Privacy Policy

Last updated: 1 November 2026 · Also available in Russian and in Polish; if the versions differ, the English version prevails, except that for users in Poland the Polish version prevails.

This policy explains how personal data is processed when you use the Allomi app for iPhone ("Allomi", "the app") and the website allomi.live. It contains the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller responsible for your personal data is Maksim Bulat, who runs Allomi as a sole proprietorship (jednoosobowa działalność gospodarcza) entered in the Polish Central Register and Information on Economic Activity (CEIDG):

Maksim Bulat
ul. Krzyżówki 28C lok. 7, 03-193 Warszawa, Poland
NIP (tax identification number): 5833448632 · REGON: 521769332
Email: support@allomi.live

In this policy "we" and "us" mean Maksim Bulat as the operator of Allomi. We are established only in Poland, so the Polish data protection authority is the supervisory authority responsible for us (section 12). We have not appointed a data protection officer. For any privacy question or request, write to support@allomi.live.

2. How Allomi works

Allomi lets you talk by voice with fictional AI characters. The app on your phone only handles the call: everything related to AI, memory and minutes is handled by our servers in Finland, which use the AI service providers listed in section 6. During a call:

1. Your phone streams your microphone audio to our server over an encrypted connection.
2. Our server passes the audio, as it arrives, to a speech recognition provider, which turns it into text. Neither we nor the provider save the audio (section 5).
3. That text, together with the character's description and the character's memory of you, goes to a large language model (LLM), which writes the character's reply.
4. A text-to-speech provider turns the reply into the character's synthesized voice, which is streamed back to your phone.
5. After the call, an LLM reads the transcript and updates that character's memory: the 2–3 recap lines you see after the call, a short profile of you (about 300 words), individual notes, and the time and topic of a callback if you agreed on one.

Characters are AI, not people. Their voices are synthesized from licensed voice libraries; no real person's voice is cloned. AI can be wrong, misremember things or say something inappropriate.

3. What we process, why, and for how long

Most data comes directly from you and your device. Some comes from Apple (purchase and subscription status, refund notices, the DeviceCheck result, Sign in with Apple) or Google (if you sign in with Google). Memory, recaps and safety flags are generated by AI from your calls. You don't have to give us anything beyond what a call needs: without microphone audio there can be no call, but your name, the onboarding questions and signing in are optional.

3.1 Your account and the app

Data

A random account ID; an install ID created on your device (we store only a hash of it); session tokens (stored as hashes); the name you want characters to use (optional); app language, time zone and app version; whether and when you confirmed you are 18 or older, and whether calls are paused after an age check (section 13); whether you finished onboarding; your optional onboarding answers (what you'd like to talk about, when you usually have time); your settings; when you last used the app. Optionally, the grammatical form you choose for how characters address you (masculine, feminine or no preference): we use it only so that characters speak to you with correct grammar, you can change it at any time in Settings, and it is deleted with your account.

Purpose

To create and run your account without a sign-up form, keep you signed in and personalise your calls.

Legal basis

Performance of our contract with you (Art. 6(1)(b) GDPR).

Retention

Until you delete your account. Signing out removes that device from the account; an account that has no sign-in method and no device left is deleted at once. Expired or revoked session tokens are deleted after 7 days.

3.2 Optional sign-in

Data

Sign in with Apple: your Apple user identifier, the email address Apple shares (it can be a private relay address), your first name if you choose to share it, and an Apple token we keep encrypted so that we can disconnect Sign in with Apple when you delete your account. Google: your Google account identifier and verified email address. Email: your email address and a one-time 6-digit code (we store only a keyed hash of the code; it is valid for 10 minutes).

Purpose

To let you get your account, the characters' memories and your purchases back on another phone or after reinstalling.

Legal basis

Art. 6(1)(b) GDPR.

Retention

Until you remove that sign-in method or delete your account. Expired codes are deleted automatically.

Apple and Google handle the sign-in itself under their own privacy policies; we receive only the data listed here. Google sign-in opens Google's page in a secure browser window; the app contains no Google software.

