Privacy Policy

This Privacy Policy explains what personal information Katchers Inc ("Sable", "we", "us") collects when you use the Sable website at sable.nyyx.ai and the Sable apps (the "Service"), how we use it, who we share it with, how long we keep it, and the choices and rights you have. For people in the European Economic Area and the United Kingdom, we are the controller of your personal information.

Sable is only for adults aged 18 or older. Words like "Terms" have the meaning given in our Terms of Service.

1. The short version

• You sign in with Google or Apple. We never see or store a password, and we keep your email address only as a keyed hash that cannot be read back.
• Your conversations are private to you. They are sent to AI providers to generate replies, and new conversation content is encrypted before it is stored.
• We do not ask for your date of birth. If you verify your age, our provider Persona handles your ID and selfie; we do not receive them.
• We do not sell your personal information for money, we do not show ads inside Sable, and we do not use your conversations to train AI models.
• We advertise Sable on other services. To measure and improve those ads, we record how you arrived and, in the countries where advertising measurement is switched on, share limited information about your visits, sign-ups and purchases with Meta. That includes which pages and works you view. We do not share your conversations, personas, calls, name or email address for this, and you can opt out (sections 2, 5 and 9).
• What you say on a call is kept as text so you can read it back, encrypted with a key unique to that call. You can delete it whenever you like, and nothing deletes it for you.
• You can delete conversations and close your account in the app. We keep information only as long as we need it, as explained in section 7.

2. Information we collect

Account information

When you sign in with Google or Apple, we receive an account identifier from that provider and the email address on that account. We use the email address to confirm who you are, to keep one email address from creating duplicate accounts, and to give welcome coins only once per address. We do not store the address in readable form: we store a keyed hash of it. If you use Apple's "Hide My Email", the address we receive is the relay address Apple gives us. We do not receive or store a password.

We create a handle and display name for your account, and you can change them. We also keep your avatar if you upload one, your language setting, when you signed up, and your account status.

Personas

A persona describes who you play in conversations. It can include a name, an age, an occupation, a gender and a description. The description is encrypted before it is stored; the other persona fields are not.

Conversations

We store the messages you send, the replies the AI generates, alternative replies you ask for, memory notes summarized from your conversations, and the settings you choose for a conversation, such as the AI model. New conversation content and memory notes are encrypted with a key unique to each conversation before they are stored.

Your conversations may include sensitive information, including about your sexuality or sex life, your health or your beliefs, if you choose to write it. Only include what you are comfortable sharing. We use it only to provide the Service to you and for the safety purposes described in section 3.

If you create scene images or videos from a conversation, we store them privately so that only you can see them.

Calls

When you make a call, your microphone audio is streamed from your device directly to the voice service that runs the conversation. Which service that is depends on the language of the call: English calls are run by ElevenLabs, and Korean calls by Google. Sable does not record or store the audio.

When you start a call that ElevenLabs runs, we also give ElevenLabs a few details so the character can talk with you naturally: the name on your default persona, if you have given it one; your local date and time, with the name of your time zone; the city we estimate you are in, from your connection or from your time zone; the memories kept from your earlier calls with that character; and how many calls you have had with that character and when the last one was. The city is only an estimate, and we do not store it. Calls run by Google are not given these details.

We store what was said on the call, as text. You can read your past calls with a character in the app, and delete any call, or all of them, whenever you like. We keep them until you delete them; we do not delete them on a schedule. What was said is encrypted with a key unique to each call before it is stored, and deleting a call's words also destroys that key.

A transcript of the call is also used, after it ends, to suggest short "memories" about what you talked about. That transcript is sent to OpenAI for this purpose. Only the memories you choose to keep are used in later conversations — what is stored for you to read back is not sent to the character.

We also store call records (when calls started and ended and how long they lasted), your relationship level with the character, and your time zone, which we use to apply daily limits and quiet hours.

If you allow notifications for incoming calls, we store your browser's push subscription (an address at your browser's push service and the keys needed to send to it), your language and your time zone.

Content you publish and share

If you create characters or stories, we store them, including their text and images. We also store comments you post and pictures you attach to them, the works you like, the authors you follow, the reports you make and the people and conversations you block.

