uPlot Privacy Policy
Effective date: October 20, 2026
Last updated: October 20, 2026
This Privacy Policy explains how TOKENSPARK PTE. LTD. ("uPlot," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use the uPlot mobile applications, website at https://uplot.ai, and related services (together, the "Services").
uPlot is an AI-powered interactive story and character chat service. To generate replies, images, and voices, the Services process the content you submit with third-party artificial intelligence providers and on AI servers we operate, some of which are located outside the United States and Canada, including in mainland China. Sections 4 and 10 explain this in detail. Please read them before you use the Services.
By using the Services, you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not use the Services.
1. Who we are
The Services are operated by TOKENSPARK PTE. LTD., 144 Robinson Road, #12-01, Robinson Square, Singapore 068908. For privacy questions or requests, contact us at [email protected].
2. Information we collect
2.1 Information you provide
| Category | Examples |
|---|---|
| Account information | Email address, username, display name, avatar, bio, language, time zone, and (if you provide it) phone number. |
| Age information | Your date of birth, if you provide it. We use this to confirm that you are eligible to use the Services. |
| Sign-in information | If you sign in with Apple or Google, we receive a unique account identifier and, depending on your settings with that provider, your email address and name. We never receive your Apple or Google password. If you sign in with email, we process the one-time verification code we send you. |
| User Content | Messages you send to AI characters, story choices, prompts, characters, personas, and world-building entries you create, images you upload, comments you post, and other content you submit. |
| Social activity | Accounts you follow, your followers, your likes, your reading and play history, and reports you file. |
| Voice input | If you use voice input, your audio recording is converted to text. We do not store the audio recording; only the resulting text becomes part of your conversation. |
| Purchase information | The products you buy, the price, date, and transaction identifiers, and your Credit balance and usage history. Payments are processed by Apple, Google, or Stripe. We do not receive or store your full payment card number. If you turn on Auto-Reload on our website, Stripe securely stores your payment method and we keep only a Stripe customer and payment-method reference, the card brand and last four digits, and your Auto-Reload settings and charge history. |
| Communications and reports | Messages you send to our support team, feedback, survey responses, and reports you file about content or other users. |
2.2 Information collected automatically
- Device and app information: device model, operating system, app version, language, and device or installation identifiers.
- Log and usage information: IP address, dates and times of access, features used, screens viewed, the AI model used for a reply, token counts, error codes, and crash diagnostics.
- Approximate location: we infer your general region (such as country or state) from your IP address. We do not collect precise GPS location.
- Cookies and similar technologies (website only): we use strictly necessary cookies and local storage to keep you signed in and to secure the website. We also use Google Analytics 4 to understand how the website is used (pages viewed, searches, content opened, approximate region, device and browser type). Google Analytics sets its own cookies and receives your IP address. We turn off Google signals and advertising personalization, and we do not use this data for advertising. You can opt out with the Google Analytics opt-out browser add-on. Our mobile apps do not currently include third-party analytics or advertising SDKs.
2.3 Information from third parties
- Sign-in providers (Apple, Google): as described above.
- App stores and payment processors (Apple, Google, Stripe): purchase confirmations, refund and chargeback notifications, and, for Auto-Reload, payment status.
2.4 Information we do not want
Please do not include sensitive personal information about yourself or anyone else in your chats, characters, or uploads — for example government ID numbers, financial account numbers, health records, or precise addresses. The Services are for fiction and entertainment and do not need this information.
3. How we use information
We use personal information to:
- Provide the Services — create and secure your account, generate AI replies, images, and voices, save your conversation history and story memory, and sync your content across devices.
- Process purchases — deliver Credits, run Auto-Reload if you turn it on, keep transaction records, and prevent fraudulent purchases.
- Keep the Services safe — detect, review, and act on content or conduct that violates our Terms of Service or Content Policy, respond to user reports, prevent abuse, and protect younger users. This includes automated filtering and, where needed, human review of reported or flagged content.
- Support you — respond to your requests and send service messages such as verification codes, receipts, security alerts, and notices of policy changes.