3.3 Calls

Data

Your voice (a live audio stream, not stored); the text of what you and the character say; call records: character, direction (you called or they called), start and end time, duration, minutes used, why the call ended, your rating of the call (thumbs up or thumbs down) if you give one, and technical data per reply (response time, which provider answered, cost).

Purpose

To provide the call, count minutes, show your recent calls, and keep call quality, reliability and costs under control.

Legal basis

Art. 6(1)(b) GDPR for the call itself; our legitimate interest in a reliable and affordable service (Art. 6(1)(f)) for the technical data; your explicit consent (Art. 9(2)(a)) for sensitive information you choose to share (section 4).

Retention

Audio: not stored. Call records: as long as your account exists. Transcripts: see 3.4.

3.4 Character memory

Data

Separately for each character: a profile summary of about 300 words, up to 200 short notes ("facts") with tags, the recap lines and topics of your calls, callbacks you agreed on (time and topic), and the full text transcripts of your 5 most recent calls with that character. Also, if it applies: the character's mood towards you after a recent call and a promised call it took back (see "How characters react to how you treat them" below).

Purpose

So that the character remembers you and can continue where you left off. This is the core feature of Allomi.

Legal basis

Art. 6(1)(b) GDPR; your explicit consent (Art. 9(2)(a)) for sensitive information.

Retention

Transcripts: only the 5 most recent calls per character; older transcripts are deleted automatically after each call. Profile, notes, recaps and topics: until you erase that character's memory or delete your account. When a character reaches 200 notes, the oldest are removed. A mood ends by itself at the latest 72 hours after it was set.

Erasing memory (Settings → Characters → the character → Erase memory…) deletes that character's profile, notes, transcripts, recaps and call topics, its mood towards you and any promised call it took back, and cancels the callbacks you agreed on. It also deletes the safety flags on your calls with that character that could reveal your health or sex life (3.8). Call records without content (date, duration, direction, rating) stay for minute accounting and your list of recent calls, and your choice about incoming calls from that character stays as you set it.

How characters react to how you treat them. Each character has its own temperament. After each call, the AI that updates the memory also assesses how you treated the character in that call: whether you insulted it, kept cutting it off or hung up on it mid-sentence in anger, and whether you apologized, the call ended warmly or you were in real distress. Cutting off and hanging up are counted by our server, not guessed. If the assessment finds a real offence and you didn't make amends, the character may be offended with you for a while: from a few hours up to at most 72 hours, depending on its temperament. If the character ended the call itself after threats or slurs (section 9), our server doesn't wait for the assessment to find an offence: it records a serious offence that you didn't make good, so the character is offended for the full time its temperament sets. Only real distress or a crisis in that call prevents this. We store the cause (an insult, cutting it off or an angry hang-up), a short note on what happened and when the mood started and ends.

• While a character is offended, it may mention it briefly at the start of your next call, and it doesn't call you on its own. It always picks up when you call, and calls it agreed with you still happen.
• A character is never offended because you call rarely, keep calls short, miss or decline its calls, don't pay, or are sad or upset. An apology, a warm call, distress or a crisis ends the mood at once.
• Only after threats, slurs or degrading names for the character or for a group of people may a character say in the call that it won't make a call it promised you. The call is cancelled only if the character actually said so in the call and a separate automatic check of your own words confirms that level of abuse. If the character said so in the line it ended the call with, the check that allowed it to end the call (section 9) serves as this check. Ordinary rudeness never cancels a call. The character's next calls remember this for up to 14 days, and a note about it (what, when and why) stays in its memory until you erase it. A sincere apology can lead to a new call the usual way.

3.5 Incoming calls

Data

Your permission for each character (not asked, allowed or declined) and when it changed; whether a character offered to call you and whether you agreed during a call; the global "Calls from characters" switch, frequency and quiet hours; your time zone; scheduled callbacks (time and topic); the VoIP push token of your iPhone.

Purpose

So that characters call you only if, when and as often as you allowed.

Legal basis

Art. 6(1)(b) GDPR. Incoming calls are a feature you switch on yourself, on screen, separately for each character.

Retention

As long as your account exists. The push token is replaced whenever your iPhone issues a new one.

The push that makes your phone ring is delivered by Apple and contains only a call ID, the character's ID and name, and an expiry time. It never contains anything from your conversations.

