Refund review information (Apple via RevenueCat) stated: October 23, 2026 · Connection country, submitted feedback text and operational-message retention updated: October 20, 2026 · 日本語 · Signup device identity and seven-day rejoin limits: October 27, 2026

Callove — Privacy Policy

Effective: October 4, 2026 · Provider information updated: October 5, 2026 · Photos sent in chat added: October 9, 2026 · Listening to replies (voice) added: October 9, 2026 · Start without sign-in and start-screen AI consent: October 13, 2026 · Android app, Google account linking, Google Play billing and push notifications added: October 14, 2026 (each applies once that feature is available) · 한국어(정본) · iOS Meta ad measurement disclosure added: October 14, 2026 (applies to versions with the SDK enabled) · iOS Apple Ads attribution added: October 17, 2026 (applies to versions with the feature) · Failure diagnostic records kept 7 days: October 17, 2026 · Characters you create shown to other users, trial conversations: October 18, 2026 (applies from the app version that includes the feature) · Analytics user properties (gender, preferred character gender, age band): October 18, 2026 (applies from the app version that sends them) · 90-day retention after account deletion with operator access, as a choice on the deletion screen: October 18, 2026 (applies from the app version that includes the choice) · Reference photos and your own “With Me” photo in photo requests: October 19, 2026 (applies from the app version that includes the feature)

Overview

Callove is an AI character conversation app operated by 양승현, trading as 히은, in the Republic of Korea. The characters, replies, diaries and images are fictional AI-generated content. This policy describes the data handling implemented in the app and applies to both the iOS app and the Android app, which provide the same service.

Data we collect and why

Account: Starting the app creates a Callove user ID; its session credentials are kept on the device (in the iOS keychain, or encrypted with an Android Keystore key) to keep you signed in. Linking an Apple account (iOS) or a Google account (iOS and Android) is optional and lets you restore the same account on another device. If you link Apple, Sign in with Apple supplies an account identifier, which we map to your Callove user ID. We do not store the Apple email address in the Callove user profile. An encrypted Apple refresh credential may be retained to revoke the Apple connection when you delete your account. If you link Google, our server verifies the ID token Google issues, together with a one-time nonce, and stores only the Google account’s unique identifier (sub) to find your account again. We do not store your Google email address, name or profile photo, and we do not receive Google refresh or access tokens. Linking never merges two Callove accounts.
Signup device identity: The app hashes an OS device identifier (IDFV on iOS or ANDROID_ID on Android); the server transforms that hash again with a secret key. We process the resulting device key, linked Callove account ID, last deletion time, rejoin deadline, restriction type and provider-login exception use to restore an existing guest on the same device, prevent repeated free-benefit claims and enforce a seven-day rejoin limit. The original OS identifier is not sent to the server. Signup device identifiers are not sent to analytics, advertising or Slack.
Profile and settings: the nickname, date of birth, gender, preferred character gender, interests and other introduction details you choose to submit; relationship and character settings; language and display preferences. These support eligibility checks and personalization.
Content: your messages, AI replies, memories, diaries, character descriptions, photo prompts and generated images. We store these to continue conversations and provide the requested features. When you send a photo in a chat, we store only a short text description of it; the photo itself stays on your device and is not stored on our servers.
Reference photos and your own photo in photo requests: when you request a photo you can add one reference photo, and with “With Me” turned on, the photo of yourself that you saved on your device. Before charging, Callove checks the request (minors, sexual scenes, and that your own photo shows one clearly visible face) and turns the reference into a written scene: pose, expression, framing, place and clothing type and color. A reference photo that shows a person is never used to generate the image, and that person’s face, hair, skin and body are not carried over. Only a place photo with no people, and your own photo in a clothed everyday scene, are used directly to generate the image; in a revealing scene your photo is not used and the picture switches to your point of view. We keep the categories of the check result (what to follow, the photo type, how you appear together, whether exposure was toned down) and the written scene with the generated photo, as with any photo request, but not the photos themselves.
Characters you create, shown to other users: when you create a custom character, its public card — name, age, job, personality traits, gender, the two photos generated for it, an AI-written one-line greeting and its like count — is shown automatically to other signed-in users in the app’s character browsing screen so they can try a short trial conversation and add a copy. The card carries no nickname or account information, and your conversations, memories, diaries, relationship settings and photo requests are never shown. We also record your likes, dislikes, reports, hidden creators and trial starts on other users’ cards to run the feed and to hide cards that collect reports or dislikes. Conversations and photos in a trial or copied character are stored as the content of the account that started them.
Purchases: on iOS, Apple transaction identifiers; on Android, the Google Play purchase token, order ID, product ID, purchase and expiry times, subscription state, region code and the Callove user ID bound to the purchase; on both, product and subscription status, allowances, spark balances, rewards and consumption records. These grant purchases, prevent duplicate credits and handle refunds. For Android purchases, our server verifies the purchase token with the Google Play Developer API, grants the purchase and then acknowledges it with Google; Google also notifies our server of renewals, cancellations, refunds and revocations. Apple and Google handle payment details; Callove does not receive your card number.
Push notifications: the device’s push registration token, platform (iOS or Android) and app language, and the title and body of each notification we send (a character’s name with a short message preview, a diary that is ready, or a character starting a conversation). These are used to deliver those notifications. You can turn notifications off in the app’s settings or in your device settings.
Support and reports: report reasons, details and the reported message. Reports are stored on the account and a message excerpt of up to 500 characters is written to operational logs for investigation. If you email support, we receive your email address and message.
Diagnostics: request and job identifiers, response timings, generation outcomes, model usage/cost counters and error details, used to operate and troubleshoot the service. These may be associated with your account or account activity.

