Dialogos Privacy Policy

Dialogos ("the app", "we") is a Stoic-philosophy dialogue app published by PiFl Labs. We designed Dialogos to collect as little as possible. We have no user accounts, no advertising, no analytics SDKs, and no cross-app or cross-site tracking.

1. Purpose of Processing

We use information solely to:

• Dialogue: generate the dialogue you request
• Daily limits: enforce fair daily-usage limits
• Purchases: verify and apply your purchases
• Reports and safety: review reports of AI replies and keep the app safe
• Support: answer the messages you send us
• Provider comparison: compare and improve the replies of our two AI providers — their quality, safety, speed, and cost, and whether conversations go on, people come back, and choose Pro — using the pseudonymous statistics in section 2

We do not sell or rent any data, and we do not use it for advertising.

2. Information We Process

The information Dialogos processes is as follows.

Anonymous device identifier

• On first launch the app generates a random token stored on your device.
• It is sent with each request to our server only to apply the daily limits fairly, to apply your purchases if you buy something, and — while we compare our two AI providers — to decide which of them answers the device and to derive the pseudonymous key of the service-improvement statistics (below).
• It is not your name, email, phone number, or an advertising identifier, and it is not linked to your identity.
• It is not sent to our AI providers.

Conversation content

• The messages you write and the ongoing conversation are sent over an encrypted connection to our backend (a Cloudflare Worker). The app sends at most the most recent 40 messages, about 22,000 characters.
• Our backend passes on only the most recent part, up to 24 messages and 12,000 characters, together with our instructions for the mentor, to one of our AI providers — Anthropic, PBC or OpenAI OpCo, LLC (both in the United States; "Anthropic" and "OpenAI" below) — for the sole purpose of generating the philosopher's reply.
• Our server decides which provider answers: while we compare the two (from October 2026), each device that has agreed to the current AI conversation consent is assigned to one of them, and if that provider cannot answer, the other may answer that message instead.
• A device that agreed only to the earlier consent, which named OpenAI alone, is answered by OpenAI only, and so are messages sent from countries or regions where Anthropic does not offer its service.
• We do not store your conversation content on our servers, except a reply you report and the message right before it (see "Reports of AI replies" below).
• By default neither provider uses the conversations we send to train its models, and we do not opt in to sharing data for training.
• We call OpenAI with storage turned off (store: false), so OpenAI does not keep the conversation as application state.
• OpenAI does keep abuse-monitoring logs, which may include your messages and the replies, for up to 30 days, and may keep an encrypted prompt cache for up to 24 hours.
• Anthropic deletes the conversations it receives within 30 days, except that a conversation its automated trust-and-safety systems flag as a possible violation of its Usage Policy may be kept for up to 2 years (its classification scores for up to 7 years).
• Anthropic also keeps the request (our instructions and the conversation we sent) in a prompt cache for up to 5 minutes after it was last used, to answer the next message faster (see sections 3 and 12).

Purchases and purchase verification

• Purchases are processed by Apple or Google.
• In these cases the app sends the store's receipt to our server, which checks it with Apple or Google:
  • when you buy or restore a purchase
  • if you already have a purchase, automatically when the app starts or the store reports a change such as a renewal
• Our server then keeps the following purchase-verification record so that your purchase can be applied and the same receipt is never credited twice (how long it is kept: section 3):
  • transaction ID (for Google Play, a one-way hash of the purchase token)
  • product
  • purchase and expiry times (or, for a pack of deep conversations, how many remain)
  • verification result
  • one-way hashes of the anonymous device identifiers of the devices that use the purchase (a subscription works on up to five devices)
• With each request the app also tells our server whether you are on the free tier or Pro.
• We never receive your payment card or billing details.