3.6 Purchases and minutes

Data

Apple transaction data that the app sends to our server and that Apple sends us in server notifications: transaction IDs, product, purchase, expiry and refund dates, whether it was a test purchase; your subscription status and billing period; your minute balance and a record of minutes added and used.

Purpose

To verify purchases with Apple, add minutes, handle renewals, refunds and "Restore purchases", and make sure no purchase adds minutes twice.

Legal basis

Art. 6(1)(b) GDPR. Keeping transaction records after you delete your account: our legitimate interest in preventing abuse and processing Apple's renewal and refund notices correctly (Art. 6(1)(f)).

Retention

Balance and minute records: until you delete your account. Transaction and subscription records: when you delete your account they are disconnected from it and kept, without your account data, so that a subscription you still pay for can be restored to a new account and a refunded purchase can never add minutes again; we delete them at the latest 3 years after the subscription ended or the purchase was made.

We never receive your card details or your Apple Account details. Apple processes all payments.

3.7 Free minutes and abuse prevention

Data

An Apple DeviceCheck token, created by your iPhone, which lets our server ask Apple to read and set a "free minutes already used" flag for your device (Apple does not tell us which device it is); a record, containing a hash of the install ID, that free minutes were given on this device; request counters per account, device and IP address.

Purpose

To give free minutes only once per device and to protect the service from abuse, such as collecting free minutes with new accounts or guessing sign-in codes.

Legal basis

Our legitimate interest in preventing fraud and abuse (Art. 6(1)(f) GDPR).

Retention

The DeviceCheck flag is stored by Apple with the device, also after the app is deleted. Our free-minutes record is kept after account deletion, for at most 3 years. Request counters are deleted automatically after their time window (at most one day) ends.

3.8 Safety

Data

The text of what you say in calls; automatic safety flags on a call record (for example, that the crisis protocol was triggered, or that a call suggested you might be under 18); your app language, region setting and time zone to choose a helpline for your country (we do not use your location).

Purpose

To keep conversations within our content rules, to help if you seem to be in crisis (the character steps out of its role, speaks calmly and gives you a helpline for your country), to block attempts to extract the characters' instructions, and to keep minors out of a service made for adults (section 13).

Legal basis

Our legitimate interest in a safe service that protects its users (Art. 6(1)(f) GDPR); your explicit consent (Art. 9(2)(a)) where the information concerns your health.

Retention

Flags that could reveal your health or sex life (that the crisis protocol was triggered; sexual content) are deleted when you erase that character's memory, and in any case 90 days after the call. We keep them that long only to check how often our safety protocols are triggered and whether they work. The other flags (threats or abuse, violence, attempts to extract the characters' instructions, a sign that you might be under 18) are part of the call record and are deleted with your account: we keep them to prevent abuse and to keep the service safe. There is no separate safety log of what you said.

How it works: your words are checked automatically against a list of crisis keywords in your language; on a match, an LLM checks the sentence. If what you say about yourself strongly suggests you are under 18, the character keeps the conversation away from adult topics; after the call, two separate automatic checks read only your own words (section 13). We do not report anything to authorities or other third parties on the basis of these checks.

3.9 Product analytics

Data

Events the app sends to our own server, with a timestamp and your account ID: app opened; onboarding steps and choices; call started, connected or ended (character, direction, duration, how it ended); call errors (step and error code); changes to incoming-call permissions; call ratings; paywall views and purchase results (product); restored purchases; which setting you changed; memory erased; account deleted. Events never contain what you or the characters said.

Purpose

To understand how Allomi is used, find problems and improve onboarding, characters and calls.

Legal basis

Our legitimate interest in improving the app (Art. 6(1)(f) GDPR). You can object at any time (section 11).

Retention

180 days, then deleted automatically; earlier if you delete your account. If you object, we delete your events at once and record no new ones for your account; we keep only the fact that you objected.

3.10 Crash and performance reports

Data

Diagnostic reports that Apple's MetricKit framework provides to the app (crashes, hangs, performance and battery data, device model, iOS version, app version), sent to our own server with your account ID.

Purpose

To find and fix bugs.

