ToThereOn Privacy Policy
ToThereOn is an independently operated remembrance service ("we", "us"). Our windows are built for people grieving a companion animal, so we hold what you share with particular care — and we describe it here plainly.
1. What we collect
- Account: email address, password (hashed by our authentication provider), language preference.
- About your companion: their name, species, the photographs you upload, and the memories, habits, and letters you write. Letters are sealed (encrypted) on arrival; the reply pipeline and specifically authorized service operators can read them for reply preparation, review and support.
- Payment: Whop is the payment processor for new paid subscriptions when checkout opens. ToThereOn supplies the service and handles service support and refund requests. We retain payment, subscription, refund and dispute identifiers, status, amount and paid-period records linked to your account, not full card numbers. Historical Polar transactions and their necessary billing records remain with the original payment provider.
- Technical: logs necessary to run and secure the service (IP, timestamps, errors). No advertising trackers. We do not respond to Do-Not-Track signals because we do not track you across other sites.
2. What your data is used for
Only to run the service you asked for: keeping their world running, generating their days, letters, and pictures with AI from what you shared, showing them to you, processing your subscription, and answering support requests. We do not sell or share personal information for advertising. We do not use your letters or photographs to train AI models.
For support and quality checks, specifically authorized operators may open the generated days, replies and world news including drafts being prepared before delivery. Each access requires a reason and is recorded. Only operators with separate letter-operation authority can request access to your sealed incoming letters for reply preparation, review and support. Access requires a reason and is recorded; the original stays encrypted at rest and the temporary reading envelope expires after ten minutes. This does not grant access to private journal entries, generation prompts or photographs. Operational screens also show companion names, world events and delivery progress so operators can identify service problems.
2a. Optional public community
Your neighbour profile uses one approved nickname and, if you choose to upload one, a public avatar across new posts and comments. Private companion photos are not copied to it automatically. We store profile revisions, consent and review records; a pending change leaves the approved profile visible. Older posts that used a separate display name keep that name. The private avatar choice for your companion is saved to your account so it works across your devices.
Sharing is optional and separate from your private companion window. We store the display name and text you explicitly submit, the selected topic and visibility/comment settings, submission and review status, and your hearts, follows, blocks and reports. Hearts store the account, shared-post identifier and time; aggregate counts are public, not a list of reacting accounts. A per-account hourly operation counter limits abuse. Authorized reviewers can read the submitted copy and comments to decide whether to publish them and handle reports; this does not give them access to your private correspondence. Approved copies, their display names, public profile identifiers, topics and publication times can be read by anyone with the public link, including people outside your country. Private photographs and private links are not attached automatically. Recommendations use language, a topic you choose, recency or explicit follows, not private letters or inferred grief.
You may withdraw a copy without deleting its private original. Withdrawal removes its text, associated comments and hearts from the service; text removed with a parent story is not restored in exports. Removing a heart deletes that reaction. Copies or screenshots others saved cannot be recalled. Blocking applies while signed in and does not make a public link private. Account deletion removes your community profile and its associated posts, comments, hearts, operation counter, follows, blocks and reports. Exports distinguish this companion's shared posts from your account-wide own comments, hearts and settings; other guardians' text is not included.
If you separately choose overseas AI safety screening for a submission, its display name and text may be sent to OpenAI, L.L.C. (United States; privacy@openai.com), over an encrypted connection at review time, solely for that review. Private correspondence and photographs are not included. Responses are sent with storage disabled; abuse-monitoring retention may be up to 30 days. This choice is separate from AI generation consent. Without it, the submission remains eligible for human review. You can stop future screening from your own submission without withdrawing the public copy; data already transmitted cannot be recalled. We keep the wording version, grant time and any revocation time to apply this choice and include your consent records in your export.
2b. Life-status choice and private journals
New world introductions require an explicit statement that your companion has died. We store it with its wording version, language and submission time, without inventing statements for existing companions. Missing or life-status-unknown companions can instead have a separate private journal. We store the selected situation, locale, ownership, encrypted name and records, creation/deletion times and daily usage counts. This creates no world resident, generated reply, public post or subscription. Journal text is not sent to AI providers, used in the world or included in community screening. Unlike world generation, it requires no AI-transfer consent.
The service decrypts journal text for its signed-in owner and their private download; this is not end-to-end encryption. Journal keys are separate from companion-letter keys. Ordinary support/moderation roles have no journal reader or database grant; this does not mean a hosting operator cannot technically access service-held keys. Owners can download readable text and delete records or journals. Journal deletion removes its key and text from the live database, and an account-erasure request removes all the owner's journals. Downloads cannot be recalled; backups need a separate retention and erasure process. Displayed limits do not promise unlimited or permanent storage. No automatic change of life status or move into a world is offered. Statements below about unavailable AI generation without transfer consent do not prevent using this non-AI journal.
