Emochi

GDPR overview

The GDPR is never mentioned: not in the privacy policy, not in the terms, not in the EULA. The framework actually covered is American, with COPPA for children, the CCPA for California residents, the Nevada data-sale law and sections 1798.83 to 1798.84 of the California Civil Code. Those texts open a right to know which categories of data were collected and from which sources over the past twelve months, including any use for model training, a right to deletion subject to CCPA exceptions, and a promise of non-discrimination. A valid request is answered within 45 days, and an authorised agent may act on written permission. No Article 27 representative is designated, no data protection officer is named, no DPA is published or offered, no sub-processor list exists and no hosting country is stated. Governing law is California, with JAMS arbitration in San Francisco.

Who owns the data?

Ownership of your User Submissions stays with you. By posting them you grant Emochi a limited, worldwide, non-exclusive licence to process, analyse, modify and transform that content in order to operate, improve and keep the service compliant. Moderation is explicit: automated and AI systems may review, filter, edit or adapt submissions, and unlawful or non-compliant material may be removed, restricted or transformed. The terms state that such compliance edits do not transfer ownership of the underlying submission. The service itself, meaning the software and the platform content, belongs to the publisher: the EULA grants users only a revocable, non-transferable licence to use it.

Reuse rights

Signing up hands over an email address, a username and a password, or a Google account through SSO. The publisher then records the role type chosen, the chat model, character customisation, conversation content and uploaded images, alongside a wide device and network footprint: device name and identifier, activation date, hardware model, operating system and app versions, region, language, time zone, font size, mobile network identifiers, IP addresses, access timestamps and error, crash, restart or update events. Payments run through Apple Pay or Google Pay, so only limited financial data is handled directly. Stated purposes are delivering and maintaining the service, security, marketing messages with an unsubscribe option, and training and refining the models on anonymised, aggregated user data. Essential, analytics and advertising cookies are used, along with pixels and web beacons, and the Do Not Track signal is not honoured. The policy states that personal data is not sold to external parties, but profile information is public, third-party apps receive data when the user connects them, authorities can be served, and everything may transfer in a merger, acquisition or bankruptcy. Reuse on the user's side stays inside personal, non-commercial limits.

Data retention & training

Hosting summary

No hosting jurisdiction is disclosed. The privacy policy says only that uploaded content and images are stored on the publisher's servers, without naming a country, a region or a provider. There is no trust or security page, and no certification such as SOC 2 or ISO is claimed. The site is served behind Cloudflare (AS13335, anycast address 104.20.18.230, San Francisco node) and character images come from image-cdn.flowgpt.com, but a delivery network says where traffic is routed, not where data lives. The only fixed geographic anchor is the publisher itself, established at 385 14th street in Oakland, California, with California law governing the terms, which makes United States storage plausible without making it certain. Security is described in general terms: technical, administrative and physical safeguards and regular vulnerability monitoring, with no guarantee of result. No sub-processor list is published and no data processing agreement is offered, so a European buyer has no documented basis for assessing transfers.