Legal basis

Our legitimate interest in a working app (Art. 6(1)(f) GDPR).

Retention

90 days, then deleted automatically; earlier if you delete your account.

Separately, if you have chosen in iOS to share analytics with app developers, Apple may give us crash reports through App Store Connect under Apple's own terms.

3.11 Server logs

Data

Web server access logs: IP address, time, requested address, response status and user agent (app or browser and system version). Application logs: account IDs and technical events. We do not log what you say, sign-in codes, tokens or full email addresses.

Purpose

Security, troubleshooting and abuse prevention.

Legal basis

Our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).

Retention

Logs have a fixed size limit and are automatically overwritten by newer entries when it is reached. They are not archived or included in backups.

3.12 Support requests

Data

Your email address, your message and any details you give us.

Purpose

To answer you and to handle requests about your data.

Legal basis

Art. 6(1)(b) GDPR for questions about the service; our legal obligation to answer data protection requests and consumer complaints (Art. 6(1)(c)); otherwise our legitimate interest in answering you (Art. 6(1)(f)).

Retention

Up to 2 years after your request is closed, unless we need it longer to establish or defend legal claims.

3.13 This website

Data

When you open a page, the web server processes your IP address, the page requested, the time and your browser's user agent in order to deliver the page, and records them in its access log.

Purpose and legal basis

Delivering the website securely; our legitimate interest (Art. 6(1)(f) GDPR).

Retention

As for server logs (3.11).

The website uses no cookies, no analytics and no content from other sites (fonts, scripts, videos or similar).

4. Sensitive information you share

Talking to a character can touch on personal things: your health and feelings, relationships, sex life, religion or political views. The GDPR calls these "special categories of personal data". Allomi never asks you for them, and you decide what you say. If you do share such information, we process it only to run your calls and keep that character's memory, as described above, based on your explicit consent (Art. 9(2)(a) GDPR), which you give on the "Before we start" screen before your first call. Running your calls includes the automatic safety checks that read what you say during and after each call: the crisis check, the check against our content rules and the age check (section 3.8). This includes processing by the AI service providers that run your calls, some of them in the USA (section 6).

You can withdraw this consent at any time by erasing the memory of the characters concerned or deleting your account, and by not discussing such topics in future calls. Erasing a character's memory also deletes the safety flags on your calls with that character that could reveal your health or sex life. Withdrawing consent does not affect processing that took place before.

5. Your voice

We don't record your calls and never store your voice, not on our servers and not in backups. Audio exists only in memory while it is streamed to speech recognition. Our main speech recognition provider (Soniox) processes it in the EU and does not retain it. Only if Soniox fails do we use Deepgram's EU service instead, with Deepgram's use of audio for model improvement switched off. We don't create voiceprints and don't use your voice to identify you.

6. Who receives data

We don't sell or rent your data and don't share it with advertisers or data brokers. We use the following service providers, which process data on our behalf and only to provide their service to us. Each of them processes your data only under a data processing agreement with us (Art. 28 GDPR): we use a provider for Allomi users only once its agreement is in place. Under these agreements they must keep your data confidential and secure, and they may not use it for their own purposes, such as training their AI models. The one exception is OpenRouter's screening for child sexual abuse material, described in How AI providers handle your conversations below. Support email is handled differently; see Support email below.

Support email. Emails you send to support@allomi.live, and our replies, are handled by two companies that are not in the table above:

• Namecheap, Inc. (USA) receives these emails and forwards them to our support mailbox. It does this on our behalf, as our processor, under the data processing addendum that is part of its terms of service.
• Google. Our support mailbox is a Gmail account. Gmail is Google's consumer email service, which Google provides under its own Terms of Service and Privacy Policy. Google is not our processor for this mailbox: we have no data processing agreement with Google, and Google processes the emails stored in Gmail as an independent controller, under its own terms and not on our instructions.

