this is the service itself. Without this data the character could not reply to you or remember you.

2.4 Artificial intelligence and OpenAI

Replies, dates, memory, photos, voice notes and the characters you create are written or made by OpenAI models. To do this we send to OpenAI:

for a reply: the character's profile, the name you chose, your gender and bio if you gave them, the memories and the diary of the story if memory is on, the latest messages of the story and the time;
for a date: the same kind of context, your answers in the scenes and what you ask for if you propose it yourself;
for memory: a part of the story;
for a photo: a description of the photo and some photos of the character as a reference. The images always show the character, never you;
for a voice note: the words the character says;
for a character you create: what you write in the form.

We do not send OpenAI your date of birth, the phone identifier, your IP address or your account code.

OpenAI processes this data on our behalf, as our provider. Under its terms for the API, OpenAI does not use this data to train its models, and keeps it for up to 30 days to monitor abuse, unless the law requires it to keep it longer. OpenAI is based in the United States: for transfers, see section 5.

Inside the story the characters stay in their role and do not talk about how they are made. That they are fictional and written by AI we tell you before you start, in the pact, at your first chat and at the bottom of every profile. Their words can be wrong or out of place and are not advice.

2.5 Content checks and difficult moments

Every message you write in a chat also goes through OpenAI's moderation service, which looks for example for signs of self-harm or sexual content involving minors. The same applies to your bio, to the texts of a character you create and to the words you write in dates, including to ask for one. The model that writes the replies also signals when a person seems to be in danger, and when the character cannot reply right away the same model reads your message for this purpose only.

If you write that you want to hurt yourself, the app steps out of the story and answers with a help message: in Italy the emergency number 112 and Telefono Amico, in other countries the page findahelpline.com, with free help lines in many countries. The app may not notice: Portosera is not an emergency service. If you are in danger now, call your local emergency number straight away.
If a message asks for sexual content involving minors, the character refuses.
You cannot create a character who depicts a real person or a minor, or who has explicit content.
When you ask a character what they are, for example whether they are a person or a bot, a model also reads their reply before it is sent, to check that it keeps to the rules of the story, and has it written again if it does not.

When one of these things happens, we keep a note with the kind of check and what the app did, without the text of the message. The note is deleted after 90 days, or earlier if you delete the account.

Why: to protect you and others, to comply with the law and with Apple's and Google's rules. More on the Safety page.

2.6 Photos, voice notes and other files

The app never asks for your photos, camera, microphone, contacts or location: it does not have these permissions.

The characters' images and voice notes are stored on Cloudflare R2, a file storage service. Some are made only for you: the photos a character sends you in a chat after you accept them, the covers of your dates, the voice notes after a date and the faces of the characters you create. They open through a long random address that cannot be guessed. Anyone who has that address, though, can open the file, so do not share it.

When you delete the account, we delete the voice notes and images made for you: the chat photos, the date covers and the faces of the characters you created, including the ones you discarded. The photos that are the same for everyone, which the characters send to anyone, remain.

2.7 Purchases

Gems and the Pass are bought through Apple's App Store or Google Play. They handle the payment: we do not see your card details, your Apple ID or your Google account.

To manage purchases we use RevenueCat. RevenueCat receives the purchase data from the store together with your account code and passes it to us. Its component inside the app talks directly to RevenueCat and also sends it some technical information about the phone and the app, such as the system, the app's version, the language and the store's country.

We keep:

what you bought, when, the price and currency, the store and the transaction code;
any refunds;
the status of the Pass;
your gem balance and every movement of gems, with the reason;
the purchase notifications RevenueCat sends us, as they arrive. Among other things they contain the store's country.

Why: to give you what you bought, to handle refunds and disputes, and for accounting and tax obligations.

2.8 Notifications

Notifications are sent only if you allow them on your phone.

If you allow them, the phone gives us a code to send you notifications. We save it with the system, the app's version and the language. Notifications are sent by Expo's notification service and reach the phone through Apple or Google. Each notification contains the character's name and the beginning of their message. For each notification we keep for 90 days a technical note without text: which message it was about and how the delivery went.

