Gemnd Privacy Policy

Effective date: 2026-12-15

Version: 2026-11-07.1

Last updated: 2026-11-08

This policy explains what personal information Gemnd collects, why, who processes it, how long we keep it, and the choices and rights you have. It is written to be read in full. If you only have a minute, start with the short version.

The short version

• Gemnd is an AI companion app for adults. Your companions are artificial intelligence, not people. To reply to you, speak, remember you and create how your companion looks, we have to process what you write and say. Our servers can read your messages, so Gemnd is not end-to-end encrypted.
• Your conversations are personal, and we treat them that way. What you tell a companion can reveal your health, your sex life, your sexuality, your beliefs or other sensitive things. We use that information only to provide Gemnd to you, keep it safe and meet our legal duties.
• We don't sell your personal information, share it for advertising, or show you ads. Gemnd contains no advertising or analytics tools and doesn't track you across other apps or websites.
• We don't use your personal information to train AI models. The AI providers that write your companion's replies are set up so they don't keep your conversations or train on them.
• Before your first conversation, the app names the AI providers that write, check, voice and illustrate your companion, and asks your permission. It asks separately before it collects health information you share. You can withdraw either permission at any time.
• We confirm that you're an adult. We use your app store's age signal, or, if there isn't one, a selfie age check by our provider Didit, with your consent. Didit deletes the selfie and tells us only whether you passed.
• You're in control in the app. You can read, correct or forget what your companion remembers, download a copy of your data, sign out other devices and delete your account, all from inside the app.
• Deletion is real. When you delete your account, we start erasing your data immediately. We keep limited payment records and a record that the account was deleted, linked to a random account number and not to your email address or your conversations. If you sent an arbitration opt-out or written notice of dispute, we keep that notice and the Terms version it relates to for the period below. If you wrote to us with a privacy request, we keep that request and our answer for 24 months, as the law requires. For 6 years we keep a record of which of our terms and policies you agreed to, the notices we showed you and the consents you gave, without your email address or your conversations. Backup copies age out on a fixed schedule, described below.
• Gemnd is only for adults 18 and older.
• If you're in crisis, Gemnd shows crisis resources, including the 988 Suicide & Crisis Lifeline. Gemnd's crisis feature never calls, messages or alerts emergency services, crisis lines or anyone else about you.

Contents

• Who we are and how to reach us
• What this policy covers
• Finding this policy and your privacy controls in the app
• Information we collect
• How we use information
• Sensitive personal information
• How AI processes your information
• Safety, moderation and crisis resources
• Age checks and biometric information
• How we disclose information
• No sale, no sharing, no targeted advertising
• How long we keep information
• Downloading and deleting your data
• Your privacy rights
• Notice at collection
• Consumer health data
• Adults only
• How we protect your information
• Cookies and similar technologies
• Where we process information
• Changes to this policy
• Contact us

Who we are and how to reach us

Gemnd is provided by GemndAI LLC, a New York limited liability company, doing business as "Gemnd" ("Gemnd", "we", "us" or "our"). We decide how and why your personal information is processed, so we are responsible for it.

• Privacy questions, requests and appeals: privacy@gemnd.ai, or in the app at Settings → Help and reports → Contact support
• Help with the app: support@gemnd.ai, or in the app at Settings → Help and reports → Contact support
• Legal notices and requests from authorities: legal@gemnd.ai
• Mail: GemndAI LLC, 160 East Sunrise Highway #1016, Freeport, NY 11520, United States
• Website: https://gemnd.ai

We read and answer the privacy inbox. You don't need an account to write to us.

What this policy covers

This policy covers personal information we collect through:

• the Gemnd app for iPhone;
• our website, https://gemnd.ai, including the pages where we publish this policy, our Consumer Health Data Privacy Policy, our Terms of Use, our subprocessor list and our safety protocol;
• emails we send you and messages you send us.

"Personal information" means information that identifies you or can reasonably be linked to you, directly or indirectly. It includes information we infer about you.

This policy doesn't cover:

• Apple. When you subscribe or buy a Usage reset, Apple processes your payment under its own terms and privacy policy. Apple doesn't share your card details with us.
• Websites we link to, such as the 988 Suicide & Crisis Lifeline. Their own privacy policies apply.

Our Terms of Use explain the rules for using Gemnd. This policy is a notice about your information: you don't have to agree to it for it to describe what we do. When you create an account, the app asks you to confirm that you've read it. After a material change, the app shows you a short notice about it. We record which version you saw and your answer. Confirming that you've read this policy is not consent to anything in it. The permissions we ask for, such as AI processing, are separate (see Sensitive personal information).

Finding this policy and your privacy controls in the app

Everything in this policy is available inside the app, before and after you create an account. The legal pages open from the Create account screen, from the Terms and privacy screen shown before your first conversation, and from Settings → Your data and devices. The AI processing screen links the subprocessor list. The legal pages work with VoiceOver and larger text sizes, and they work without an internet connection.

The app includes a copy of this policy so you can read it offline: the version that was current when your version of the app was released. Each copy shows its version and date. The current version is always on our website at https://gemnd.ai/legal/privacy. When a material change takes effect, the app shows a short notice with what changed and a link to the full text, whatever version of the app you have.

When we make a material change to this policy or our Terms of Use, we email you first and the app shows a short notice that never stops you from using Gemnd (see Changes to this policy). Confirming that you've read this policy is not consent to anything in it. The permissions we ask for, such as AI processing and health information, are separate.

Information we collect

We collect only what we need to run Gemnd. Most of it comes from you. Some is created as you use the app, and a little comes from Apple. The Notice at collection lists the same information by the categories California law uses.

Information you give us

• Account details. Your email address and password. We store your password only in a scrambled form that can't be turned back into the password (a bcrypt hash). If you choose, a display name. The app signs you in with your email address and password only.
• Your age check. Before you can use a companion, you confirm that you're 18 or older, and we check it with your app store's age signal or a selfie age check (see Age checks and biometric information). We record that your age was confirmed, how, when, and which version of our first-use disclosure you saw. We don't ask for your date of birth, and we don't keep your age range or your selfie.
• What you tell your companions. Every message you type, everything you dictate or say in a call once it has been turned into text, and the replies your companion gives you. This is the heart of Gemnd, and it can include anything you choose to share.
• Profile details. A nickname, a description of yourself or your occupation, if you or your companion add them, so your companion can address and know you.
• Your companions. Each companion's name, character, personas, look, voice and expressions, the boundaries you set and how it supports you on a hard day, the story themes you choose, and earlier versions of these settings. When you ask a companion in conversation to change its character, we keep the change together with a short quote from your request (up to 512 bytes) so you can review what changed and why.
• Look and selfie requests. The description you write for a custom look, and the line you write when you ask for a selfie (up to 280 characters).
• Reports and support messages. The reason you choose and any note you add when you report a reply or an avatar, and emails you send us.
• Your choices. Whether you allowed AI processing and the collection of health information, and each time you changed them; your consent to a selfie age check, if you took one; your acceptance of each version of our Terms of Use, your confirmation that you've read each version of this policy, the notices of changes we showed you and your answers; your acknowledgment of how Usage works; and your Memory, voice-recording, suggestions and other settings.