What this means for you:

• Your emails and our replies are stored by Google on its servers, which are in the USA and other countries (section 7).
• The commitments described above for our service providers (processing only on our behalf, no use for their own purposes) don't apply to Google. Google's use of the emails is governed by its Privacy Policy, and you can exercise your rights regarding that use with Google as well as with us.
• We keep support emails for up to 2 years after your request is closed, and longer only if we need them to establish or defend legal claims (section 3.12). Then we delete them, and Google removes them from its systems after a delay that Google determines.
• Please include only what your request needs, and nothing about your health or other sensitive matters unless the request requires it. You can erase a character's memory, delete your account and stop incoming calls in the app without writing to us (section 11).

Independent controllers that process data under their own privacy policies:

• Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., USA): App Store purchases, payments, refunds and subscription management; Sign in with Apple; delivery of the pushes that make incoming calls ring (Apple Push Notification service); DeviceCheck.
• Google: if you choose "Continue with Google" (Google Ireland Limited for users in the EEA and Switzerland, Google LLC elsewhere); and Gmail, where our support mailbox is (see Support email above).
• OpenRouter (USA): only for content that its child-safety screening flags as potential child sexual abuse material, which OpenRouter handles under its own legal obligations (see below).

We may also disclose data where we are legally required to, for example to a court or authority, and only to the extent required.

How AI providers handle your conversations

What a language model receives. For each reply: the text of the call so far (what you and the character said), the character's description, the character's memory of you (profile, notes and recaps of recent calls), your name and form of address if you gave them, your onboarding answers, and the call context (for example the time, your time zone, who called whom and your incoming-call settings). After a call, the model that updates the memory receives the call's transcript. This can include sensitive information you choose to share (section 4) and what you say about other people. Language models never receive your voice: audio goes only to speech recognition (section 5).

Our main model: OpenRouter and three model hosts. We send these requests to OpenRouter, Inc. (New York, USA). OpenRouter passes each request to one of three US companies that run the model: Together AI, Baseten or Crusoe. The model is an open-weight model developed by DeepSeek (currently DeepSeek V4.1 Flash); it runs on these hosts' servers, and nothing is sent to DeepSeek. With every request we instruct OpenRouter to use only these three hosts and only with zero data retention. Apart from the exception described next, this means:

• OpenRouter and the host use the text only to produce the reply. Neither stores it after the reply has been generated, and neither uses it to train AI models.
• To answer faster during a call, the host may briefly hold the request in working memory (a cache). This is not a stored copy.
• OpenRouter keeps technical records of each request, such as the time, the model and the number of tokens, but not its content.

The exception: child-safety screening. OpenRouter automatically screens every request it handles, including requests with zero data retention, for child sexual abuse material. If the screening flags content as potential child sexual abuse material, OpenRouter may keep it for review by people, for reporting (US law requires such reports to the National Center for Missing & Exploited Children) and for preservation where the law requires it. OpenRouter may also keep data where the law requires it or where this is necessary to deal with malicious use of its service. OpenRouter does this to meet its own legal obligations and to protect its service, not on our instructions, and is responsible for it itself.

Backups. If the main model is unavailable or too slow, the reply comes from xAI's Grok model (we try xAI's EU endpoint first, then its global endpoint) and, if that fails too, from Mistral AI's own Mistral Small model in the EU. The backup then receives the same information for that reply. Mistral AI also runs our safety checks and updates the characters' memory after each call; if Mistral is unavailable, xAI takes over the safety checks and OpenRouter the memory update. These providers process the text only on our behalf and may not use it to train AI models.

7. Transfers outside the EEA

We are established in Poland, our servers are in Finland and our backups are in Germany. Finland and Germany are in the EU, so keeping your data there is not a transfer outside the European Economic Area (EEA). Some providers are in the USA or may process data there (section 6). Sending data to a country outside the EEA is a transfer under Chapter V of the GDPR, and we make such transfers only with one of the safeguards described here. The European Commission's adequacy decision for the USA covers only companies certified under the EU-U.S. Data Privacy Framework. For all other transfers outside the EU and the EEA we rely on the Commission's Standard Contractual Clauses (Decision (EU) 2021/914), which are part of the provider's data processing agreement.

For our main language model, our transfers to OpenRouter are covered by the Standard Contractual Clauses (controller-to-processor module) in OpenRouter's data processing agreement. OpenRouter passes the requests on to Together AI, Baseten or Crusoe within the USA, and under these clauses it must bind them to the same data protection obligations.