Support messages

When you contact us through Help, we store your messages, their category and our replies. If you tell us why you are closing your account, we store that reason.

Age information

We do not ask for or store your date of birth.

When you answer the agreement on your first visit, your answer is stored only on your device, in your browser's storage. When your account confirms that you are 18 or older, we record that confirmation, the version of the policy it applied to, when it happened, how it was declared, and a country code if your device sends one. We also keep an age record for your account that says whether you have self-declared or been verified as an adult.

If you verify your age, Persona collects and processes a photo of your government-issued ID and a selfie, under its own privacy policy. We send Persona only a random reference that is not linked to your email or name. We receive the status and result of the verification, Persona's identifiers for it, and the time it happened. We do not receive your ID images, your selfie, your name or your date of birth.

Purchases, coins and rewards

When you buy coins, the payment is handled by Stripe or PayPal, which collect your payment details directly. We receive and keep an order record: what you bought, the amount and currency, the payment provider's reference numbers and the status, including any refund or dispute. We keep a ledger of the coins added to and spent from your account.

If you take part in an invitation program, we store who invited whom, the rewards given, and a hash derived from each person's email hash, used to stop the same person from being rewarded twice.

How you use Sable

When you are signed in and have agreed to our Terms, we record how you use the app, linked to your account: which works were shown to you and which you opened, swiped, liked, shared, commented on, reported or blocked; when you start conversations and use chat features; and how long the app was in the foreground. We do not record the text of your messages, your search terms, your IP address or a device fingerprint in these records.

How you arrived

When you arrive at Sable, we note how you got here, and we keep this for your first visit and for your most recent visit that came from a campaign: campaign tags in the link you followed (the `utm_source`, `utm_medium`, `utm_campaign`, `utm_content` and `utm_term` parameters), the site that referred you (its scheme and host only, never the page or its query), the path of the page you landed on (without its query), your browser's language and the time. If the link came from an ad, it may also carry an advertising click identifier set by the ad platform (Meta's `fbclid`, Google's `gclid`, `gbraid` or `wbraid`, TikTok's `ttclid`, X's `twclid` or Microsoft's `msclkid`).

We keep this in your browser's storage on our own domain. When you create an account, your browser sends it to us once and we store it with that account, so we can tell which campaigns lead to sign-ups, conversations and purchases. We keep it while your account exists and remove it when the account is closed, as described in section 7. This record is ours and is not itself sent to Meta, and opting out of advertising measurement does not remove it. Where advertising measurement is on for you, the click identifier of a Meta ad you followed does reach Meta, through the measurement described below.

If you are in the European Economic Area, the United Kingdom or Switzerland, if we cannot tell which country you are in, or if your browser sends a Global Privacy Control signal, we keep this only for your browser session and we do not keep or store advertising click identifiers at all.

Advertising measurement

Advertising measurement is switched on country by country. When this version of the Policy took effect it was not yet switched on anywhere, and nothing described in this section was being sent. The first country we will switch it on for is the United States. It is never on for visitors in the European Economic Area, the United Kingdom or Switzerland, or where we cannot tell which country you are in. This section applies to you only while it is on for you and you have not opted out, and you can opt out before it is switched on.

When it is on, Sable uses Meta's measurement tools (the Conversions API from our servers and, on some pages, the Meta Pixel in your browser) to learn whether our ads on Facebook and Instagram lead people to visit, sign up and buy, and to let Meta show our ads to people likely to be interested in Sable. When you visit a page, sign up, begin a purchase or complete one, Meta receives:

• the kind of event and when it happened, with a random identifier we give the event so it is not counted twice
• the address of the page you were on, without its query, and the site that referred you (its scheme and host only). On a story page the address is rewritten to carry only a code for the work, never its title, so Meta can tell one work from another but is not told what it is
• your IP address, your browser's user agent and the technical details a browser sends with any request, such as its language and screen size
• Meta's own browser identifiers (the `_fbp` and `_fbc` cookies described below) and the advertising click identifier, if any
• for a purchase, which coin pack it was, the amount and the currency

We send Meta only the items listed above. We do not send a work's title, tags, description or images, which works you like, follow or talk to, the content of your conversations, personas or calls, what you search for, your name, your handle, your email address in any form, your account identifier, your payment details or your age information, and we keep Meta's automatic matching features switched off. Meta uses what it receives under its own terms and data policy, including to match the event to a Facebook or Instagram account if you have one.