Usage records on our server

• Daily counters and token totals: For each anonymous device identifier and day, our server keeps the following counters and a total of the AI tokens used.
  • messages
  • deep answers used
  • conversations treated as a crisis and therefore not counted against the limit
  • purchase checks sent to the stores
• These are stored under the identifier itself, not a hash, and expire automatically within about two days.
• Only the daily number of reports filed is counted by a one-way hash of the identifier instead (it expires on the same schedule).
• Service-wide daily spend total: To keep costs and abuse in check, our server also keeps a service-wide counter per day of the total AI spend with each AI provider. These are not tied to any device or person, contain no personal data, and expire automatically within about two days.
• Rate limiting: To slow down abusive traffic, our server uses Cloudflare's rate-limiting feature, which counts requests per IP address over a short window. Cloudflare uses the IP address only transiently, as the key of that counter, and we do not store it in our own records.
• Operational logs: Our operational logs record the first 8 characters of the device identifier and usage details (such as plan, type of answer, which AI provider answered and why, token counts, how the reply ended, whether it was handled as a crisis, and the platform, product and result of a purchase check) — never message content.
• Cloudflare request logs: Cloudflare's request logs for our server may also include connection information such as IP addresses.

Service-improvement statistics

• While we compare our two AI providers (from October 2026), for each message from a device that has agreed to the current AI conversation consent our server records:
  • the time
  • a pseudonymous experiment key (derived from the device identifier by a one-way hash, so it does not reveal the identifier and cannot be matched with our purchase records)
  • the device's comparison group
  • the provider and model that answered and, when the provider meant to answer did not, the reason
  • the plan (free or Pro), the type of answer (fast or deep), the language and mentor
  • how the reply ended (including whether it was declined, flagged as a crisis, failed, or turned away by a daily limit or the service's daily budget)
  • whether the app was closed before the reply ended, the position of the message in the conversation
  • token counts, cost, response times, and the length of the reply
• These statistics never include the content of messages or replies, and nothing about purchases beyond the plan.
• We use them only to compare and improve the two providers' replies: their quality, safety, speed, and cost, and how they affect whether a conversation goes on, whether people come back within a week, and whether they choose Pro.
• They are kept in Cloudflare's analytics service and deleted automatically after 3 months, and we stop recording them when the comparison ends.

Reports of AI replies

If you report a reply in the app, we keep:

• the reported reply and the message you sent right before it (each up to 2,000 characters)
• the reason you chose and any note you add (up to 500 characters)
• the time of the report, the mentor, and the app's language and version
• a one-way hash of the anonymous device identifier (never the identifier itself)

We keep these for 90 days, solely to review the report and keep the app safe, and then delete them automatically.

Messages you send us by email

• "Report a problem" in Settings opens your email app with a message addressed to support (at) pifl-labs.com.
• If you write to us this way or any other, we receive your email address and what you put in the message.
• The app does not send this on its own; it is an email you write and send. We use it only to answer you (section 1) and keep it as described in section 3.

On-device settings

Your language, theme, onboarding state, daily counters, your purchase status (whether you are on Pro, and how many deep conversations are left), and the version and date of your AI conversation consent are stored locally on your device only.

Conversation history on your device

• So that you can come back to them, your conversations with the mentors (your messages and their replies) are kept on your device only, up to the most recent 200 messages with each mentor.
• We do not receive or store this history. Only the conversation under way is sent to generate a reply, as described above.
• You can clear it at any time with "Clear conversation history" in Settings, and deleting the app removes it.
• Your device's own backup (such as iCloud or Google backup) may include it, as with other app data.

3. Retention Period

• Conversation content: not retained on our servers, except report records (below).
  • OpenAI does not keep it as application state (store: false).
  • OpenAI's abuse-monitoring logs are kept for up to 30 days (longer only where required by law or reasonably necessary to protect OpenAI's services or others from harm).
  • OpenAI's encrypted prompt cache is kept for no more than 24 hours.
  • Anthropic deletes it within 30 days (a conversation flagged as a possible Usage Policy violation: up to 2 years, classification scores up to 7 years; longer where required by law).
  • Anthropic's prompt cache is deleted within 5 minutes of last use.
• Service-improvement statistics: deleted automatically 3 months after they are recorded.
• Daily counters, token totals, and the service-wide daily spend total: expire automatically within about two days.
• Operational logs: deleted automatically within 7 days.
• Purchase-verification records: deleted automatically 5 years (1,830 days) after the transaction date.
  • For a subscription, the 5 years run from the end of its latest subscription period.
  • A pack of deep conversations is kept with no deletion date while it still has answers left, because purchased credits must not expire; once they are used up or the pack is refunded, it is deleted 5 years after its purchase date (within a day, if that date has already passed).
  • We keep these records so that the same receipt can never be credited twice, and because Korean e-commerce law (the Act on Consumer Protection in Electronic Commerce) requires records of payments and supply to be kept for 5 years.
• Report records: kept for 90 days, then deleted automatically.
• Messages you send us by email: kept for 3 years after we have dealt with them, then deleted.
• On-device settings: remain until you delete the app, which removes all local data.
• Conversation history on your device: the most recent 200 messages with each mentor, until you clear it in Settings or delete the app.