Information created as you use Gemnd

• Memories and summaries. As you talk, our AI forms memories from your conversations: facts, preferences, feelings, relationships and moments you share, and a running description of you that your companion draws on. It also writes summaries of longer conversations and titles for them. To find the right memory at the right time, we compute search data (numerical "embeddings") from memory text on our own servers. These memories and summaries are inferences about you. You can see and control your memories in Memory. Conversation summaries and search data aren't shown there. Summaries are included when you download your data. Search data, which can be rebuilt from your memories, is not, but you can ask us for it. Both are deleted with your account, or sooner if you ask us.
• Generated media. The images and videos we generate for your companion's look, expressions and selfies. They show your fictional companion, never you.
• Call records. When a call started and ended, how it ended, whether your speech was recognized on your iPhone or by our speech provider, and the language setting. We don't record calls.
• Safety records. For each safety check, what was checked (for example, your message, a companion's character or a look or selfie request), the outcome (allowed, supported, declined or unavailable), the reason category, and a one-way fingerprint (a hash) of everything the check looked at, never the content itself. When your companion turns down a request, we record which of our rules applied and the kind of request, described in our own words from a fixed list, never your words, so your companion stays consistent and doesn't bring it up again. When a message leads us to show crisis resources, that fact is saved with the reply. We also record when we last reminded you in each conversation that your companion is an AI. Each time a look or selfie request is refused or a whole round of generated images is withheld, we record it, together with any pause or review lock that follows.
• Suggestions about life outside the app. When your companion suggests a small real-world step, such as messaging a friend, we record that it did and when, without the text, so suggestions stay spaced out.
• Usage and purchase records. Your plan; the records Apple sends us when you subscribe, renew, cancel, buy a Usage reset or get a refund; for each reset you buy, its plan and price, when you bought and used it, and whether Apple refunded it; and a ledger of how much of your weekly Usage each action used, including which AI model and provider handled it and how many units of text it processed.
• Sign-in and security records. For each signed-in device, the IP address and the type of device and app version it reported (its "user agent") when it signed in, when it signed in and when it was last used. We keep one-way hashes of sign-in and refresh tokens and of one-time codes, never the codes themselves. To slow down attacks, we briefly count sign-in attempts against a keyed hash of your IP address or email address.
• Logs and diagnostics. Like most online services, our servers record each request they receive, including the IP address, device description and the address requested. Our services record operational events and errors with identifiers replaced by keyed hashes, and they are built to leave out email addresses, IP addresses, message text and request bodies. If the app crashes, freezes or hits an unexpected error, it sends a diagnostic report about your device model, operating system and app version, with no conversation content and no account information. Errors on our servers are reported with a keyed hash of your account number, which we could link back to your account, but never with message content. When an error on our servers involves your content, its complete details, which can quote your messages, memories or companion text, are encrypted with the key unique to you before they are stored. We keep them for 14 days in a restricted log. Only our servers, using the key unique to you, can decrypt them, and they become unreadable as soon as your account is deleted.
• Your time zone. The app shares your device's time zone so your companion knows what time it is for you. This doesn't use location services.
• Notification device token. If you allow notifications for Gemnd in iOS, we keep the address Apple gives your iPhone for notifications (a "device token"), whether it is a development or production address, and which of your signed-in devices it belongs to. We use it only to tell that iPhone that something you asked for (previews, an avatar, new poses, an expression or a selfie) is ready or couldn't be made. We also keep a short record of each notification: which request it was about, whether it was sent, and when. That record never holds the notification's text or your request.

Information from other companies

• Apple sends us signed records of your subscription purchases, renewals, cancellations and refunds, and of each Usage reset you buy and any refund of it. To link a purchase to your Gemnd account, we give Apple a random number we generate for your account. It contains no name, email address or payment details, but it is linked to your Gemnd account, so we treat it as personal information.
• Your app store's age signal. If your device or app store can share an age range with apps (on iPhone, Apple's Declared Age Range) and you allow it, it tells us an age range. We use it only to confirm that you're 18 or older and keep only that result.
• Didit, our age-check provider, tells us whether a selfie age check confirmed that you're 18 or older and that the selfie was of a live person. It doesn't send us the selfie or your estimated age.

Information kept only on your iPhone

• Your sign-in. The secret that keeps you signed in is stored in the iOS Keychain, on that device only and excluded from device backups.
• Small pieces of app state in the Keychain, such as which conversation you had open, a purchase or a memory change that hasn't finished, and a report you haven't finished sending. If you delete the app without signing out, iOS may keep Keychain items on the device; signing out first removes your sign-in.
• Saved voice recordings, if you turn on "Save recordings on this device": recordings of your companion's spoken replies, so you can replay them without using Usage. They are encrypted with a key held in the Keychain, excluded from device backups, limited to 250 MB, and deleted after 30 days, when you sign out or switch accounts, or when you delete your account.
• A small cache (up to 4 MB) of your companion's short animation clips, cleared when you sign out.
• Downloads of your data are saved only to the folder you choose in the Files app. We don't keep a copy.

What we don't collect

• precise location, and we never use your IP address to work out where you are;
• photos or videos of you, apart from the selfie for an age check, which our provider Didit takes with your consent and deletes, and which we never receive. Gemnd has no access to your photo library and uses the camera only for that check;
• stored recordings of your voice: when your iPhone can't recognize speech itself, your audio streams through our servers to our speech provider only while you speak, and neither we nor it keeps the audio (see Voice);
• voiceprints, or faceprints used to identify you. The face measurements Didit makes from an age-check selfie are used only to estimate your age, are never sent to us, and are deleted (see Age checks and biometric information);
• your contacts;
• your date of birth or government ID;
• advertising identifiers or any device identifier beyond your device description;
• payment card details: Apple handles payment.

How we use information

We use personal information only for the purposes below, each tied to the information it needs. We don't use it for any other purpose without telling you first and, where the law requires, asking your consent.

We send email only about your account: verification and sign-in codes, password-reset codes, account-deletion codes and confirmations, and notices the law requires. We don't send marketing email. The only notifications Gemnd sends are the ones you allow in iOS, telling you that something you asked for is ready or couldn't be made, and you can turn them off at any time in iOS Settings.

We don't read or analyze your conversations for product research, advertising or marketing.

Sensitive personal information

What it is. Several state laws treat some information as "sensitive". For Gemnd that can include:

• information about your physical or mental health, including sexual and reproductive health;
• your sex life, sexual orientation, or status as transgender or nonbinary;
• your racial or ethnic origin, national origin, religious or philosophical beliefs, citizenship or immigration status, union membership, or experience as a victim of crime;
• the contents of your messages;
• your account email together with your password.

