Privacy Policy

1. What we collect

• Phone number.Required — it’s how we route messages to you.
• Email. Optional at signup; Stripe collects it during checkout for billing receipts.
• Message content. Every text you send the pal and every reply they send back. Stored so the pal can keep context across conversations.
• Profile facts you share.Birth date, what you’re working on, people you’ve mentioned — extracted by the pal from your conversation and saved to make future replies useful.
• Attribution data. If you arrived from an ad, we capture click IDs (fbc / fbp), UTM tags, and first-touch timestamp so we can measure ad effectiveness.
• Billing metadata. Stripe customer ID, subscription status. We never see your full card number — that lives at Stripe.

2. What we do with it

• Send your messages to the AI model that drafts your pal’s reply.
• Charge your card via Stripe and confirm successful payments.
• Compute attribution for ad campaigns via Meta’s Conversions API.
• Improve prompts and pal behavior, in aggregate.

We don’t sell your data. We don’t share message content with advertisers.

3. Subprocessors

The third parties who touch your data, and what they touch:

• Stripe — payments, billing, customer record.
• SendBlue — sends and receives the actual SMS / iMessage texts.
• OpenAI— drafts pal replies. Phone numbers and account IDs are not sent to OpenAI; only the message text and the pal’s system prompt go in.
• Supabase — primary database (user records, message history, embeddings).
• Vercel — hosts the web app and runs the agent loop.
• Meta — receives hashed identifiers (email, phone) and event metadata for ad attribution via Conversions API. We never send Meta your message content.

4. AI processing

Every message you send is sent to OpenAI to generate the pal’s reply. OpenAI may retain that data per their privacy policy (currently 30 days for abuse monitoring, then deleted, when accessed via the API). We don’t use your messages to train any model.

5. How long we keep it

• While you’re a user: we keep message history and profile data so your pal stays useful.
• After you delete your account: message content and profile data are removed within 30 days. Billing records (per Stripe) and webhook idempotency rows (24-hour TTL) are governed by their own retention.

6. Your rights

You can request access to your data, correction of bad fields, or deletion of your account by emailing hi@textpals.co. We’ll respond within a reasonable time (usually within a few business days).

7. Children

textpals is for adults. We don’t knowingly serve users under 18 and will delete any account we discover belongs to one.

8. Contact

Privacy questions: hi@textpals.co.