2c. Optional dates and chosen address
You may separately record a remembered birth or departure year and optional month, including whether it is approximate, unknown or skipped, and the name or word your companion uses for you. We keep these declarations and their revision history in the private database. Dates do not create anniversaries, determine personality or voice, or go to reply generation. A chosen address is included in the private profile and newly prepared AI replies under the existing generation-transfer choice; already prepared and published replies retain their original version. Your data download includes earlier declarations. Account deletion removes the live declarations and profiles; downloaded copies cannot be recalled and backups require the separate erasure process described below.
3. Photographs, people, and detection
Uploads should show only your companion. Every photograph is checked — your own answer first, then automated face and person detection — and any photograph that may contain a person is excluded from AI processing and from any transfer abroad. Album uploads remain on our Korean servers and can be deleted from the album. Photographs supplied during onboarding are not added to the album automatically; originals blocked by the check remain in the private Korean onboarding record and are removed when you delete the account. Detection is presence-only: it produces a yes/no outcome, no face templates or biometric identifiers are created or retained, and detection geometry is discarded immediately. Do not upload photographs of children; a photograph of anyone requires that person's (or their guardian's) permission.
4. Grief is health data, and we treat it that way
(Consumer Health Data section — WA MHMDA/NV)
What you write to your companion can reveal your mental and emotional state. We collect it only because the service you asked for cannot exist without it, use it only to produce the world's responses and safety features (the crisis notice), never sell it, and never use it for advertising. You may withdraw consent, and you may have it deleted (section 8). Our crisis-support feature shows help lines; using or not using it is never recorded for any purpose beyond showing it to you.
5. Where your data lives and travels
Your data is stored in Seoul, Republic of Korea (database and file storage: Supabase, Seoul region). The web service runs on Vercel (Seoul region function). To generate days, letters, and pictures, the necessary text (your companion's name and the memories, habits, and letters you share) and photographs that passed the person check are transmitted to our AI provider, OpenAI, L.L.C. (United States; privacy@openai.com), at the time of each generation, over encrypted connections. We send them with storage disabled; the provider does not use them to train its models and retains them for up to 30 days for abuse monitoring, after which they are deleted. They are used only to produce your world's content. This transfer needs your separate consent, which we ask for when you introduce your companion and which you can withdraw in Settings at any time. If you refuse or withdraw it, we cannot generate their days, letters, or pictures, so the service cannot be provided; nothing already made is taken away. Photographs that may contain a person are never transferred. UK users: these onward transfers are safeguarded by the provider's data processing addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. We have not appointed a UK representative; write to us at the privacy address below.
6. Who else touches data
(processors)
Supabase (hosting, Seoul) · Vercel (web) · Whop (new payment processing; its privacy policy governs its checkout processing) · Polar (historical transactions only) · OpenAI (AI generation, United States) · Resend (email delivery). Payment providers process information under their own applicable privacy terms; this list does not represent every provider as our data processor under an identical agreement.
7. Retention
Existing letters, pictures and world records are not deleted merely because you cancel or a payment lapses. They remain readable under Free while your account and the service remain available, subject to your deletion choices. This is not a lifetime storage or uninterrupted-generation product. Existing contractual and statutory rights remain intact. Account deletion removes or cryptographically erases private live records; downloaded copies cannot be recalled. Necessary billing records may be retained for applicable legal obligations and unresolved refunds or disputes. Backups require their separate erasure process. If the service closes, we will explain the available export, deletion and refund arrangements and honor applicable rights. Blocked album photographs remain until you delete them; blocked onboarding originals remain until account deletion. Logs: up to 30 days.
8. Your rights
You may access, correct, export, or delete your data — including the entire world — at any time: in-app account deletion runs cryptographic erasure of sealed letters and removal of photographs, or write to ottystartup@gmail.com. We answer within 30 days. UK users may complain to the ICO; Korean data subjects to PIPC; Washington residents have the rights in section 4. We honor requests regardless of where you live.
9. Children
ToThereOn is for adults 18. We do not knowingly collect information from children, and accounts may not be created for them.
10. Changes and contact
Material changes are announced on this page (and by email for subscribers) with a new effective date before they apply.
Team ToThereOn · Support and refund requests: ottystartup@gmail.com