How it gets to us. Apart from your sign-in details, we don't require any of it. Companions are made for personal conversation: they may ask how you feel or about your life, and you can ask them general health questions. Sensitive information reaches us when you share it in conversation. It also reaches us through choices you make about your companion, such as your boundaries, how it supports you on a hard day, or what a selfie should show, which can reveal information about your health. Memory can then turn what you shared into a stored fact so your companion remembers it. The selfie for an age check is biometric information, which only Didit processes (see Age checks and biometric information).

How we use it. We collect and use sensitive information only as strictly necessary to provide the companion experience you ask for. That means:

• writing your companion's replies;
• keeping your conversation history;
• remembering what you share;
• keeping you and others safe, including showing crisis resources;
• protecting the security and integrity of the service;
• meeting our legal obligations.

We don't use it to infer characteristics about you for any other purpose. We don't use it for advertising, marketing, pricing or model training. We never sell it.

Your consent and control.

• Before your first conversation, the app asks for your permission on the AI processing screen, separate from our Terms of Use. The screen names the AI providers that write, check, voice and illustrate your companion, what each does and where it processes data. You allow processing by tapping Allow.
• The app then asks, on its own screen, for your consent to collect and use health information you share, as our Consumer Health Data Privacy Policy describes. You give it by tapping Allow. It is never part of another choice.
• Nothing you write or say is sent to those providers, and no memory forms, unless you allow both. If you don't, you can still use Settings, download your data and delete your account.
• We never treat accepting our Terms of Use or confirming that you've read this policy as consent to process sensitive information.
• You can withdraw either permission at any time in Settings → AI processing. Withdrawing is as easy as giving it, and it takes effect right away.
• You decide what to share, and you can forget any memory, or turn off Remember new conversations, at any time.

Some states have specific rules for health information. See Consumer health data.

How AI processes your information

The models behind your companion

Your companion's replies, conversation summaries and memories are written by DeepSeek V4.1 Flash, an openly published AI model developed by DeepSeek. The model runs on servers of Together AI in the United States; we never use DeepSeek's own service, and none of your data is sent to DeepSeek or processed in China. Our requests reach Together AI through OpenRouter, a routing service.

• What they receive: what your companion needs to reply. That is its character and persona, the memories relevant to the moment, recent conversation, your latest message, and the name and details your companion knows you by.
• Zero data retention. We send these text requests only to endpoints that OpenRouter lists as zero data retention, and our requests forbid data collection. OpenRouter and Together AI don't keep your prompts or replies after the request is answered and don't train models on them. DeepSeek receives none of your data. This text-route policy is not a zero-retention claim for image or video generation.

Other AI providers

TypeSafe (Jev 1.13), through OpenRouter

• What it does: checks text against our content and safety rules.
• What it receives: your message with the reply before it and your latest few messages, companion character text, and look, expression and selfie requests. It never receives your companion's replies, images or videos.
• How it treats your data: these requests go only to zero-data-retention routes through OpenRouter, with data collection denied. It doesn't train on your data and receives no user identifier.

Deepgram

• What it does: turns your speech into text when your iPhone can't, and speaks your companion's replies.
• What it receives: your voice while you speak, only when your iPhone can't recognize speech itself, and reply text to be spoken.
• How it treats your data: we opt out of its model-improvement program on every request, so it keeps audio and text only while processing them and doesn't train on them.

fal (Features & Labels, Inc.)

• What it does: Avatar, expression and selfie image and video generation. It runs the three models below for us: OpenAI's GPT Image 2.6 for pictures, MiniMax's H3 for animations and video selfies, and Topaz Labs' Apollo to smooth each animation to 30 frames a second.
• What it receives: the look or selfie request text and your companion's reference portrait; for an animation, that portrait as its first and last frame; and the images and videos the models make. None of it is a picture of you.
• Who else receives it: fal marks each of these models as a partner model, which it describes as hosted by its partners, and its terms say that a request for a model reached through a partner's API goes to that partner. The three providers below are listed for that reason.
• How it treats your data: fal's terms with us forbid it to use our requests to train or develop its products or services, for every model we use. Every request we send asks fal not to keep the request or its results in its request history, and to delete the files it makes one hour after making them; until then, anyone who has a file's web address can fetch it. fal still keeps a record of each request without its content, such as when it ran and what it cost, and the model providers below keep their own copies, so this route is not zero-data-retention. We copy delivered files to our private storage at once.
• Where it processes it: United States and other countries.

OpenAI

• What it does: Avatar, expression and selfie images, with GPT Image through fal.
• What it receives: through fal, the picture request text and your companion's reference portrait.
• How it treats your data: OpenAI states that it doesn't train on data sent to its API unless the customer opts in, and keeps API inputs and outputs for up to 30 days to detect abuse.
• Where it processes it: United States and other countries.

MiniMax (Nanonoble Pte. Ltd.)

• What it does: Avatar poses, expressions and video selfies, with MiniMax H3 through fal.
• What it receives: through fal, your companion's portrait or selfie still and the animation request text.
• How it treats your data: fal also describes H3's openly published model, and doesn't say whether our H3 requests go to MiniMax or run on fal's own servers. MiniMax's API terms let it use requests and generated content to develop and improve its services, and give no retention period.
• Where it processes it: United States (stored there; operated from Singapore).

Topaz Labs

• What it does: Smoothing generated video to 30 frames a second, through fal.
• What it receives: through fal, the finished animation only.
• How it treats your data: Topaz Labs states that it never trains on customer inputs or outputs and deletes media after 7 days.
• Where it processes it: United States.

None of fal, OpenAI, MiniMax or Topaz Labs commits to a region for our requests: each place above is where the company says it processes data. A provider's headquarters, a regional endpoint name or a no-training setting does not establish where a request is processed.

Serper

• What it does: web search when your companion looks something up during a conversation.
• What it receives: the search query your companion writes, which can reflect your conversation, and web addresses it reads.
• How it treats your data: receives no user identifier. Its public policy doesn't say how long it keeps queries or whether it uses them to improve its services.

Our age-check provider, Didit, is described under Age checks and biometric information. Every provider in this section is listed, with its location, on our subprocessor list. The AI processing screen in the app lists the AI providers that write, check, voice and illustrate your companion, with what each does, before you allow processing, and links the full subprocessor list. If the AI providers listed on the AI processing screen change, the app asks you again before any new one receives your data.

We don't train AI on your data

We don't collect, use or sell your personal information to train, fine-tune or improve large language models or any other AI model, and we don't build training datasets from your conversations, memories, voice or images.

Memory

Memory is how your companion remembers you, and it is shared by all your companions.

