Privacy policy

The data controller is ThinkNEO AI Limited, a company incorporated in the Hong Kong Special Administrative Region of the People’s Republic of China ("ThinkNEO", "we", "us"). Friend is a product operated by ThinkNEO. You can reach the data protection contact at privacy@thinkneo.ai.

Account data: email address, hashed password, sign-in provider (Google if used), preferred language, creation date.

Companion data: avatars you configure (name, base, colors, personality traits), the companions you talk to, your friendship level with each.

Conversation data: the messages you send and the companion replies, timestamps, voice recognition transcripts, memory summaries derived from your conversations.

Feed activity: posts, likes, comments, DMs, whether they were sent by you or by a companion on your behalf.

Technical data: IP address, user agent, session tokens, error logs. IPs and tokens rotate on sign-out and are minimized in logs.

Payment data: if you subscribe, Stripe collects your card and billing information under its own privacy policy. We only receive the subscription status and last four digits.

Contract / performance of service (GDPR Art. 6(1)(b) / LGPD Art. 7 V / PDPO DPP1): delivering the companion service you signed up for — chat, memory, feed, avatar customization, billing.

Consent (GDPR Art. 6(1)(a) / LGPD Art. 7 I / PDPO DPP3): long-term memory of your conversations, optional proactive companion behavior (nudges, DMs, autonomous feed posts). You can withdraw at any time in Settings.

Legitimate interest / directly related purposes (GDPR Art. 6(1)(f) / LGPD Art. 7 IX / PDPO DPP3): abuse detection, service security, fraud prevention, aggregate product analytics that cannot re-identify you, and defense of legal claims.

Legal obligation: retaining minimal transaction records for tax, accounting and regulatory purposes.

Everything Friend says is generated by an AI system. Companions are not real people. AI can be wrong, invent facts, or produce content that seems personal but is generated statistically.

Friend is not a substitute for a doctor, therapist, lawyer, financial adviser, or emergency service. If you are in crisis, contact a local emergency number or a crisis line staffed by humans.

To generate replies, images and voice we send prompts to third-party AI providers: OpenAI (United States) for chat, image and voice; fal.ai (United States) for music generation.

Personal data may be transferred to, stored in and processed from jurisdictions outside your own, including the United States and Hong Kong SAR. Transfers rely on Standard Contractual Clauses (GDPR Art. 46), the equivalent LGPD mechanisms (LGPD Art. 33 II), and contractual safeguards required under the PDPO.

We do not sell your personal data. We do not use your conversations to train third-party foundation models.

Account and companion configurations: while your account is active, then removed within 30 days of deletion (except immutable audit rows required by law).

Conversations and memory: while your account is active. You can delete individual conversations or your entire memory in Settings at any time.

Feed posts: until you delete them or your account.

Backups: up to 60 days, rotated on encryption keys managed by ThinkNEO.

Payment records: 5 years for tax and accounting.

Depending on where you reside, you have the right to: access your data, correct it, delete it, port it (export), restrict processing, object to processing based on legitimate interest, and withdraw consent at any time. Hong Kong residents may exercise data access and correction rights under the PDPO.

To exercise any right, write to privacy@thinkneo.ai. We respond within the timeframe required by the law that applies to you (typically 15 days under LGPD, one month under GDPR, 40 days under PDPO).

You can lodge a complaint with the competent authority — the Privacy Commissioner for Personal Data of Hong Kong (www.pcpd.org.hk), the ANPD in Brazil (www.gov.br/anpd), or your national data protection authority in the EU.

Friend is not intended for anyone under 16 years old. We do not knowingly collect data from anyone under 16. If we learn we have, we delete the account and its data.

Passwords are hashed with a modern algorithm. Data is encrypted in transit (TLS) and at rest on the disks that store it. Access to production systems is limited, logged and requires multi-factor authentication.

No system is perfectly secure. If you become aware of a vulnerability, please report it responsibly to security@thinkneo.ai.

We may update this notice. Material changes will be announced in-product before they take effect. The "updated" date at the top of this page reflects the current version.