Support email (section 6): Namecheap's forwarding in the USA is covered by the Standard Contractual Clauses (controller-to-processor module) in Namecheap's data processing addendum. Google stores support emails as an independent controller, in the USA and other countries, and is itself responsible for those transfers: Google states that it relies on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and on the Standard Contractual Clauses. Our own safeguards do not extend to Google's storage of these emails.

You can ask us for a copy of the relevant safeguards at support@allomi.live.

8. Retention at a glance

Deleted data is removed from the live database immediately and disappears from backups as they roll over, within 8 days. We use backups only to recover from a technical failure; if we ever have to restore one, we delete again whatever you had deleted.

9. Automated processing and AI

Characters' replies, call recaps and memory are produced automatically by AI models; no person listens to your calls or writes the replies. No one reads your conversations as a routine. Conversation data is accessed by a person only when that is necessary to fix a specific technical problem, to handle your request, to review a pause of calls after an age check (only the words that triggered it, section 13), or when the law requires it. At OpenRouter, people may review content that its child-safety screening flags (section 6).

We don't make decisions about you based solely on automated processing that have legal effects or similarly significantly affect you (Art. 22 GDPR). Some automatic steps do affect what you can do in the app: free minutes are given only after the device check (3.7); a call ends automatically when your minutes run out or after long silence; a character can end a call itself, but only in the three cases described below; the crisis check can make a character step out of its role. After each call, AI assesses how you treated the character (section 3.4): this can make the character offended for up to 72 hours, during which it doesn't call you on its own, and after threats or abuse a call it promised you can be cancelled. If a call strongly suggests you are under 18, calls are paused until you confirm your age again or contact us (section 13). If you think something went wrong, write to us and a person will look at it.

When a character ends a call. A character can end a call itself only in these three cases:

• you threaten the character or another person with violence or harm;
• you use slurs, or vile, degrading names for the character or for a group of people (for example people of a nationality or a religion, women or gay people);
• you say something sexual or romantic involving someone under 18: you talk sexually about a minor, or, after saying in that call that you are under 18, you ask the character for flirting, romance, a date or sex. Saying that you are under 18 is not by itself a reason to end a call (section 13).

A character never ends a call for anything else: not for ordinary rudeness, swearing or insults such as "stupid" or "useless", not for being cut off, and never because you are sad, upset or in crisis. Once the crisis check has been triggered in a call (3.8), the character can't end that call.

This is decided automatically; no person takes part. The AI that writes the character's replies signals that one of the three cases applies. Before the call can end, our server runs a separate automatic check: another AI model reads only your own words from that call (the last three things you said decide; up to eight earlier ones are context only, for example an age you gave) and must name one of the three cases and quote words you actually said. If it doesn't, or gives no answer in time, the call goes on. If it does, the character says one short last line in its own words and its own manner, in the language of the call (in the third case, a calm and kind line saying that Allomi is for adults), and the call ends; that line can't be interrupted. After threats or slurs, depending on its temperament, a character may first warn you once. The app then shows that the character ended the call.

What follows:

• The call record shows that the character ended the call and which of the three cases applied, with a safety flag (threats or abuse, or a minor involved). We keep these until you delete your account, to prevent abuse and keep the service safe (3.8).
• The character remembers it: a note in its memory says what happened, when and why, and stays until you erase that memory.
• After threats or slurs, the character is offended with you (section 3.4), and if it says in its last line that it won't make a call it promised you, that call is cancelled.
• In the third case the character isn't offended. The usual check after the call decides whether your calls are paused (section 13).
• Ending a call doesn't by itself stop you from calling again, and doesn't pause, suspend or close your account. If you think a character ended a call by mistake, write to us and a person will look at it.

10. No selling, no ads, no tracking

• We don't sell, rent or trade personal data.
• Allomi shows no ads and contains no advertising or third-party analytics software.
• We don't track you across other companies' apps or websites and don't use the iPhone's advertising identifier.
• We don't use your conversations to train AI models, and our AI service providers may not use them for that either.

11. Your rights and how to use them

Under the GDPR you have the right to access your data and get a copy of it, to have it corrected, to have it deleted, to restrict its processing, to receive it in a machine-readable format (portability), to object to processing based on our legitimate interests (Art. 6(1)(f)), and to withdraw consent at any time with effect for the future.