• How memories form. After you talk, our AI reads the conversation and saves facts, preferences, feelings, relationships and moments worth remembering. It also keeps a running description of you. You can also ask your companion to remember or correct something.
• What you can do, in Menu (≡) → Memory:
  • see every memory and where it came from;
  • edit its wording yourself, for free, or ask your companion to correct it, which uses Usage;
  • mark it "Don't use this";
  • forget it, which removes it together with its earlier versions;
  • forget all saved memories at once. They stop being used right away and are removed as cleanup finishes. Earlier versions that Memory keeps for your review may still appear there, and your conversations stay in your history.
• Remember new conversations, the switch in Memory, stops new messages from becoming memories. It doesn't delete existing memories.
• Automatic tidying.
  • Once a moment from an older conversation has been folded into longer-term memory, its detailed record is deleted after 180 days.
  • Suggested connections between memories that were never confirmed are deleted after 90 days.
  • People and topics noted only as possible memories are deleted if they haven't come up for 12 months.
  • Other people and topics, apart from you, are archived if they haven't come up for 12 months.
• Where it runs. Memories are formed by the same AI model and providers as your companion's replies. The search data that helps your companion find the right memory is computed on our own servers, not by an outside provider.
• Not used for decisions about you. We use memory only for your own conversations with your own companions. We never use it to make decisions about you that have legal or similarly significant effects, such as decisions about credit, housing, employment, insurance, education or health care.

Voice: dictation, calls and read-aloud

• On your iPhone first. When your iPhone has an on-device speech model for your language, your speech is turned into text on the phone, and only the text reaches us.
• Our speech provider only when needed. If your iPhone can't recognize speech itself, for example because the speech model is missing or still downloading or your language isn't supported, your audio is streamed over an encrypted connection to our servers and on to Deepgram, which turns it into text.
• Calls. During a call, our call-media provider carries your companion's voice to you and, when your iPhone can't recognize speech itself, your voice to our servers.
• No recordings. We never store recordings of your voice. What you say becomes text and is kept as part of your conversation. In a call, each thing you say is held as encrypted text for at most 60 seconds while it becomes a message.
• Your companion's voice is generated by Deepgram from the reply text.
• No voice identification. We don't create voiceprints, don't analyze your voice for emotion, and never use your voice to identify you.

Avatars and selfies

• Never from images of you. Gemnd never asks for a photo or video of you. Looks and selfies are made from text and your companion's own reference portrait, never from images of you or any real person.
• Checked before and after they're made.
  • What you write for a look, an expression or a selfie is checked against our content rules before anything is generated.
  • Every request for a picture that we send to fal ends with fixed rules: the character is an original, invented adult, 20 or older, or a friendly invented creature; dressed in everyday clothes the way people dress in public for the setting, even at a beach or a pool; in a natural, friendly pose and expression; and the scene stays non-graphic. Every animation starts from one of those pictures.
  • We don't check the images and videos fal returns ourselves: fal's safety checker and each model's own moderation withhold what they flag, and a withheld image or video is never shown. If a selfie or look breaks our content rules anyway, you can report it.
  • Selfie videos are delivered without sound.
• Kept privately. We store generated media privately with Cloudflare and show it only to you, through your signed-in account. fal and the model providers it runs keep their own copies for the periods described under Other AI providers. No-training requirements do not mean no retention.
• Yours to download. It is included, as image and video files, when you download your data, and it is erased from our storage when you delete your account.

When a person sees your content

We don't look at your conversations to run Gemnd. A person on our team sees conversation content only when:

• you report a reply, selfie or avatar (they see the reported content and your note);
• you send it to us yourself, for example in a support email;
• we need to investigate a security incident or a serious safety or legal matter;
• the law requires it.

Access is limited to people who need it for that task.

Safety, moderation and crisis resources

Gemnd is a companion app, not a health care, therapy, counseling or crisis service. No companion is a therapist, counselor or doctor, and companions can't diagnose or treat anything. You can ask general health questions, as with any AI: your companion gives general information, says when to see a doctor, tells you to get urgent care when you describe warning signs, and never tells you to start, stop or change a medicine.

Our full safety protocol is published on our website at https://gemnd.ai/legal/safety and in the app at Settings → Your data and devices → Safety.

• Content checks. Gemnd is for companionship, conversation and creative stories, under one set of content rules on every device, set to the standard of Google Play's Developer Program Policies: no romance between you and your companion, nothing sexual, no suggestive images, no profanity from companions, and no hate, harassment, graphic violence or real-world harm. We automatically check:

  • your messages and call transcripts, before your companion replies, for a few hard lines: thoughts of suicide or self-harm, anything sexual involving minors, signs that you are under 18, sexual or romantic requests, real people, and instructions for serious harm;
  • companion character settings;
  • look, expression and selfie requests, before anything is generated.

  Your companion's replies are not checked before you see or hear them: companions follow our content rules through their instructions. We don't check the images and videos we generate ourselves; fal's safety checker and each model's own moderation apply, as described under Avatars and selfies.

  Within those rules, companions go along with your story and don't lecture. When your companion won't do something, it tells you in its own words. These checks are automated, and Gemnd pays for them: they never use your Usage. We store only the outcome, a reason category and a one-way fingerprint of the checked content, as described above, and our logs record the checks' scores as numbers only. Image generation, including looks and selfies, pauses for 30 days after three of the following within 30 days: a look description, selfie request, expression or companion character refused because it describes or implies someone under 18; a sexual description of an animal or creature look; or a round of look previews in which fal's safety checker or the model's own moderation withholds every image. A round lost to a technical problem, or a selfie or expression withheld that way, never counts. A request that appears to sexualize a minor pauses image generation until our team reviews it.

• Crisis resources. We automatically check your messages and call transcripts for signs that you may be thinking about suicide or self-harm, may have an eating disorder, or may really harm someone else, including when you say it in other words or in character during a role-play. Violence in fiction, with no sign of a real plan, never triggers crisis resources.

  • When we see those signs, the app shows crisis resources, including the 988 Suicide & Crisis Lifeline, with your companion's reply, including when our safety model is unavailable, because a fixed list of crisis phrases is checked on our own servers. In a call, your companion says them first.
  • We note on the reply that resources were shown, and we log that a crisis response happened without logging what you said.
  • Neither your companion nor Gemnd ever contacts emergency services, crisis lines or anyone else about you.
  • Counting referrals. Some state laws require us to report how often we showed crisis resources. We report only a total, with no name, account number, message content, IP address or location, to the state agencies that require it, such as the California Office of Suicide Prevention, which publishes the totals.

• AI reminders. The app tells you that your companion is an AI, not a person, with your companion's first reply each day and in each interaction, at least every three hours while an interaction continues, and whenever you sincerely ask whether you are talking to a person or an AI, in chat and in calls. In a call, the reminder appears as a caption on the call screen. An interaction begins with your first message after 30 minutes without one. We record when we last showed the reminder in each conversation so the next one comes on time.

• Minors. A message that says or strongly suggests the writer is under 18 is refused, and we may ask the account holder to confirm their age again. If an account's holder tells us they are under 18, or a person on our team concludes after review that an account belongs to someone under 18, we close the account: it can no longer be used, and we delete its data 30 days later. If we made a mistake, tell us within those 30 days and we reopen it.

• Reports. A report sends the reported reply or avatar and your note to our review queue, encrypted. Our support inbox is told only that a report arrived, with its reference, reason and time, never its content. A person reviews every report within 24 hours, and you can follow it in Settings → Help and reports. A report is kept until it is reviewed and deleted 30 days after the review, unless the law requires us to keep it longer.