- Maintain and improve the Services — debug, measure performance, understand which features are used, and develop new features, using aggregated or de-identified information where practical.
- Comply with law — meet legal obligations, enforce our agreements, and establish or defend legal claims.
Model training. We do not use the content of your private conversations to train our own generative AI models. We may use de-identified, aggregated data (for example, how often a feature is used or the rate of flagged replies) to evaluate and improve quality and safety.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects.
4. AI processing and third-party AI providers
To produce AI output, we must process the content you submit with third-party AI service providers and on AI servers we operate. This is essential to how the Services work. We ask for your consent in the app before your first AI interaction, and you can withdraw consent at any time by ceasing to use AI features or deleting your account.
| What is sent | Why | Who receives it |
|---|---|---|
| The text of your messages and prompts, together with the relevant conversation history, character definition, and story context | To generate text replies and story content, and to write prompts for image generation | OpenRouter, Inc. (United States), which routes each request to a large language model provider — currently principally DeepSeek and Google — and, if the primary provider is unavailable, to another provider hosting the same model |
| Image prompts, and reference images you upload | To generate images and to understand images you upload | AI servers operated by us, located in mainland China |
| Text to be spoken | To generate voice audio | AI servers operated by us, located in mainland China |
| Your voice recording | To convert speech to text | AI servers operated by us, located in mainland China; the audio is not stored after transcription |
What we do not send. We do not send AI providers your email address, phone number, password, payment information, or account identifiers as part of these requests. However, anything you type, say, or upload is sent as-is — so if you include personal information in your content, the providers will receive it.
How providers handle the data. Third-party providers process this content to return a result to us and handle it under their own data policies, which may include temporary retention for abuse monitoring and legal compliance. The list of providers may change as we improve the Services; we will update this section and, where a change is material, ask for your consent again.
5. How we disclose information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only as follows:
- Service providers that work on our behalf under contractual confidentiality and data-protection obligations: AI providers (Section 4); cloud hosting and database providers; Cloudflare, Inc. (file storage and content delivery); email delivery providers; customer-support tools; and Google LLC (Google Analytics, website only).
- Payment and distribution partners: Apple Inc., Google LLC, and Stripe, Inc., which process payments as independent businesses under their own privacy policies.
- Other users and the public: your profile (username, display name, avatar, bio), the characters and stories you publish, the comments you post, and your public follower and following lists are visible to other users and, on the website, to the public and to search engines. Your private conversations with AI characters are never visible to other users.
- Legal and safety: when we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of our users, the public, or us. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and other appropriate authorities as required by law.
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
- With your consent or at your direction.
6. How long we keep information
| Information | Retention |
|---|---|
| Account information and User Content | For as long as your account is active. When you request account deletion, the account is deactivated immediately and enters a 30-day restoration period during which you can change your mind. After that period ends, we permanently delete or de-identify the data within 30 days, and it is removed from backups within 90 days. |
| Individual conversations or characters you delete | Removed from active systems promptly and from backups within 90 days. |
| Purchase and transaction records | Up to 7 years, as required for tax, accounting, and fraud-prevention purposes. |
| Server logs and diagnostics | Up to 14 days. |
| Records of policy violations, reports, and enforcement actions (including content preserved for legal or child-safety reporting) | As long as necessary to protect the safety of the Services and comply with legal obligations. |
7. Your choices and rights
7.1 Choices available to everyone
- Access and edit your profile information in the app settings.
- Delete individual conversations, characters, or uploads in the app.
- Delete your account at any time in the app under Profile → Settings → Danger zone → Delete account, or through the same settings on our website. See https://uplot.ai/legal/delete for instructions.
- Device permissions: you can turn microphone, photo, and notification permissions on or off in your device settings.
- Emails: we send only transactional and service emails. If we ever send marketing emails, each will include an unsubscribe link.