In the app

• Erase what a character remembers: Settings → Characters → the character → Erase memory…
• Delete your account and its data: Settings → Account → Delete account (if you haven't signed in, the button says Erase data). This immediately deletes your account, all memories and transcripts, your call history, settings, sign-in methods, analytics events and crash reports, and disconnects Sign in with Apple. It does not cancel an Apple subscription; cancel that in your Apple Account settings.
• Stop incoming calls: for everyone, Settings → Incoming calls → Calls from characters; for one character, Settings → Characters → the character → Can call me.
• Remove a sign-in method or sign out: Settings → Account.
• Microphone access: in the iOS Settings app, under Allomi.

Deleting the app alone does not delete your account. Because the device's install ID is kept in the iPhone's secure storage (Keychain), the same account can come back after you reinstall. To remove your data, use Delete account (or Erase data).

By email

For everything else, including a copy of your data, corrections or objections, write to support@allomi.live. We answer within one month; for complex requests this can be extended by two further months, and we will tell you if so. It is free of charge. If you object to product analytics, we delete your events and stop recording them for your account.

To protect your data, we act on a request about an account only when we can confirm it is yours, for example when you write from the email address linked to it. If your account has no sign-in method, the in-app controls above always work; for other requests we will agree with you on a way to confirm that the account is yours.

12. Complaints

You have the right to lodge a complaint with a data protection supervisory authority.

• The authority responsible for us. Our only establishment is in Poland, so the supervisory authority responsible for us is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl. Because our processing affects users in several EU and EEA countries, UODO is also the lead supervisory authority for it (Art. 56 GDPR).
• The authority in your country. You can also complain to the supervisory authority in the EU or EEA country where you live or work, or where you think the infringement took place. That authority will deal with your complaint and, where needed, work with the Polish authority on it. The list of EU and EEA authorities is on the European Data Protection Board's website.
• In the UK, this is the Information Commissioner's Office.

We'd appreciate the chance to fix the problem first, so please consider writing to us.

13. Adults only

Allomi is only for people aged 18 or over, and you confirm your age before the first call. We don't knowingly process data of anyone under 18.

• During a call. If what you say about yourself strongly suggests you are under 18 (for example your age or your school year), the character keeps the conversation away from adult topics and says, once, that Allomi is meant for adults.
• After the call. Two separate automatic checks read only what you said in that call. Talking about someone else, about the past, or in a joke or a game doesn't count. If both checks find that you said you are under 18, the call is flagged and your calls are paused: you can't make or receive calls until you confirm again in the app that you are 18 or older, or until we lift the pause after you write to us.
• What we keep. When and why calls were paused, the call it came from and the words that triggered it, so that a person at Allomi can review the pause. Those words and the call reference are deleted 30 days after the pause ends; the safety flag stays on the call record (section 3.8).

If we learn that an account belongs to a minor, we delete it. If you think a minor is using Allomi, please tell us.

14. Security

• All connections between the app, our servers and our providers are encrypted (TLS).
• Our servers are in a data center in Finland, and our backups are kept apart from them in a data center in Germany. The database is reachable only from our own servers, and administration tools are not reachable from the internet.
• Install IDs, session tokens and sign-in codes are stored only as hashes; Apple tokens are encrypted (AES-256-GCM).
• Keys to AI services exist only on our servers, never in the app.
• Backups are stored in a private storage bucket, and we test restoring them regularly.

No system is perfectly secure. If a personal data breach puts your rights at risk, we will notify the supervisory authority and, where required, you, as the GDPR provides.

15. Permissions on your iPhone

Allomi asks only for the microphone, which is needed for calls and is used only while a call is active. The app doesn't ask for your contacts, location, photos or camera and doesn't request permission to track you. Incoming calls from characters use Apple's VoIP push and CallKit and depend on the permissions you give in the app, not on iOS notification permission.

16. Changes to this policy

If we change how we process data, we will update this policy and the date at the top. We will tell you about important changes in the app before they take effect. The previous version is available on request.

Questions? support@allomi.live