You can turn this off for yourself at any time (section 9). When you do, or when your browser sends a Global Privacy Control signal, we do not load Meta's tools for you, we do not send Meta your events from our servers either, and we remove Meta's cookies from your browser. What Meta received before then is not recalled.

Technical information

Your IP address and browser information reach our network and hosting providers, Cloudflare and Amazon Web Services, because that is how internet traffic works, and they may keep them in their own logs. In our own database we keep only a keyed hash of your IP address, used to limit how often actions can be repeated. There is one exception, and it applies only where advertising measurement is on for you and you have not opted out: an event waiting to be sent to Meta is held with the IP address, user agent and Meta browser identifiers it will carry, until it has been sent and for no longer than seven days, after which we erase them from the event. Our server logs record your account identifier, the page or API path you requested (without its query), the result and how long it took.

If an AI request fails and our diagnostics store is turned on, we may keep an encrypted copy of that request, including the conversation it contained, for a limited time so we can investigate the failure.

Cookies and similar technologies

We use cookies and your browser's storage to run the Service and, where advertising measurement is on for you, to measure our advertising as described above.

• sable_reader keeps you signed in (30 days).
• sable_reader_renewed marks that we have already refreshed your sign-in today, so we do not do it again until tomorrow (1 day).
• sable_reader_holder remembers which account last signed in on this browser, so a late refresh cannot bring back a sign-in you ended (up to 400 days).
• sable_signin protects a sign-in while it is in progress (up to 12 hours).
• sable_social_oauth protects connecting a social account to an account already signed in (10 minutes).
• Cookies whose names begin with sable_referral carry an invitation code until you sign up (up to 30 days).
• CloudFront-Policy, CloudFront-Signature and CloudFront-Key-Pair-Id let your browser load images (session).
• sable_age_gate_declined records an answer that you are under 18, so that answer survives (up to 10 years), and sable_age_gate_declaration keeps a Yes answer when your browser's local storage cannot (up to 10 years).
• Cookies whose names begin with sable_unsettled_purchase remember a purchase that is still being confirmed (7 days).
• _fbp and _fbc are Meta's advertising measurement cookies. `_fbp` identifies your browser to Meta, and `_fbc` holds the click identifier of a Meta ad you followed (up to 90 days each, subject to your browser's settings). They are set only where advertising measurement is on for you, and not when you have opted out or your browser sends a Global Privacy Control signal.

In your browser's own storage we also keep your first-visit answer, your appearance settings, your recent searches, which tips you have seen, pending purchase and media states, where you had scrolled to, a queue of usage events waiting to be sent, and — while a reply is being written — the message you typed and any rewrite instruction you gave. These stay on your device. We also keep there how you arrived and your advertising measurement choice; unlike the rest, these are sent to us as described above, when you create an account or are signed in.

Some pages load resources from other companies, which receive your IP address and may set their own cookies: Google Fonts, Sign in with Apple, PayPal on the purchase screen, Persona on the age verification screen, and, where advertising measurement is on, Meta.

3. How we use your information

We use personal information to:

• provide the Service: sign you in, run conversations, remember context, show and publish works, process purchases and coins, and deliver notifications
• generate AI replies, suggestions, memories, images, videos and calls, which requires sending the relevant content to our AI providers
• keep Sable safe and within our Terms: review works before they are published, including with the help of AI models; handle reports; investigate abuse; enforce content rules; protect minors; and prevent fraud and duplicate rewards
• apply age assurance and decide which works you can access
• answer your support requests
• understand how Sable is used so we can improve it, using the usage records described above
• measure and improve our advertising, using how you arrived and the advertising measurement described above
• secure the Service, prevent misuse and debug problems
• comply with the law, respond to lawful requests, and establish or defend legal claims

Who can see your conversations. Your conversations are not visible to other users. Authorized Sable staff can access conversation data, including conversation lists, messages and memory notes, when needed to investigate a report or a safety concern, to answer a support request you make, to investigate a failure, or to comply with the law. Only accounts with a moderation role can reach that data, and we limit their use of it to those purposes.