4. Disclosure to Third Parties

We do not provide your personal information to any third party other than the providers in section 5, except with your consent or where the law requires it.

5. Processing Entrustment and Sharing

We share data with the providers below only as needed to run the app. We do not share data with advertisers or data brokers.

↔ Privacy information table 1; scroll horizontally

6. What We Do Not Collect, Advertising and Tracking

The app itself collects no name, email, account, location, contacts, photos, health data, or biometric data (if you write to us by email, see section 2).

• No analytics or advertising SDKs (the service-improvement statistics in section 2 are recorded by our own server, not by an SDK in the app)
• No advertising identifier (IDFA/GAID)
• No tracking across other apps or websites

The app does not show ads, and shows no App Tracking Transparency prompt because it does not track you.

7. App Permissions

Dialogos does not ask for any permission that needs your approval (such as camera, photos, microphone, location, contacts, notifications, or tracking).

The app only uses the network connection to reach our server and each store's payment system for purchases.

8. Data Destruction

When personal information is no longer needed — its retention period has ended or its purpose has been achieved — we destroy it without delay.

• Procedure: Server records whose retention period (section 3) has ended are deleted automatically when it ends, with no manual step. Other personal information that is no longer needed, such as email inquiries, is destroyed after approval by the Data Protection Officer.
• Method: Electronic files are permanently deleted using non-recoverable methods. Data on your device is removed when you delete the app; your conversation history is also removed when you clear it in Settings.

9. Your Rights and How to Exercise Them

You may at any time exercise the following rights over your personal information:

1. The right to be informed about how your personal information is processed
2. The right to decide whether, and to what extent, to consent to its processing
3. The right to confirm whether it is processed and to request access to it
4. The right to request suspension of processing, correction, deletion, and destruction
5. The right to seek redress for damage caused by its processing

To exercise these rights, contact privacy (at) pifl-labs.com (our Data Protection Officer, section 13).

Because Dialogos has no accounts and we do not hold any information that identifies you (the anonymous device identifier is not linked to your name or email and is not shown in the app), we generally cannot locate "your" data on request.

You can also act on your own:

• Withdraw your AI conversation consent at any time in Settings.
• Clear your conversation history in Settings ("Clear conversation history").
• Clear all local data by deleting the app.

Server-side records are deleted automatically on the schedule in section 3. For general questions, contact support (at) pifl-labs.com.

10. Security Measures

We take the following measures to keep personal information safe.

• All network traffic uses encryption in transit (HTTPS/TLS).
• Our AI providers' API keys and our store-verification credentials are stored only on the server and are never shipped inside the app.
• Purchase-verification records and report records keep the anonymous device identifier only as a one-way hash (the daily counters, which expire within about two days, are the exception — see section 2).
• Operational logs keep only the first 8 characters of the identifier and never contain message content, receipts, or API keys.
• A Google Play purchase token is stored only as a one-way hash.
• Service-improvement statistics keep only a pseudonymous experiment key, never the device identifier or message content.
• Server records are deleted automatically when their retention period ends (section 3).
• Access control and permission management for personal information.
• On-device settings and your conversation history are kept in the app's private storage on your device, without separate app-level encryption.

11. Children's Privacy

Dialogos is not directed at children under 13 (or the minimum age required in your country — 14 in the Republic of Korea) and we do not knowingly collect personal information from children. If we find that we have, we will delete it immediately, as far as we can identify it. A parent or guardian can ask for deletion at privacy (at) pifl-labs.com.

Teenagers may use the app. For their safety, in line with our AI providers' guidelines for services that teenagers may use:

• the app always tells you that the mentors' replies are written by AI
• the mentors are instructed to keep conversations safe and supportive
• the app shows crisis-support contacts for your region when a message suggests a crisis
• you can report any reply (section 2)

12. International Data Transfers

To provide the app, we transfer information outside your country (entrusting its processing or storage) as follows.