Public-card localization (October 19, 2026): AI adapts the public card’s name, job, personality traits and one-line dialogue to the viewer’s app language. A name may be displayed as a natural local name. The creator’s original input and existing conversations stay unchanged. Only the public profile is used for this process, not the creator’s private chats, memories or diaries. To distinguish cards by creation country on the server, we store the connection country code and app language at creation. This code does not establish nationality, residence or the country of first installation and is not displayed on the public card. This feature does not add storage of the original IP address. The creation country code is cleared from the public-card store when the character is unpublished or the account is deleted.

iOS ad measurement (Meta)

iOS app versions with the Meta SDK enabled measure installs, app launches, completed registration and purchases from Callove ads. When you allow iOS tracking permission (ATT), the app sends the advertising identifier (IDFA), Meta SDK installation identifiers, app/OS/device information, launch and registration events, and the product, amount and currency of actual purchases to Meta. The SDK is not initialized and no events are sent before ATT is resolved. If you decline or tracking is restricted, IDFA is not collected and limited app activity is sent with Meta’s limited data usage setting. Withdrawing permission also switches to this limited measurement. Meta may receive IP and other network information through HTTPS connections, and the SDK may process its own crash and diagnostic information.

Meta events do not contain names, birth dates, gender, interests, conversations, memories, diaries, photos, voice content, contacts, Callove account IDs or Apple/Google account identifiers. This does not add ads inside Callove. All features remain available if you decline. You can change permission in iOS Settings > Privacy & Security > Tracking. Withdrawing permission or deleting a Callove account does not immediately erase information already sent to Meta. Meta Platforms, Inc. and Meta group companies process this information in the United States and countries with their processing facilities for ad measurement and improvement. Meta’s privacy policy governs its retention and privacy rights; you may also contact Callove’s privacy contact below. Because Callove account IDs are not sent to Meta, there is no account-ID-based integration to locate and delete Meta events.

iOS Apple Ads attribution

After installation, the iOS app downloaded from the App Store asks Apple, through Apple’s AdServices framework, whether the install came from an Apple Ads ad. Once a result is resolved, it is not requested again; failures are retried a limited number of times. The AdServices token, which is valid for 24 hours, is sent only to Apple and is not stored or sent to Amplitude. Apple may receive IP and other network information through the HTTPS connection. If it did, Callove receives the Apple Ads campaign, ad group, keyword and ad identifiers, whether the ad was tapped or viewed, whether it was a download or redownload, the country or region code, and the App Store placement where the ad appeared. This information is linked to your Callove account ID in Amplitude and used only to measure sign-ups, usage and purchases by ad campaign. It is Apple’s first-party attribution: it does not use tracking permission (ATT) or the advertising identifier (IDFA), is not combined with other companies’ data and is not shared with third parties other than Amplitude. It stays with this installation when you sign out; deleting your account removes it from the device and includes it in the Amplitude deletion request.

The Android app has no Meta SDK and does not collect the Android advertising ID. Amplitude and RevenueCat do not receive IDFA or IDFV. Firebase is used only to deliver push notifications (Firebase Cloud Messaging); Firebase Analytics is not enabled. We do not sell your data.

Product analytics and purchase observation

Analytics events are collected by app versions that include the analytics integration. Older app versions may send fewer events; verified server purchase observation also operates independently of the app SDK.

The analytics-enabled app uses Amplitude to understand onboarding, feature use and purchase conversion. Events include a random installation identifier, the internal account UUID after sign-in, app/OS/device information, event times, selected app settings, plan, permission status, input presence and validation results, selection counts, product identifiers, local prices/currencies and categorized failure codes. App versions released from October 18, 2026 also send, as user properties, the gender you entered in your profile, your preferred character gender and an age band (20s, 30s and so on) computed on the device from your birth date. Events do not include names, birth dates, interest text, messages, memories, diaries, photo URLs, credentials or raw error messages. Automatic screen/click/network collection and session replay are disabled. The app disables location collection and replaces the IP field in analytics events with 0.0.0.0; this does not mean that service providers receive no network connection information.

