Privacy Policy

1. Overview

Lovia provides conversations with fictional AI characters through text, voice messages and AI voice calls. This notice explains what information is used, why it is used, who receives it and how you can request access, correction or deletion.

2. Information you provide

Account information: Firebase Authentication handles registered email, phone and Google sign-in. When Google sign-in is enabled and you choose it, Google shares an account identifier and basic account information with Firebase; our backend uses the identifier and verified email for account access. When Truecaller sign-in is enabled and you consent, Truecaller verifies your phone number. Our server exchanges a short-lived authorization code, checks the verified number and signs you into Firebase. We request phone verification, not your contact list. For phone sign-in, our configured SMS provider (MSG91 or Firebase) processes your phone number and verification message to deliver an SMS code. When MSG91 is enabled, our server verifies the code and Firebase manages the authenticated account. Our server temporarily stores the phone number, a keyed hash of the code, expiry and attempt counts to prevent misuse; the raw code is not stored in our database. Our backend stores your verified account identifier, email when available, verified phone number, access or suspension status and activity timestamps. It also stores Pro status and expiry, talk-time balance, and a history of manual membership or talk-time adjustments including the reason, administrator and time. Keep your credentials and SMS codes private.

Profile and preferences: your chosen name, avatar, language and other preferences are stored on your device. Your name and selected language are included in AI requests to personalise replies.

Conversations: messages, relevant conversation context and saved memories you choose to use are processed to generate replies. Voice notes and microphone audio are processed when you use voice features. Do not include passwords, payment credentials or sensitive information about yourself or others.

Feedback and support: feedback submissions store the star rating, comment, profile name, app version, submission time and verified account identifier when available. Preview submissions are identified separately. Messages you email to support include the information and attachments you choose to send.

Google and Truecaller may supply your profile name, which we use for your account and first-name greetings. The login screen offers phone, Google and Truecaller. Our database stores a lifetime free-message usage counter per account to enforce the three-message allowance; photos and AI picture requests also count as messages.

Email OTP sign-in uses our configured Hostinger SMTP mailbox to deliver a six-digit code. We retain a keyed code hash, email address, expiry and attempt counts temporarily; successful verification signs you into Firebase. CMS administrators can see registered email or phone, membership, coins, last successful login time and the login network address when our trusted hosting proxy supplies one. SMS autofill requests Android consent to read one verification message, without reading your inbox.

3. Test access

The current Android test phone-entry flow checks the format of a ten-digit number. It does not verify ownership and does not store or transmit that entered number. A random installation identifier identifies the local test profile. This test flow is not a verified phone account.

4. How information is used

We use information to authenticate registered accounts, provide and personalise AI replies, apply access controls, investigate problems, review feedback and respond to support or privacy requests. Device time zone and local time support appropriate greetings; this does not require GPS location. Verified phone numbers also let authorised administrators locate your account to grant Pro access or add promotional minutes. Manual grants do not charge you.

Hosting and authentication providers may process network addresses, request times, device or browser details and error or security logs to operate and protect their services. Lovia does not include an advertising SDK in the current beta.

5. Chat storage and private sessions

Ordinary conversation history and recorded voice messages are stored locally on your device. The current Lovia backend does not maintain a conversation-history database. AI requests still pass through our backend or the AI provider as needed to produce replies.

Private-session history is held in app memory and cleared when you leave the session or the app goes into the background. Private sessions are excluded from saved chat history and memory. This does not erase data already processed or retained by a service provider, and does not make a conversation anonymous.

Live-call microphone audio is sent to the AI service while the call is active. Lovia does not create a local recording of live calls. Voice messages are a separate feature and can remain in ordinary chat storage.

Photos you choose to share and image-generation descriptions are sent to Google Gemini to respond or create pictures. Ordinary chat images stay in app-private storage on your phone. Private-session images remain in memory and clear when the session closes. The backend forwards image requests and responses without saving a photo library. AI-created pictures are fictional and may differ from character profile photos.

6. Permissions and reminders

Microphone permission is used for voice notes and calls. You can revoke it in Android settings; text chat remains available. The current app does not require access to your contacts or precise GPS location.

Optional reminders use activity timing held on your device and generic timing and message settings received from our backend. Private chats do not trigger unfinished-chat reminders. Chat content and reminder activity are not uploaded for notification targeting. You can switch reminders off in Profile or Android notification settings.

7. Service providers and international processing

Hostinger provides website and backend hosting and database infrastructure. Google Firebase provides registered-account authentication. MSG91 delivers verification SMS messages when enabled. Google Gemini processes AI text and audio requests. These providers may process information in countries other than your own under their applicable terms and privacy practices.

Gemini data handling depends on the configured service tier. Under unpaid-service terms, inputs and outputs may be used for product improvement and human review. Paid-service terms differ and may still permit retention for abuse monitoring. Do not assume that private mode prevents provider processing. Review Google’s Privacy Policy and Gemini API terms linked below.

An owner-only LiveAvatar sandbox by HeyGen processes microphone audio and connection information if the owner starts a test. This is separate from customer AI calls; responsive customer video-avatar calling is not enabled in this beta.

We may also disclose information when required by law or reasonably necessary to protect users, investigate misuse or protect the service. We do not sell your personal information.

8. Cookies, links and payments

The website uses an admin sign-in session cookie to maintain authorised access. Disabling necessary cookies may prevent admin sign-in. Links to external websites open services with their own policies.

Talk-time and subscription checkout screens are previews in this beta. They do not collect payment details, complete purchases or create automatic renewals. Data practices and checkout terms must be updated before real payments are enabled.

9. Retention and security

Local profiles, ordinary chat history and voice-message files remain on the installation until removed using app controls or by clearing app storage. Private-session memory is cleared as described above.

Account and feedback records are retained while needed to operate the service and handle support requests. Following a verified deletion request, applicable records must be removed unless retention is required for a legal, security or dispute-resolution purpose. Provider logs, support correspondence and backups may follow separate retention processes. Contact us for details relating to your request.

We use encrypted network connections, authentication and restricted administrative access. No storage or transmission method is completely secure. Avoid sharing information that you would not want processed by the service.

10. Your choices and deletion requests

You can change your local profile and preferences and revoke app permissions. Contact connect@velaisai.com to request access, correction, deletion or help with your information. We may verify account ownership before responding; never send your password.

To request account deletion, use the Delete account link below or the Request account deletion option in Profile. Send the request from the email associated with your registered account. For a test profile, explain that it is a test profile and include an identifier only if available.

Deleting local app data is separate from deleting a registered Firebase account and associated backend records. Uninstalling the app or signing out does not itself submit an account-deletion request. The deletion page explains these steps.

11. Young users

Account eligibility and restrictions for individual features are described in our Terms & Conditions. This privacy notice does not authorise access to age-restricted services. If you believe a young person has supplied information without the necessary eligibility or authorisation, contact us so we can investigate and address the relevant records.

12. Changes to this policy

We will publish changes here with an updated date. Material changes to data collection or use will require appropriate notice and, where necessary, consent before the new practice begins.

13. Contact us

Lovia is operated by Velais Labs LLP. For privacy questions, data requests, complaints or support, email connect@velaisai.com. Include enough information to identify the relevant account or request.