Privacy
Every claim on this page is derived from what the code actually does. If you find a sentence here that the app does not honour, that is a bug and we want to hear about it.
The short version
- You do not need an account or an email address to use Mythkin.
- Your conversations are sent to Anthropic to generate replies. Character artwork, story covers, painted moments and optional chapter illustrations are generated by OpenAI. We ask your explicit permission before either happens.
- We do not sell your data, and we never use your conversations to target advertising.
- You can export everything, and you can delete everything, from inside the app.
- Mythkin is for adults (18+).
What we collect
| Data | Why it exists | Where it lives |
|---|---|---|
| A device identifier — a random ID your device generates. Not your email, phone, or advertising ID. | It is how your characters, conversations and memories are yours without an account. | Our server, and your device. |
| About you, if you fill it in — Settings → About you holds the name you want characters to call you, your pronouns, and anything you choose to write about yourself. All three are optional and all three are free text you typed; we never read them off your phone. | So a character addresses you the way you asked to be addressed. This is the dedicated profile-name field, and it is the name you chose to give it; names may also appear in content you send. | Our server, one row per device. Sent to Anthropic as part of the prompt on every reply, which is what makes it work. Editable and clearable in Settings at any time. |
| Characters you create — name, description, personality, greeting, backstory, artwork. | The product. If you publish one, its text and artwork become visible to other users. | Our server. |
| Conversations — the messages you send and the replies you receive. | So a conversation can continue where it left off. | Our server, and cached on your device. |
| Memories — short facts about you that a character has learned, each linked to the message it came from. | So characters remember you. This is the feature the app exists for. | Our server. Visible and editable by you in the app. |
| Age confirmation — that you confirmed you are 18+. | Legal requirement. | Our server, as a dated event against your device ID. |
| Crisis referral counts — that a referral was shown, and when. Not what was said. The row also holds a salted hash of the network the request came from — never an address, and it cannot be turned back into one. | California SB 243 requires operators to report these annually from July 2027. The network hash is what stops one caller looking like a crowd: crisis turns skip the free-tier limit, and without it anyone could mint a fresh device ID per message and take unlimited free replies. | Our server. |
| Subscription status, if you subscribe — an Apple-signed receipt. | To unlock Plus. We never see your payment details; the store handles payment. | Verified in memory per request; not stored as a payment record. |
| Spark purchases — Apple's transaction ID, the pack, when it was credited, your remaining balance, and the random app-account identifier and device ownership link used to reach that balance. We do not receive your Apple ID or payment-card details. | To credit each purchase once, keep earlier library balances separate when their ownership cannot be established, show your balance and spend credits only on paintings. | Our server. Unspent purchased Sparks survive "Delete everything", together with the link needed to reach the balance. Redeemed-purchase records are retained with the device identifier removed to prevent duplicate credit. See below. |
| Sandbox testing credits, when using App Review or TestFlight — test transaction IDs, packs, credits and usage counts. | To test purchases with Apple-signed transactions while keeping test credits separate from purchased funds and limiting test painting usage. | Our server. Test credits are identified as Sandbox and are not paid funds. |
| Usage counts — how many messages you have sent in the current window. | To enforce the free tier fairly. | Our server. |
| What you heart, borrow, block and report — one row per action, holding your device ID, what it pointed at, and when. A report also holds the reason, anything you typed into it, and a salted hash of the network it came from, for the same reason the crisis row does — so one reporter cannot look like a crowd. | Hearts and borrows are how the shelves rank and how your library knows what is in it. Blocks are how a creator stays hidden from you. Reports are how a human can review something you flagged. | Our server. Hearts and borrows appear as counts on the creator's card, never as your identity. All of it is in your export. Hearts, borrows and blocks are deleted when you delete everything; a report you filed stays open with your identifier removed, because it is evidence about someone else's content. |
We do not request access to your contacts or photo library, your precise location, an advertising identifier, or a health profile. Photos are limited to ones you choose as described below. Content you type or attach can contain names, contact details or health information, and follows the processing described above. The optional name in Settings → About you is the dedicated profile-name field; names can also occur in conversations and saved memories. There is no third-party analytics SDK or advertising SDK in the app.
Photos you choose to send
Mythkin never reaches into your photo library. It only ever receives a photo you pick yourself, and only in two places:
- Making a kin from a photo. You choose up to three photographs — with the camera or from your library, you pick either way — and we paint a portrait from them. Our service removes the input photos after the painting succeeds or reaches a terminal failure; a pending retry can retain them until that request resolves. This does not mean OpenAI deletes its copy immediately: provider retention and safety review follow the API policies below. We do not make the input photos public or use them to train our own models. Location and camera details are stripped before anything is sent. A kin made this way stays in your library: it cannot be shared or borrowed.
- Sending a photo in a chat. The photo is forwarded to the AI so the character can respond to it, and is not stored on our server afterwards.
Before either one leaves your phone, the location, the timestamp and the camera details recorded inside the image file are stripped off, and the image is re-encoded by us. Photos are sent to OpenAI (for painting) and to Anthropic (for a reply in chat) — the same two companies named on the consent screen when you first opened the app.