AI training. Sable does not use your conversations, personas or voice data to train AI models. Our AI providers process this content to provide the Service to us under the agreements and plans we hold with them.

Advertising and sales. We do not sell your personal information for money, and we do not show other companies' ads inside Sable. We do share the limited information described under "Advertising measurement" with Meta to measure and deliver our own ads. Under some privacy laws, including several United States state laws, this can be a "sale" or "sharing" of personal information or "targeted advertising" even though we receive no money for it, and you have the right to opt out (section 9).

Automated decisions. AI models help review works submitted for publication, but decisions to publish or reject a work are made by people.

4. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the Service you signed up for, including conversations, purchases, coins and support.
• Legitimate interests: to keep Sable safe and secure, prevent fraud and abuse, review content, understand usage and improve the Service, and measure which campaigns bring people to Sable using campaign tags kept for your browser session, where those interests are not overridden by your rights. We do not use Meta's measurement tools or store advertising click identifiers for people in the European Economic Area or the United Kingdom, or in Switzerland.
• Consent: where we ask for it, including for sensitive information you choose to include in conversations, and for notifications. You can withdraw consent at any time, which does not affect processing before you withdrew it.
• Legal obligation: to keep financial records, meet age assurance requirements and respond to lawful requests.

5. Who we share information with

We share personal information only as described here.

Service providers that process it on our behalf:

• Amazon Web Services (United States): hosting, database, storage, encryption keys and logs.
• Cloudflare: network delivery and protection for all traffic to Sable.
• Google: AI models that generate conversation replies, memories and suggested replies, help creators draft, tag and illustrate works, translate works, and review videos in submitted works; Korean calls; scene video generation; and Sign in with Google.
• ElevenLabs (United States): the voice service that runs English calls, including the speech it hears and the speech it speaks, and the details we give it when a call starts, listed under "Calls" in section 2.
• OpenAI: scene image generation from your recent conversation, memory suggestions from call transcripts, and background images for works.
• Anthropic: AI review of the text and images of works submitted for publication, and matching backgrounds to works.
• Persona: age verification.
• Stripe and PayPal: payments.
• Apple: Sign in with Apple.
• Your browser's push service (such as those run by Google, Mozilla or Apple): delivering notifications you allow, sent encrypted.

Advertising partners. Meta Platforms (United States) receives the information described under "Advertising measurement" in section 2, for visitors for whom it is on and who have not opted out. Meta is not one of our service providers for this: it processes what it receives under its own terms and data policy, and its role depends on the advertising service used.

Other users. Your handle, display name, avatar, published works, comments and the fact that you like or follow something may be visible to other users.

Legal and safety. We may disclose information if we believe in good faith that it is required by law or legal process, or needed to protect the rights, property or safety of Sable, our users or the public, including reporting child sexual abuse material to the appropriate authorities.

Business transfers. If Sable is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

With your consent. In any other case, only when you ask us to or agree to it.

6. International transfers

Sable is hosted in the United States, and our service providers may process information in other countries. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we use safeguards recognized by law, such as the European Commission's Standard Contractual Clauses.

7. How long we keep information

In general. We keep personal information for as long as we need it for the purposes described in this Policy, or as otherwise described when we collect it, unless the law requires a shorter period. How long that is depends on what the information is, why we collected it and the choices you make. When we no longer need it, we may delete it, de-identify it or aggregate it. We may also keep information for as long as necessary to comply with legal obligations, such as tax and accounting rules, to keep Sable and its users safe, to prevent fraud and abuse, to resolve disputes and to enforce our agreements. Copies may remain in backups for a period after they are removed from our live systems.

Deleting conversations. Deleting a conversation removes it from your account. A copy may remain in our systems until it is removed under the rule above.