7.2 U.S. state privacy rights
Depending on where you live (including California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states with comprehensive privacy laws), you may have the right to:
- know and access the personal information we hold about you, and receive a portable copy;
- correct inaccurate personal information;
- delete personal information;
- opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and certain profiling — we do not engage in any of these activities;
- limit the use of sensitive personal information — we use sensitive information (such as account login credentials and the contents of your conversations) only to provide the Services and for other purposes permitted by law;
- not be discriminated against for exercising your rights; and
- appeal if we decline your request.
How to exercise your rights. Email [email protected] from the address associated with your account, or use the in-app controls described above. We will verify your request by confirming control of your account email. You may use an authorized agent; we may ask for proof of the agent's authority and verify your identity directly. We respond within 45 days (extendable once by 45 days where permitted). To appeal a decision, reply to our response with the subject "Privacy Appeal"; if your appeal is denied, you may contact your state attorney general.
California notice at collection. In the past 12 months we have collected the following categories of personal information, for the purposes in Section 3, from the sources in Section 2, and disclosed them to the categories of recipients in Section 5:
| Category (Cal. Civ. Code § 1798.140) | Collected | Sold or shared |
|---|---|---|
| Identifiers (email, username, IP address, device identifiers, account IDs) | Yes | No |
| Customer records (phone number, if provided) | Yes | No |
| Characteristics protected by law (age / date of birth) | Yes | No |
| Commercial information (purchases, Credit balance) | Yes | No |
| Internet or network activity (usage and log data) | Yes | No |
| Geolocation data (approximate, from IP address) | Yes | No |
| Audio, electronic, or visual information (voice input, uploaded images) | Yes | No |
| Sensitive personal information (account login; contents of messages you send through the Services) | Yes | No |
| Inferences | No | No |
We do not sell or share the personal information of any user, including users under 16. California's "Shine the Light" law: we do not disclose personal information to third parties for their direct marketing purposes.
7.3 Canada
If you are in Canada, you have the right to access and correct your personal information and to withdraw consent, subject to legal and contractual restrictions. Your information may be processed and stored outside Canada (including in the United States, Singapore, and mainland China), where it may be accessible to courts, law enforcement, and national security authorities of that jurisdiction. Contact our privacy officer at [email protected].
8. Children and minors
The Services are open to users of all ages and do not offer adults-only content. Users under 18 may use the Services only with the permission of a parent or legal guardian. For a child under 13 (or under the minimum age at which a person can consent to online services in their country, if higher), a parent or legal guardian must set up the account. If we learn that we hold personal information from such a child without a parent's or guardian's consent, we will delete it. Parents and guardians can ask us to review or delete their child's information at [email protected].
9. Security
We use technical and organizational measures designed to protect personal information, including encryption (TLS) for connections between your device and our Services, hashed credentials, access controls, and restricted employee access on a need-to-know basis. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by law.
10. International transfers
uPlot is operated by a company based in Singapore. We and our service providers process and store information in several countries, including the United States (for example, OpenRouter and Cloudflare), Singapore, and mainland China, where the AI servers that generate images and voice and transcribe speech are located (Section 4). When you use the Services from the United States or Canada, your information is transferred to and processed in these countries, whose data-protection laws may differ from those where you live and whose authorities may be able to request access to it under local law. We take the measures described in Section 9 to protect it.
11. Third-party services
The Services may link to third-party websites or services, and you may sign in or pay through third parties such as Apple, Google, and Stripe. Their handling of your information is governed by their own privacy policies, not this one.
12. Do Not Track and Global Privacy Control
We do not sell personal information or share it for cross-context behavioral advertising, and we do not track you across third-party websites or apps for advertising. Because there is nothing to opt out of, our website does not currently change its behavior in response to Do Not Track or Global Privacy Control signals. If that ever changes, we will honor Global Privacy Control signals as a valid opt-out request.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the app or by email before the changes take effect and, where required by law, ask for your consent. The "Last updated" date at the top shows when this policy was last revised.
14. Contact us
TOKENSPARK PTE. LTD. 144 Robinson Road, #12-01, Robinson Square, Singapore 068908 Privacy: [email protected] Support: [email protected]