Age checks and biometric information

Gemnd is only for adults, so we confirm once, before your first conversation, that you are 18 or older. This section is our written policy for the biometric information that check can involve, including the retention schedule and destruction rules that Illinois, Texas, Washington, Colorado and other states require.

• Your app store's age signal first. If your device or app store can share an age range with apps (on iPhone, Apple's Declared Age Range), the app asks for it. If it shows that you are 18 or older, there is no selfie check. We keep only the result, never the range.
• Otherwise, a selfie age check by Didit. Didit (Didit Identity, Inc. and Didit Identity Spain, S.L.) is our service provider for age checks and acts only on our instructions. Before the camera opens, the app tells you what the check collects, why, and how long it is kept, and asks for your consent. If you don't consent, no selfie is taken, and companions stay closed until your age is confirmed another way.
• What is collected. A selfie taken in the app, with a short capture that checks it shows a live person and not a photo or a screen. From it, Didit's system measures facial features to estimate your age. Those measurements are biometric information. They are used only to estimate your age, never to identify you or to match you against anyone.
• What we receive. Only whether the check confirmed that you are 18 or older and that the selfie was of a live person. We never receive the selfie, the measurements or your estimated age, and we never store them.
• Retention and destruction. As soon as Didit sends us the result, we tell Didit to delete the check, and Didit permanently deletes the selfie, the liveness capture and the measurements. Our Didit account is set to delete every check after 30 days at the latest, in case a deletion fails. Nothing from the check is kept for more than 30 days, well within the limits Illinois (3 years after your last interaction with us) and Texas (1 year after the purpose ends) allow. If you delete your account or withdraw your consent before then, we delete it at once.
• Never sold or shared. We and Didit never sell, lease, trade or otherwise profit from this information, and we disclose it to no one else except as a valid court order, warrant or subpoena legally compels. It is protected in storage and in transit with at least the care we give our other sensitive information.
• Where it is processed. Didit stores data in the European Union by default, on Amazon Web Services.
• Your consent and choices. You can withdraw your consent for an age check before it is done by closing it. Afterwards there is nothing left to withdraw, because the selfie and measurements are deleted. To ask a question about a check, email privacy@gemnd.ai.

How we disclose information

We disclose personal information only in the ways below.

Service providers. Companies that process personal information on our behalf to provide Gemnd. Every service provider except Serper, our web search provider, works under a written contract that lets it use your information only to provide its service to us, on our instructions. The contract forbids it to sell or share your information or to use it for its own purposes, including training or improving AI models. It requires the provider to keep your information confidential and secure, to protect it at least as well as this policy does, to help us honor your rights, and to delete your information when we ask. The same applies to the crash-reporting software built into the app. If a company related to us, such as a parent, subsidiary or affiliate, ever has access to your information, it must protect it the same way. Where a provider's own practice differs, such as how long it keeps data, this policy says so. The model providers that fal runs for us work under fal's agreements with them, which aren't published; what each states for its API customers is under Other AI providers. Serper receives only the searches your companion writes, under Serper's own terms, and does not publish how long it keeps them.

What the AI providers receive and how they treat it is described in How AI processes your information. Our subprocessor list names each provider, with its purpose and location, and on request we'll send you each one's contact details. The categories are:

• AI model hosting and routing: OpenRouter and Together AI. They receive conversation context, memories and companion character text. DeepSeek supplies the model but receives no requests from Gemnd.
• Content safety: TypeSafe, through OpenRouter. It receives messages, character text and requests.
• Age checks: Didit. It receives the selfie for an age check, when your app store can't confirm your age, and deletes it.
• Speech recognition and voice: Deepgram. It receives voice audio when your iPhone can't transcribe it, and reply text.
• Image and video generation: fal (Features & Labels, Inc.), and through it OpenAI, MiniMax (Nanonoble Pte. Ltd.) and Topaz Labs. They receive look and selfie requests, companion portraits and generated media.
• Web search for companion replies: Serper. It receives search queries and web addresses.
• Cloud hosting, databases, logging and encryption keys: Google Cloud. It stores and processes all the information described in this policy for us.
• Media storage: Cloudflare. It stores generated images and videos.
• Real-time call media: our call-media provider, named on the subprocessor list. It receives call audio while a call is active, and your device's IP address while a call is connected.
• Email delivery: our email provider, named on the subprocessor list. It receives your email address and the codes and notices we send.
• Support mailbox: our mailbox provider, named on the subprocessor list. It receives emails you send us.
• Crash and error reporting: Sentry. It receives crash and error diagnostics with message content removed.
• Notification delivery: Apple, through the Apple Push Notification service. It receives your notification device token and each notification: a generic title and line that name no one, and an opaque identifier of the request it is about.

Apple. Apple runs the App Store and processes your payments for subscriptions and Usage resets under its own terms, as an independent company, not as our service provider. We send Apple only the random purchase number described above, which is linked to your account.

Legal requirements and safety. We may disclose information if we believe in good faith that the law requires it, for example to answer a valid subpoena, court order or search warrant, or to report apparent child sexual abuse material to the National Center for Missing & Exploited Children, as federal law requires. We review every request and disclose only what the law requires. We may also disclose information when needed to:

• protect Gemnd, our users or others from fraud or security threats;
• respond to an emergency request from a government authority where someone's life is at imminent risk;
• enforce our Terms of Use or defend legal claims.

These broader disclosures never apply to consumer health data. For consumer health data, only the narrower cases in Consumer health data apply: we never disclose it in response to a request that doesn't legally compel us, such as a voluntary emergency request, or to enforce our Terms of Use or defend legal claims, unless you consent.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, personal information may be transferred as part of that deal. Anyone who receives it must keep honoring this policy and the laws that protect consumer health data. We will tell you before your information becomes subject to a different privacy policy.

At your direction. We disclose information when you ask us to.

We don't disclose personal information to anyone for their own marketing. We don't sell it to data brokers or anyone else.

No sale, no sharing, no targeted advertising

These statements are true today and have been true for the past 12 months:

• We don't sell personal information, including sensitive personal information and consumer health data, to anyone, for money or anything else of value.
• We don't share personal information for cross-context behavioral advertising, and we don't use it for targeted advertising. Gemnd shows no ads.
• We don't sell or share the personal information of anyone under 16, or of anyone at all.
• No other company tracks you through Gemnd. No third party collects information about your activity in Gemnd over time or across other apps or websites.
• We don't profile you to make decisions that have legal or similarly significant effects, and we make no automated decisions about your access to financial services, housing, education, employment, health care or essential goods and services.
• We use and disclose sensitive personal information only for the purposes the law permits without an opt-out: providing the service you asked for, security, safety, preventing fraud, quality and legal compliance.
• We offer no financial incentive or price difference tied to your personal information. Our plans and prices depend on how much you use Gemnd, not on your data.
• We don't train AI models on your personal information (see above).

Because we don't sell, share, target ads or profile you in these ways, there is nothing for you to opt out of. We don't need a "Do Not Sell or Share" or "Limit the Use of My Sensitive Personal Information" link. If we ever wanted to do any of these things, we would change this policy first and ask for your consent where the law requires. Information we collected under this policy would never be sold or shared without your consent.