Anthropic, PBC

United States · 548 Market St, PMB 90375, San Francisco, CA 94104 · privacy contact: privacy (at) anthropic.com

• Items: your messages and the ongoing conversation (up to the 24 most recent messages / 12,000 characters) and our instructions for the mentor. The device identifier is not sent.
• When and how: each time our server sends your message to Anthropic to answer (section 2) — including when Anthropic then cannot answer and OpenAI answers instead — through our server over an encrypted connection (HTTPS/TLS).
• Purpose: generating the mentor's reply.
• Retention
  • deleted within 30 days (a conversation flagged as a possible Usage Policy violation: up to 2 years, classification scores up to 7 years)
  • prompt cache within 5 minutes of last use
  • not used for model training

OpenAI OpCo, LLC

United States · 1455 3rd Street, San Francisco, CA 94158 · privacy contact: privacy (at) openai.com

• Items: your messages and the ongoing conversation (up to the 24 most recent messages / 12,000 characters) and our instructions for the mentor. The device identifier is not sent.
• When and how: each time our server has OpenAI answer your message (section 2), through our server over an encrypted connection (HTTPS/TLS).
• Purpose: generating the mentor's reply.
• Retention
  • not kept as application state (store: false)
  • abuse-monitoring logs for up to 30 days (with the exceptions in section 3)
  • encrypted prompt cache for no more than 24 hours
  • not used for model training

Cloudflare, Inc.

United States and other countries where Cloudflare operates data centers · privacy contact: privacyquestions (at) cloudflare.com

• Items
  • anonymous device identifier
  • conversation content (relayed only, not stored)
  • report content if you report a reply (the reply and the message before it, reason, note, time of the report, mentor, app language and version, one-way hash of the device identifier)
  • free/Pro tier
  • daily counters, token totals and the service-wide daily spend total
  • purchase-verification records
  • operational logs
  • service-improvement statistics (pseudonymous experiment key and the reply details in section 2, never message content)
  • connection information such as IP addresses (in request logs; also used transiently for rate limiting)
• When and how: each time the app contacts our server (messages, purchase checks, reports), over HTTPS/TLS.
• Purpose: hosting our backend (relaying the conversation, applying daily limits, verifying purchases, receiving reports, limiting abusive requests, keeping the service-improvement statistics).
• Retention: as in section 3
  • purchase-verification records: 5 years from the transaction date — for a subscription, from the end of its latest period; a pack with answers left is kept until they are used up or refunded
  • report records: 90 days
  • service-improvement statistics: 3 months

Apple Inc. / Google LLC

United States · privacy contact: Apple, Google

• Items: what is needed to check your purchase — Apple: the transaction ID; Google: the purchase token and product ID.
• When and how: when you buy or restore a purchase — and, if you already have one, when the app starts or the store reports a change such as a renewal — our server sends it to the store's server API over HTTPS/TLS.
• Purpose: confirming that the purchase is valid.
• Retention: under each company's own privacy policy, as the payment processor.

If you do not want these transfers

• You can decline the AI conversation consent in the app or withdraw it at any time in Settings — your messages are then not sent.
• You can also leave the purchase features unused or delete the app.
• Without these transfers we cannot generate replies or apply purchases.
• Questions: support (at) pifl-labs.com

13. Data Protection Officer

• Company: PiFl Labs Co., Ltd.
• Email: privacy (at) pifl-labs.com

14. GDPR (European Economic Area)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation, including the right to access, rectify, erase, restrict processing, data portability, and object to processing. Contact us at privacy (at) pifl-labs.com.

15. Changes to this Policy

We may update this policy; we will revise the effective date above and, for material changes, surface a notice in the app.

Revised October 18, 2026

• Anthropic was added as a second AI provider (each message is answered by one of the two, and the other may take over when one cannot answer).
• The service-improvement statistics and the safety measures for teenagers were added.
• The AI conversation consent was renewed to name both providers.

Revised October 1, 2026

• Our AI provider changed from Anthropic to OpenAI.
• Purchase verification, reports of AI replies, the details of international transfers, email inquiries, the counters that limit abuse, app permissions, destruction of personal information, how to exercise your rights, security measures, and the Data Protection Officer were added.
• The conversation history kept on your device was added.