What was said on your calls. We keep it until you delete it. There is no schedule that removes it for you. Deleting a call's words in the app removes them and destroys the key that could read them; a copy may remain in backups until those are removed under the rule above.

Closing your account. You can close your account in Settings. Closing starts a 7-day window in which you can cancel. After it ends, your account is closed and your information is handled as described above.

What you shared with others. Content you shared with other people may remain after you close your account. Works you published are made private rather than deleted, and comments you posted may remain with your name removed. If you plan to publish a character or story, do not include personal information about yourself in it.

How you arrived. We keep it while your account exists and remove it when the account is closed, under the general rule above (a copy may remain in backups for a period). What Meta has already received is kept under Meta's own retention practices, which we do not control.

Advertising measurement events waiting to be sent. Where advertising measurement is on for you, an event is held until it has been sent to Meta. The IP address, user agent and Meta browser identifiers held with it are erased once it is sent, and in any case within seven days.

Age verification. Persona keeps the information it collects for verification under its own retention policy.

8. Security

We use technical and organizational measures to protect personal information. New conversation content, memory notes, persona descriptions and what was said on your calls are encrypted with keys managed in AWS Key Management Service. Our database and storage are encrypted at rest, connections to Sable use TLS, and database access controls restrict each account's private records to that account and to authorized staff. We store email addresses only as keyed hashes, and IP addresses only as keyed hashes apart from the one held for up to seven days with an advertising measurement event waiting to be sent, as described under "Technical information" in section 2. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your choices and rights

In the app. You can edit your profile and personas, delete conversations, delete what was said on any call or on all of them, manage blocks and notification settings, and close your account in Settings.

Advertising measurement. You can turn off advertising measurement at any time at sable.nyyx.ai/privacy-choices, which is linked as "Your Privacy Choices" from the first screen you see when you open Sable, from the side menu on a computer, from the profile menu on a phone, and from Settings > Privacy & safety. You do not need an account. The choice is saved in your browser, and with your account when you are signed in, so that it also applies on your other devices and to events sent from our servers. We also treat a Global Privacy Control signal from your browser as that choice.

Requests. You can ask for a copy of your personal information, or ask us to correct, delete or restrict it, through Help or by emailing [email protected]. We prepare copies by hand, and we may need to confirm that the request comes from the account holder. We respond within the time the law requires.

EEA and UK. You have the right to access, rectify, erase, restrict and port your personal information, to object to processing based on legitimate interests, and to withdraw consent. You can also complain to your local data protection authority.

United States. Depending on the state you live in, you may have the right to know what personal information we collect and how we use and disclose it, to access and receive a copy of it, to correct it, and to delete it. You have the right to opt out of the "sale" or "sharing" of personal information and of targeted advertising: the advertising measurement described in section 2 is the only such sharing we do, and you can opt out at sable.nyyx.ai/privacy-choices ("Your Privacy Choices") or with a Global Privacy Control signal. We do not sell personal information for money. We do not knowingly sell or share the personal information of anyone under 18. We do not use or disclose for advertising what you write in conversations, personas or calls. Which works you view is shared with Meta as described in section 2, and because that can say something about your interests, including sensitive ones, you can stop it at any time with "Your Privacy Choices". You can use an authorized agent to make a request, and if we deny a request you may appeal by replying to our decision. We will not discriminate against you for exercising your rights.

10. Children

Sable is not for anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we close it and take steps to delete its information, subject to section 7. If you believe a minor is using Sable, tell us through Help or at [email protected].

11. Changes to this Policy

Every version of this Policy has a version name. If we make a change that affects what we collect, how we use it, how long we keep it or who receives it, we publish a new version and ask you to agree before you continue using features that need your agreement. We may correct typos and improve wording without changing any of those things; such corrections update the current version without asking you again.

The current version is always at sable.nyyx.ai/privacy, and every earlier version stays available at sable.nyyx.ai/privacy/ followed by its version name.

12. Contact

• Katchers Inc
• 16192 Coastal Highway, Lewes, Delaware 19958-3608, United States
• Privacy questions and requests: [email protected]

You can also reach us through Help in the app.