You can turn them off under Tu, Impostazioni, Notifiche, for a single story with Silenzia notifiche, or in your phone's settings. With the Pausa notturna, under Tu, Benessere, no messages and no notifications arrive at night.

Why: to tell you about new messages, with the permission you gave.

2.9 Technical logs

To work and stay secure, the server keeps some logs:

for every call to the models: which model, how much it cost, how long it took and how it went, without text. They stay for 90 days and are also used for daily limits;
technical copies of the responses to your actions, so that a request can be repeated without being carried out twice. They stay for 48 hours;
counters of connections per IP address, against people who create accounts in bulk. They stay for one to two days;
the server's logs, with requests, errors and warnings. They do not contain your messages or the content of your requests. They can contain your account code, in some warnings the IP address and, when a model answers in the wrong format, the text of that answer. They are kept only for a limited time: they are deleted automatically when the server is updated, which happens regularly.

On our server we also count things like how many people use the app in a day and how much the replies cost. These are overall numbers, used to keep the service running.

Why: to run the service, protect it and keep its costs under control.

2.10 What stays on the phone

On the phone the app keeps:

the sign-in code, the phone identifier, the date of birth and the age block if there is one, in the phone's protected storage;
your choices from the start, the settings, some preferences of the app and the images and lists already downloaded, to load faster.

On Android, uninstalling the app deletes this data, and with it the access to the account. On iPhone the protected storage can keep it even after the app is uninstalled.

2.11 This website

portosera.com uses no cookies, no analytics and no tracking, and loads nothing from other companies. To deliver the pages and protect them from attacks, Cloudflare and our server process your IP address and the technical data your browser sends, such as the page requested and the browser type, and keep them in short-lived logs.

3. What we do not do

No advertising in the app, and no data given to advertisers.
No analytics or crash reporting tools from other companies: the app does not contain them.
No tracking: we do not use the phone's advertising identifier and we do not follow you across other apps or websites.
We do not sell or share your personal data for advertising.
We do not make automated decisions that have legal effects on you.
In Portosera you do not talk to other people: other users see nothing about you.

4. Our legal bases

The GDPR, the European data protection regulation, asks us to say on what basis we use each piece of data.

Contract, article 6(1)(b): the account, profile, stories, memory, dates, created characters, purchases, gems and the Pass. Without this data we cannot provide Portosera.
Legal obligation, article 6(1)(c): keeping sales records for tax purposes and answering requests from the authorities.
Legitimate interest, article 6(1)(f): security, limits against abuse, the welcome gift once per phone, content checks, technical logs and cost control. You can object by writing to us: we assess each request individually.
Consent, article 6(1)(a): notifications, which are sent only with your permission and which you can turn off at any time.
Explicit consent, article 9(2)(a): the choice of who you want to meet, as section 2.2 explains, and any sensitive information you choose to write in your stories, as section 2.3 explains.

5. Who helps us and where the data goes

These providers help us. They process data on our behalf, only for the service they provide to us:

Hetzner Online: the server and the database, in a data centre in Germany, and the database backups, in its storage in Falkenstein, Germany.
Cloudflare: protects and routes the traffic between the app and the server, serves this website, and stores files in R2.
OpenAI: the models that write the replies, make images and voice notes and check content.
RevenueCat: the management of purchases and the Pass.
Expo: sending notifications.

Apple and Google handle payments and the delivery of notifications as independent controllers, under their own privacy policies.

OpenAI, RevenueCat, Expo and Cloudflare are companies based in the United States, and data can reach the United States. For these transfers we rely on the safeguards the GDPR provides: the European Commission's standard contractual clauses, or the EU-U.S. Data Privacy Framework where the provider is certified under it.

We may disclose data to the authorities when the law requires it.