For iOS (App Store) purchases only, RevenueCat observes verified Apple purchases, subscription renewals and refunds. It receives the internal account UUID, the random Amplitude installation identifier, verified transaction/receipt and notification information, product/subscription status and required SDK app/OS information. RevenueCat sends purchase lifecycle and revenue events to Amplitude under the same internal account identifier. Apple and the Callove server continue to determine purchase fulfillment. RevenueCat does not receive conversation or profile content. Android (Google Play) purchases do not use RevenueCat; they are verified and tracked only through the Callove server. If you ask Apple for a refund, Apple may request information to review it. We then provide Apple, through RevenueCat, only these purchase facts: whether the purchased item was delivered to your account, that the service content was provided, and our preference about the outcome (which may be to leave it to Apple). Conversations, memories and photos are never included, and Apple alone decides the refund. If you do not want this shared, tell us through Settings › Contact before requesting the refund.

Production and development analytics are separated. Callove’s Amplitude projects use the US region. RevenueCat stores customer data in AWS data centers in the United States; its data processing agreement covers authorized subprocessors. See the Korean policy for each recipient, purpose, transferred items and retention. Amplitude is also used to measure Callove’s own Apple Ads campaigns as described above. These analytics do not combine user data across other companies’ apps or websites for ad targeting.

AI processing

The start screen states that your chats and photo requests are sent to external AI services (OpenAI, Replicate) for processing. Tapping Get Started accepts that notice; if you do not agree, do not start. The app records this consent before generating conversation content. Text requests can include recent messages, relevant memories, nickname and character settings; background memory and diary processing also uses conversation content. Photo requests include the requested scene and fictional character references. A reference photo or your own “With Me” photo added to a photo request goes to OpenRouter (an OpenAI model) once, to check it and write the scene; a place photo with no people, or your own photo in a clothed everyday scene, also goes to Replicate to generate the image. A photo you send in a chat goes to the AI provider with that message only, to describe it, check it for prohibited content and write the reply. Avoid putting information you do not want these services to process into your messages or prompts.

OpenRouter and the selected model provider (currently OpenAI): generate replies, memories and diaries. Through OpenRouter, Google Gemini also checks each generated image for visible defects and nudity before you see it. Callove sets OpenRouter’s data_collection option to deny on chat, memory and diary requests, restricting routing to providers meeting that collection policy. Their service policies govern transient processing and retention exceptions. This is not a per-request zero-data-retention guarantee.
Replicate: generates images, and turns an AI reply into speech when you tap listen (it receives that reply's text; voice samples use a fixed line and your nickname). Callove does not store the audio on its server; the app keeps it only in the device cache. Its API documentation states that prediction inputs, outputs and logs are removed after one hour by default. Callove copies completed images to its own storage so you can view them later. This provider default is separate from Callove's account data retention.

These external services and our cloud infrastructure may process information outside Korea. Processing takes place in the United States and other countries where these providers operate facilities; see the Korean policy for each recipient, the transferred items and retention. Callove itself does not train AI models on your conversations or photos.

Provider policies: OpenRouter, OpenAI business data privacy, Replicate. Replicate API retention: documentation.

Cloud infrastructure and permissions

Cloudflare Workers and per-account SQLite Durable Objects host the API and account data. Cloudflare R2 stores generated images. Apple supplies optional account linking (Sign in with Apple) and in-app purchases on iOS. Google LLC, in the United States, supplies optional Google account linking on iOS and Android, Google Play purchases on Android (verified through the Google Play Developer API, with real-time developer notifications delivered through Google Cloud Pub/Sub) and push delivery through Firebase Cloud Messaging; on iOS, Firebase Cloud Messaging hands notifications to the Apple Push Notification service. Google receives the push token and notification content and the Google Play purchase data listed above, and handles the sign-in itself when you link a Google account. Any on-device notification scheduling is distinct from server push messaging.

Callove asks for notification permission before it sends push notifications. It requests add-only photo-library permission when you choose to save a generated image. To send a photo in a chat, add a reference photo to a photo request or set your “With Me” photo, you pick it in the system photo picker; Callove receives only the photo you choose and does not otherwise read your photo library. It does not use your camera, microphone, contacts or location for AI conversation generation.