Global Privacy Control and Do Not Track. We don't sell or share personal information, we don't use it for targeted advertising, and we don't let anyone track you across other websites or apps. So a Global Privacy Control or browser "Do Not Track" signal has nothing to switch off, and Gemnd works the same whether or not your browser sends one. The iPhone app doesn't receive browser signals, and the same commitments apply there. If we ever started selling, sharing or targeting ads, we would change this policy first and honor these signals as requests to opt out.

How long we keep information

We keep personal information only as long as we need it for the purposes in this policy. The table gives each period. "Until you delete your account" means we keep it while your account exists, because your companion depends on it, and it is erased when you delete your account.

Written arbitration opt-outs and notices of dispute are encrypted separately from your conversations and restricted to authorized legal operators. Deleting your account starts the fixed retention period above; reading a notice or repeating the deletion does not restart it. This exception preserves the notice and its related Terms version, not your conversations or your conversation key. The record of your agreements, notices and consents is kept separately, for the period above, without your email address or device details.

Backups

We back up our databases automatically so we can recover from failures. Backups can't be edited, so something you delete stays in older backups until those backups are deleted.

• We keep automatic backups for 30 days, then delete them, along with 7 days of change records that let us restore a database to an earlier moment. So anything you delete is gone from our backups within about 30 days.
• Your messages, memories, memory corrections, personal profile (nickname, occupation and description, including earlier copies kept when your profile changes), conversation summaries, companion character text and the text of your companion's spoken replies are also locked with a key that belongs only to your account. That key is itself locked by a master key held in Google Cloud's key management service.
  • When you delete your account, we destroy that key.
  • Every month we also replace the master key, and we destroy each old version once our backups have aged out and one more replacement has passed.
  • So within about 60 days of your deletion, no one, including us, can read that text in any backup.
  • Other information is not locked with your key, including look requests, conversation titles and the numerical search data computed from memories. It is erased with your account and leaves our backups within 30 days, like everything else.

Downloading and deleting your data

Download my data

In Settings → Your data and devices, tap Download my data. The app then prepares a ZIP file and saves it straight to a folder you choose. We don't keep a copy on our servers. The download includes:

• your account details, profile, time zone and settings;
• all your conversations, transcripts, summaries and the factual claims extracted from them;
• your memories, with their earlier versions and sources, and the text prepared for memory search;
• your companions, personas, their versions and character changes;
• your custom looks, expressions and selfies, as image and video files, with their requests;
• call records (not audio, which we don't keep);
• your safety records and reports;
• your AI-processing choices, consents and their history;
• your plan, purchase records and Usage ledger.

The download doesn't include:

• passwords, sign-in codes and tokens, which we keep only as one-way hashes for security;
• the raw signed records Apple sends us;
• the IP addresses and device descriptions stored with your sign-ins (the device descriptions appear in Signed-in devices);
• the numerical search data (embeddings) computed from your memories, which can be rebuilt from them;
• data kept only on your iPhone;
• logs and diagnostics;
• copies held by our providers;
• your emails with us.

You can ask us for any of these that we hold by emailing privacy@gemnd.ai.

Delete your account

In Settings → Delete account, confirm with your password or a code we email you. Then:

1. Right away, we sign you out on every device and start erasing your account. There is no waiting period.
2. In fixed steps, we erase your memories, your conversations, your companions, your generated images and videos, and finally your account details. We confirm that the media files are gone from storage before we erase their records. If a charge for something you started is still being settled, erasure waits until it settles. Either way, your conversations, memories and other consumer health data are erased from our active systems within 30 days of your request.
3. When it's done, we email you. Right after you confirm, the app shows a deletion status screen that follows the steps.

What we keep after deletion, linked only to a random account number and never to your email or conversations, except where this list says otherwise:

• the Usage ledger, subscription records and records of the Usage resets you bought, for accounting, tax, fraud prevention and legal claims, for the period in the table above;
• the identifiers of your subscription and of each Usage reset you bought, so an erased purchase can't be claimed again;
• a record that the account was deleted;
• for 24 months, the privacy requests the account made and our answers, which can include the email address you wrote from;
• for 6 years, the record of which of our terms and policies the account agreed to or was shown, its answers to our notices and the consents it gave, without its email address or device details;
• the permanent erasure record described above.

Where your data can remain for a while: backups, until they expire (see Backups); logs, until they expire; copies at our providers, as described above; and any download you saved yourself.

Your subscription continues until you cancel it with Apple. Deleting your account doesn't cancel it. Cancel in your iPhone's Settings → [your name] → Subscriptions, or in Gemnd under Menu (≡) → Plan & Usage → Manage subscriptions.

Delete specific information

• Memories: forget one, or all, in Memory.
• Reports: deleted automatically 30 days after a person reviews them.
• Conversations and companions: you can't delete a single conversation or companion in the app. Deleting your account deletes all of them. If you want specific information deleted without closing your account, email privacy@gemnd.ai, and we'll handle it as a deletion request under Your privacy rights.

Turn off AI processing

In Settings → AI processing, tap Turn off.

• Chat, calls, memory updates and avatar creation stop right away, including a reply already in progress, until you turn processing back on.
• We stop sending your conversations and memories to our AI providers and stop forming new memories. Your conversations, memories and account stay stored, so they're there if you turn processing back on, and you can still download your data, manage your devices and delete your account. To have them deleted, delete your account or email us.
• Turning processing off can't recall what was already sent. The providers that write your companion's replies keep nothing. Our image and video generation provider, fal, and the model providers it runs keep request data and generated files for their own periods, as described in How long we keep information.

Your privacy rights

We give every Gemnd user in the United States the rights below, wherever you live, even if your state's law doesn't require them. They are based on the privacy laws of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, Washington and other states.

Your rights

• Know and access. Ask whether we process your personal information, and get a copy of it, including the inferences we've made about you, such as memories. You can also ask for the categories we collect, where it comes from, why we use it, the categories of providers we disclose it to, and what we keep.
• Portability. Get your information in a portable, machine-readable format. The download is a ZIP of standard JSON files plus your media files.
• Correct. Fix inaccurate information. You can edit or correct memories and your companion settings yourself in the app. For anything else, such as your account email, write to us.
• Delete. Have your personal information deleted, including information derived from it. You can delete your account in the app, or ask us to delete specific information.
• List of recipients. Get a list of the specific companies we've disclosed your personal information to. That is our subprocessor list, plus Apple (the random purchase number described above), plus any authority or other party we disclosed your information to as described in How we disclose information. We name each of them in our answer to you, and on request we add each one's contact details.
• Withdraw consent. Withdraw any consent you gave, as easily as you gave it. AI processing stops immediately when you turn it off, and so does the collection of health information when you withdraw that consent.
• Stop collection. Ask us to stop collecting, using and disclosing your consumer health data. Turning off AI processing in Settings → AI processing does this right away for anything new. After that, we keep what you already have only so you can read, download or delete it, and we don't process it in any other way. To have it removed too, delete your account or ask us.
• Opt out of sale, sharing, targeted advertising and significant profiling, and limit the use of sensitive personal information. You have these rights, but they don't arise at Gemnd, because we don't do any of those things.
• Appeal any decision we make on your request (see below).
• Equal treatment. We will never deny you service, charge you a different price or give you a worse experience because you used your rights. Withdrawing AI-processing consent pauses the features that need AI processing, because they can't work without it.