6. How long we keep data

Profile, stories, memory, dates, created characters, gems and progress: as long as you have the account.
A memory you delete: it disappears completely within a little over an hour.
The session, with the IP address and the app's technical label: as long as it is valid. A session expires 90 days after it was last used and is then deleted within an hour.
Logs of calls to the models and notification notes: 90 days.
Notes from the content checks: 90 days, or earlier if you delete the account.
Technical copies of responses: 48 hours.
Connection counters per IP address: one to two days.
Server logs: until the server is next updated, which happens regularly, then they are deleted automatically.
Sales: after the account is deleted, they remain without any link to you for as long as tax and accounting law requires, up to 10 years.
RevenueCat purchase notifications: as long as you have the account.
The fingerprint of the phone identifier: it remains even after the account is deleted, without any link to you, so that a new account on the same phone does not receive the welcome gift again.
Database backups: one per night, each kept for about 15 days. Deleted data can remain in these backups until they expire.

7. Deleting your account

In the app: Tu, then Privacy e account, then Elimina l'account. The app asks you to confirm twice.

Immediately:

we empty the profile: name, date of birth, gender, bio, preferences, settings;
we delete the account and its sessions;
the phone forgets your profile and the app starts from the beginning. Only the phone identifier stays on the phone.

Shortly after, usually within minutes and at most within a few hours, we delete everything else: messages, stories, memory and diary, dates, created characters, likes and reports, gems, the Pass and progress, notification data, logs of calls to the models, notes from the content checks, RevenueCat purchase notifications, and the voice notes and images made for you.

What remains, without any link to you:

sales records, for tax obligations;
the fingerprint of the phone identifier, so the welcome gift is not given again.

What also remains:

the data Apple and Google keep under their own rules. We ask RevenueCat to delete your customer profile;
what OpenAI keeps to monitor abuse, for up to 30 days under its terms;
the database backups, one per night, which delete themselves after about 15 days.

The Pass does not cancel itself. Deleting the account or uninstalling the app does not stop the subscription: cancel it in the App Store or Google Play settings, otherwise the store keeps charging it.

If you no longer have the app, read the Delete your account page.

If you uninstall the app without deleting the account, the data stays on the server. On Android, or on a new phone, the app may not find that account again. We may delete accounts that have not been used for more than two years.

8. Your rights

You have the right to:

know what data we have about you and get a copy;
correct it;
delete it;
restrict its use;
receive it in a machine-readable format, to take it elsewhere;
object to uses based on legitimate interest;
withdraw your consent at any time, for example by turning off notifications, without affecting what was done before.

Many things you can do directly in the app: change your name and preferences under Tu, Impostazioni, delete memories under Tu, delete the account under Tu, Privacy e account.

The app does not yet have a button to download your data. To get a copy, or for any other right, write to [email protected].

Your account has no email or username, so we need to be reasonably sure that it is yours before we give out or change any data. We will ask you for details that only the account's owner knows, such as the name you chose, the characters you talk to and roughly when you started. If we cannot recognise the account, we cannot act on it, and the safest way is always to do it from the app.

We reply within one month. If the request is complex we may take two more months, and in that case we tell you within the first month.

If you think we are using your data in the wrong way, you can complain to the data protection authority of the country where you live or work. In Italy it is the Garante per la protezione dei dati personali, at garanteprivacy.it.

9. Minors

Portosera is only for adults, 18 or over. We do not knowingly collect data from minors. If we learn that an account belongs to someone under 18, we delete it. If you know of one, write to [email protected].

10. Security

Communications between the app and the server are encrypted.
The server answers only through Cloudflare, and the database cannot be reached from the internet.
The sign-in code is kept in the phone's protected storage.
Of the phone identifier we keep only the fingerprint.
Only the people who run the service can access the data, and only when needed.

No system is one hundred percent secure. If something happens that puts your data at risk, we do what the law requires, including telling you when needed.

11. Changes

We may update this policy when the app or the law changes. The version in force is always on this page, with the date of the last update. If something important changes, we tell you in the app or on this site before it takes effect.

12. Contact

Privacy and everything else: [email protected], in English or Italian.

If this version and the Italian one differ, the one more favourable to you applies.