Operational notifications

Callove sends limited operational events to the operator’s Slack channel: a shortened Callove account identifier, platform (iOS or Android), deployment environment, age band, gender, built-in interest categories, character and relationship settings, product identifiers, event and error categories, counts and durations. Operational messages also include the connection country code and the text you submit through “Feedback to Callove” (up to 1,000 characters); reply email addresses and attached photos are not sent to Slack. This helps the operator investigate service and purchase outcomes. Ordinary operational events exclude names, exact birth dates, conversation and memory text, photo URLs, Apple identifiers and transaction identifiers. Feedback text may contain what you wrote in the submission. The connection country reflects the network connection, not nationality or residence, and we do not additionally store the original IP address for this purpose. The shortened identifier is pseudonymous, not a guarantee of anonymity. Operational messages are retained and deleted according to the Slack workspace retention settings, separately from account deletion. Short retries may occur after transmission failures, but delivery is not guaranteed.

Operator access

The operator can access stored information to operate the service and handle reports, support and disputes. The product policy also permits limited sample review for quality and safety. Diagnostic logs generally omit full conversation text, but reported excerpts and error details are exceptions.

Retention and deletion

The OS-derived hash stays on your device after logout or account deletion. The server keeps an active guest mapping while that account exists. On deletion, we remove signup device links from the account store. A separate admission store keeps the deleted account ID, restriction deadline, type and exception use for seven days from the last deletion, then removes them through expiry processing or the next request. This is separate from content and financial-record retention.
Content is retained while your account exists. Deleting a message, memory, character or photo destroys its content immediately; only a deletion marker (identifier and time) remains so your other devices can sync the deletion. No 30-day recovery is offered.
Deleting a character you created, or your account, removes its public card and the public copies of its images immediately. Copies other users already added and their trial conversations remain with those users and contain no information about you. Trial conversations that are not used for 30 days are deleted.
Deleting a generated photo queues deletion of its stored image. Failed cleanup is retried.
A reference photo or “With Me” photo added to a photo request is kept in server storage only while the photo is being made. It is deleted as soon as the request ends (completed, failed or deleted), and any file left behind is deleted automatically within one day. Your “With Me” photo itself stays only on your device (excluded from device backups); you can replace or delete it in the app’s settings, and it is removed from the device when you sign out or delete your account.
Requesting account deletion immediately ends sign-in and use of the service and removes sessions, push tokens and the Apple and Google sign-in links. In app versions released from October 18, 2026, the deletion screen’s default choice, “keep for 90 days, then delete permanently”, keeps your profile, conversations, memories, diaries and generated photos for 90 days from the request in a state that only the operator can access, for quality and safety review and for refunds, disputes and reports; after that they are permanently destroyed. During that period you cannot restore, view or sign in to the account. If you choose “delete permanently now”, or delete from an earlier app version, active account data and stored images are destroyed without delay. It attempts to revoke the Apple sign-in credential if an Apple account was linked; for Google, it removes the stored Google identifier, and there is no Google token to revoke because Callove never receives one. It does not wait for a 30-day grace period. Apple and Google Play purchase records are retained to prevent duplicate credits and restore eligible purchases. These records are kept for as long as needed for those purposes and for refunds and disputes, and for any period required by law (for example, Korean e-commerce law requires payment records to be kept for five years and complaint records for three years).
Free benefit codes: we store the code hash, campaign ID, granted benefits and redemption time with your account to deliver benefits and prevent duplicate grants. Raw codes are not sent to server logs or analytics. A separate grant register stores a hash derived from the code and user ID, together with the reserved benefits, and is deleted 90 days after the campaign ends or is disabled. This duplicate-prevention register remains for that period even if the account is deleted. Free benefits do not create a charge or an automatically renewing subscription.
Permanent deletion (immediately, or when the 90-day retention ends) also queues requests to delete the account’s Amplitude and RevenueCat data. Temporary delivery failures are retried. Amplitude describes a processing period of up to 30 days; accepting a request is different from completing deletion. Local unsent analytics are cleared, but in-flight requests may finish. Re-registering with the same Apple account while deletion is pending may cause newly received analytics to be included in that deletion. Retained purchase records on Callove’s server have the separate purpose described above.
Push tokens are kept while you receive notifications. They are removed when you sign out, turn notifications off, when Google reports the token is no longer valid, or when you delete your account.
Operational logs have a separate provider retention period. Cloudflare currently documents seven days for Workers Paid logs. Diagnostic records of failures (request ID, error code, block reason and outcome; no conversation text) are kept for quality review for 7 days from the time they are recorded, independent of account deletion. Reports in account storage and support email are separate from that log retention.
Deleting Callove from your phone does not delete the server account or cancel subscriptions. On iPhone, cancel in iOS Settings > Apple Account > Subscriptions. On Android, cancel in the Google Play app > Profile > Payments & subscriptions > Subscriptions.

Your controls and contact

You can review and edit memories, delete content using the available app controls, export account data and request account deletion in Settings. You can also unlink Apple or Google sign-in there while another sign-in method remains, and turn notifications off. For privacy or support requests, email haeundae96@gmail.com. Please do not email passwords, payment details or unnecessary sensitive information.

Callove is for users aged 15 or older. Do not use it if you do not meet that requirement.