Who else receives your data
Anthropic — conversation content
To generate a character's reply, we send the character's description, the relevant part of your conversation, the memories that character is using, and — if you filled it in — what you wrote in Settings → About you, including the name you asked to be called. Anthropic’s commercial API terms restrict processing purposes and require confidentiality and security. API inputs and outputs are not used for model training by default, subject to explicit opt-in and feedback exceptions. Its standard retention is up to 30 days, with safety, legal, model/feature and separate-agreement exceptions. See its commercial terms, retention policy and training policy.
OpenAI — character artwork and optional illustrations
OpenAI processes API content under its services agreement and API data controls. API content is excluded from training by default unless sharing is enabled. Retention and safety review depend on the endpoint and applicable settings; deleting content from Mythkin does not erase copies the provider already received.
When artwork is generated for a character you create, the character's appearance description is sent to OpenAI's image API. Photo-based creation also sends the reference photo as described above. A painted chat moment uses a short AI-written scene description, the character's appearance description and the kin's portrait. A story cover uses the story's title, premise and character references.
If you choose Illustrate this chapter, a separate confirmation asks your permission to send OpenAI a short excerpt from that saved AI-written chapter (up to 240 characters), the character's appearance description and the kin's portrait. This image request does not directly include your own chat messages, saved-memory library or About you profile. Declining the illustration keeps the chapter available to read.
Apple — payments
Subscriptions, if you take one, are handled entirely by the app stores. We receive a signed receipt confirming an active subscription. We never see your card.
Fly.io — hosting
Our server and database run on Fly.io infrastructure in the United States.
We ask for your permission during setup before the normal AI features send content to Anthropic or OpenAI. Optional chapter illustration asks for separate permission for that selected excerpt and portrait each time, before starting. If you decline, that illustration is not sent; you can keep reading the chapter. You can review provider sharing in Settings.
Same or equal protection. Anthropic and OpenAI receive only the data they need to answer your requests, under commercial API terms that limit their use of it to providing that service to us (and to abuse monitoring and legal compliance) and that require confidentiality and security. We confirm that they protect your data to the same or an equal standard as this policy describes and as Apple’s App Store Review Guidelines require. None of them may sell it or use it for advertising. Fly.io hosts our servers under terms that let it use hosted data only to provide and improve its hosting service; it has no right to sell that data or use it for advertising.
What other people can see
This matters most, so it is stated as a rule rather than as a description:
If you publish a character, other people can borrow it and talk to it. They cannot see your conversations with it. You cannot see theirs. A creator sees counts — how many chats, borrows and likes their character has — and never a word of anyone's conversation, and never anyone's memories.
A character kept private is visible only to you. A character shared by link is visible to whoever has the link.
Keeping and deleting
Saved facts do not expire or get automatically pruned. Both plans use the same 10,000-active-fact safety limit; reaching it pauses new additions without deleting existing facts. Replies use a bounded selection of relevant facts and pins, not the whole saved library. User-authored facts, edits and pins are protected from automatic changes. Ordinary learned facts can be corrected or superseded when supported by a live message you sent.
- You delete a memory — it leaves the saved-memory recall set immediately and is no longer shown on the memory screen. We retain its text as a deleted marker to suppress automatic re-learning of the same wording. You can add it back yourself. The original conversation is separate and can still be used as conversation context until you delete that conversation.
- You delete a conversation — its messages go with it. Memories a character learned from it stay, deliberately: a fact you chose to keep is yours, and forgetting is done on the memory screen, where you can see exactly what you are forgetting.
- You delete a character — it disappears from the marketplace and can no longer be borrowed.
- You delete everything — Settings → Delete everything. This removes your characters, conversations, messages and memories from our servers. Characters other people have borrowed are anonymised rather than yanked out of someone else's ongoing conversation.
What survives "Delete everything", and why
The app shows you this list at the moment you delete, rather than the word "everything". It is short, and each line is there for a reason we can defend:
- Crisis referral counts — kept, with the link to you removed. California SB 243 requires us to report referral counts for periods that have already passed, and a counter that can be erased cannot do that. No message text was ever stored.
- Reports you filed — kept, with your identifier removed. A report is evidence about someone else's content and stays open for a human to finish reviewing.
- Rate-limit counters for the window you are currently in. They hold a request count and nothing else.
- A record that a Spark purchase was redeemed — kept, with the device identifier removed, so the same store transaction cannot be credited twice.
- Purchased Sparks you have not spent — kept with the random app-account identifier and device link needed to reach the balance. This access link is not anonymised while a paid balance remains. If you want that balance removed, spend the Sparks first or contact support. Removing the balance does not issue an App Store refund.
Otherwise we keep your data for as long as you use the app. Server logs, which do not contain conversation text, are kept for up to 30 days for debugging.
Your rights
You can export everything we hold about you as a file, from inside the app, at any time, without asking us. Because we do not require an account, that in-app export is also the fastest way to exercise a GDPR or CCPA access request. One exception, stated so the export is not mistaken for a complete archive: memories you have already deleted are not in it. If you want those too, write to us and ask. For anything else, or if the app is not working, see Support.
Children
Mythkin is for adults. We ask you to confirm you are 18 or older before any character is reachable, and we do not knowingly collect data from anyone under 18. If you believe a minor has used the app, contact us and we will delete the data.
Changes
If this policy changes in a way that affects what we collect or who receives it, we will say so in the app before the change takes effect, not only on this page.