How to make a request

• In the app, for the requests the app handles directly: Download my data, Delete account, AI processing, Signed-in devices and Memory. For any other request or an appeal, Settings → Help and reports → Contact support opens an email to us.
• By email to privacy@gemnd.ai, for any request. Write from the email address on your account if you have one, say which right you want to use, and tell us your state of residence.
• By mail to GemndAI LLC, 160 East Sunrise Highway #1016, Freeport, NY 11520, United States.

You don't need a Gemnd account to make a request. Requests are free.

How we verify requests

• In the app, being signed in identifies you. Before we delete your account, the app also asks you to confirm with your password or a code we email you.
• By email or mail, we'll ask you to confirm the request from the email address on your account. We may ask for more information if a request is unusually sensitive, and we use what you give us only to verify you.
• Without an account, we match what you tell us against the information we hold, to the degree of certainty the request calls for.
• Requests to opt out need no verification.

If we can't verify a request, we'll tell you why and what would let us.

Authorized agents

You can have someone make a request for you. We'll ask the agent for your signed permission, and we may ask you to confirm your identity or the request directly with us. A valid power of attorney is also accepted.

When you'll hear from us

• Within 10 business days, we confirm we received your request and tell you how we'll handle it.
• Within 45 days of receiving it, we respond.
• If we need more time, we tell you why within those 45 days, and we take at most 15 more days.
• Within 60 days of receiving it, we confirm that we've carried it out.
• If we decline any part of it, we explain why and tell you how to appeal.
• For consumer health data, we delete within 30 days of verifying the request, and in every case within 45 days of receiving it (60 if we extend as above), and we tell every provider that may still hold a copy to delete it. Our image and video generation providers' request data and files, kept for 30 days, are deleted on those providers' own schedules, described in How long we keep information.

How to appeal

If you disagree with our decision on your request, you can appeal:

• reply to our decision email with the word "Appeal" in the subject line, or email privacy@gemnd.ai with that subject;
• say which decision you are appealing and why.

We answer in writing within 45 days, with our reasons. If we deny your appeal, you can complain to your state attorney general. Our decision will include a link to your attorney general's online complaint form.

State-specific information

• California.
  • The Notice at collection lists the categories of personal information we have collected in the past 12 months, their sources, purposes and retention, and the categories of providers we disclosed them to for a business purpose.
  • California's "Shine the Light" law (Civil Code §1798.83): we don't disclose personal information to third parties for their direct marketing purposes. You can ask us about this once a year at privacy@gemnd.ai or by mail, and we'll respond within 30 days.
  • Automated decision-making rights don't arise, because we make no automated decisions with legal or similarly significant effects.
• Nevada. We don't sell covered information. You can still send a request not to sell to our designated address, privacy@gemnd.ai, and we'll record it.
• Colorado, Connecticut, Minnesota, Virginia and other states that require consent for sensitive data.
  • We process sensitive data, including inferences such as memories, only after you give the AI-processing consent and the separate health-information consent described in Sensitive personal information, and only as needed to provide Gemnd.
  • In Virginia, we obtain and disclose reproductive or sexual health information only with that consent.
• Illinois, Texas, Washington, Colorado and other states with biometric privacy laws. A selfie age check is done only with your consent, after the notice described in Age checks and biometric information, which is also our public retention schedule and destruction policy.
• Maryland. We collect and process sensitive data only when it is strictly necessary to provide the service you asked for, and we never sell it.
• Connecticut. We don't collect, use or sell personal data to train large language models. The providers that write, check, voice and illustrate your companion are barred by contract from training on your data, and our web search provider receives only search queries, with no user identifier (see We don't train AI on your data).

Notice at collection

This notice tells you, at or before the point we collect personal information, what we collect, why, whether we sell or share it (we don't) and how long we keep it. It applies to California residents and everyone else. You can open it directly, without scrolling through the rest of this policy, at https://gemnd.ai/legal/privacy#notice-at-collection, and, before you download Gemnd, from the link to https://gemnd.ai/legal/privacy#notice-at-collection on our App Store page. In the app, the Notice at collection link on the Create account screen, shown before you send us your email and password, opens this section directly.

• We collect the categories below. The category names are the ones California law uses. We have collected these categories, and only these, in the 12 months before this policy's effective date.
• We don't sell or share any of them, and we don't use sensitive personal information beyond what the law allows without an opt-out (see No sale, no sharing, no targeted advertising).
• We keep each one only as long as described below and in How long we keep information.
• "Service providers" means the categories in How we disclose information, named on our subprocessor list.

Identifiers

• What: email address, display name, account number, sign-in and device records with IP address and device description, Apple purchase number.
• Sources: you; your device; Apple.
• Purposes: running your account, security, Usage and purchases, support, and letting your companion address you by the name you choose.
• Disclosed to: cloud hosting; AI model hosting and routing, and content safety (the name or nickname your companion knows you by); email delivery (your email address); our support mailbox provider (your email address, when you write to us); our call-media provider (your device's IP address while a call is connected); operational monitoring and crash reporting (as keyed hashes only); and Apple (the random purchase number only).
• Kept: until you delete your account; sign-in records until you delete your account; logs for 30 days, and crash and error reports for 30 days.

Personal information described in California Civil Code §1798.80(e)

• What: your name, and anything in that list you choose to tell your companion, such as a description of yourself or medical information.
• Sources: you.
• Purposes: providing your companion.
• Disclosed to: AI model hosting and routing, content safety, cloud hosting.
• Kept: until you delete your account or forget the memory.

Characteristics of protected classifications

• What: that you are an adult (18+); anything you choose to tell your companion about your sex, gender, sexual orientation, religion, national origin, disability, age or similar characteristics.
• Sources: you; your app store's age signal; Didit, our age-check provider.
• Purposes: confirming that you're an adult; providing your companion.
• Disclosed to: AI model hosting and routing, content safety, cloud hosting.
• Kept: until you delete your account or forget the memory.

Commercial information

• What: your plan, Apple purchase records and your weekly Usage ledger.
• Sources: Apple; created as you use Gemnd.
• Purposes: providing your plan, measuring Usage, preventing fraud, accounting.
• Disclosed to: cloud hosting.
• Kept: until you delete your account, then without contact details for 7 years after the end of the year they relate to, for accounting, tax, fraud prevention and legal claims, and then we delete them.

Biometric information

• What: the selfie and liveness capture for an age check, and the facial measurements made from them to estimate your age, only when your app store can't confirm your age. Your voice is turned into text and never used to identify you.
• Sources: you, with your consent.
• Purposes: confirming that you're 18 or older, and nothing else.
• Disclosed to: Didit, our age-check provider. We never receive the selfie or the measurements.
• Kept: deleted as soon as the result reaches us, and in every case within 30 days.

Internet or other electronic network activity

• What: request logs, how you use the app's features as needed to run them, crash and error diagnostics.
• Sources: your device.
• Purposes: operating, securing and fixing Gemnd.
• Disclosed to: cloud hosting, operational monitoring, crash and error reporting.
• Kept: request logs and telemetry 30 days; crash and error reports 30 days.

Geolocation data

• Not collected. We use your device's time zone, not its location.

Audio, electronic, visual and similar information

• What: your messages and your companion's replies; your voice while you speak (streamed, not stored); call transcripts; generated images and videos; saved voice recordings on your iPhone.
• Sources: you; created at your request.
• Purposes: conversations, calls, dictation and read-aloud, avatars and selfies, safety checks.
• Disclosed to: AI model hosting and routing, content safety, speech, image and video generation, web search, call media, media storage, cloud hosting.
• Kept: conversations and media until you delete your account; speech text 60 seconds or less while it becomes a message; saved voice recordings on your iPhone up to 30 days.

Professional or employment information

• What: only what you choose to tell your companion or add to your profile.
• Sources: you.
• Purposes: providing your companion.
• Disclosed to: AI model hosting and routing, content safety, cloud hosting.
• Kept: until you delete your account or forget the memory.

Education information

• What: only what you choose to tell your companion.
• Sources: you.
• Purposes: providing your companion.
• Disclosed to: AI model hosting and routing, content safety, cloud hosting.
• Kept: until you delete your account or forget the memory.

Inferences

• What: memories, the running description of you, and conversation summaries.
• Sources: created by our AI from your conversations.
• Purposes: letting your companion remember you.
• Disclosed to: AI model hosting and routing (to form and use memories), cloud hosting.
• Kept: until you forget them or delete your account, with automatic tidying.

Sensitive personal information

• What: your account email with your password; the contents of your messages; when you share them in conversation or in companion settings, information about your health, sex life, sexual orientation, racial or ethnic origin, religious or philosophical beliefs, citizenship or immigration status or union membership; and, for an age check, the biometric information described above.
• Not collected: government ID numbers, financial account numbers, precise geolocation, genetic or neural data.
• Sources: you.
• Purposes: providing the service you ask for, security, safety and legal compliance only.
• Disclosed to: as for the audio and inferences categories.
• Kept: as for the audio and inferences categories. Passwords are stored only as a one-way hash.

Consumer health data

Some state laws protect "consumer health data": information linked to you that identifies your past, present or future physical or mental health, including information inferred from other data. These include Washington's My Health My Data Act, Nevada's consumer health data law and Connecticut's privacy law.

Our separate Consumer Health Data Privacy Policy describes how we handle consumer health data for every user, as Washington's My Health My Data Act requires. This section summarizes it and adds what Nevada and Connecticut require.

What we collect and how we use it

• What you tell your companions about your health: for example your physical or mental health, mood, medications, treatment, sexual or reproductive health, or gender-affirming care, typed, dictated or said in a call. We use it to reply to you, keep your conversation history and remember what you share.
• Memories and summaries about your health, which our AI creates from your conversations. We use them so your companion stays consistent with you.
• How you ask a companion to support you, in its character settings. We use it to shape replies.
• Character changes you ask for in conversation, with the short quote from your request that we keep (up to 512 bytes), if it mentions your health. We use it so you can review what changed and why.
• Safety signals: a record that we showed crisis resources or gave a supportive response, without your message. We use these only for safety and to meet our legal duties.
• Reports and messages you send us, if they mention your health: the reported reply and your note (deleted after 30 days), and emails or letters you send us, including privacy requests. We use them to review the report or answer you.
• Your voice, when your iPhone can't transcribe it. It is streamed to our speech provider to be turned into text and isn't kept. We keep the text, not the audio, and we never use your voice to identify you. Washington law can treat voice recordings as biometric data, so we list it here.
• The selfie for an age check. Washington law treats biometric data as consumer health data. Only Didit processes it, only to estimate your age, and it is deleted within 30 days at the latest (see Age checks and biometric information).

Where it comes from. From you, and from our systems and AI providers, which create memories, summaries and safety signals from what you share.

How it is processed.

• It is stored encrypted on Google Cloud servers in Iowa (the us-central1 region), in the United States, with your messages, memories, memory corrections, conversation summaries, companion character text and the text of your companion's spoken replies encrypted under a key unique to you.
• It is processed by automated systems and by the AI providers that write your companion's replies, on our instructions.
• People on our team see it only in the situations listed in When a person sees your content.

Sharing. We never sell consumer health data, and we don't share it with any third party or affiliate for its own purposes. We disclose it only in the limited ways below.

• To our service providers, which process it under written contracts, only on our instructions and only to provide Gemnd:

  • what you tell your companions about your health goes to AI model hosting and routing, content safety, speech recognition, call media, web search for companion replies, and cloud hosting and storage;
  • memories and summaries go to AI model hosting and routing, and cloud hosting and storage;
  • support preferences and character-change quotes in companion settings go to AI model hosting and routing, content safety, and cloud hosting and storage;
  • safety signals go to cloud hosting and storage and, without your words, operational monitoring;
  • your voice, when your iPhone can't transcribe it, goes to speech recognition and call media;
  • reports go to cloud hosting and storage, and messages you send us go to our support mailbox provider.

  They are named on our subprocessor list. On request we'll send you each one's contact details.

• When we disclose it to anyone else. We disclose consumer health data without your consent only:

  • to prevent, detect, protect against or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or illegal activity, or to investigate, report or prosecute those responsible; or
  • when a court order, search warrant or subpoena legally compels us.

  We disclose only what is required and, unless the law forbids it, we tell you first. We never disclose it in response to a request that doesn't legally compel us, and our crisis feature never contacts anyone.

• Business transfers. If Gemnd is merged with or sold to another company, that company must follow this policy and the laws that protect consumer health data.

Consent. Before we collect consumer health data, the app asks for your consent on its own screen, separate from our Terms of Use, this policy and the AI-processing consent. A selfie age check asks for its own consent before the camera opens. We also collect consumer health data only as needed to provide the companion you asked for. You can withdraw consent at any time in Settings → AI processing.

Your rights. You can confirm whether we collect, share or sell your consumer health data; see and download it; get the list of companies that process it; ask us to stop collecting and sharing it (Settings → AI processing → Turn off, or email us); withdraw consent; and have it deleted. The paths are in Downloading and deleting your data and Your privacy rights.

• Deletion. We delete consumer health data from our active systems within 30 days of verifying your request, and we tell every provider that may hold a copy to delete it. Safety entries in our operational logs carry only a coded identifier and no message text, and they expire within 30 days. Backup copies expire within 30 days and become permanently unreadable within about 60 days (see Backups), well within the six months Washington law allows.
• Response time. We respond to requests within 45 days and to appeals within 45 days. If we deny an appeal, we give you your attorney general's contact details: in Washington, atg.wa.gov/file-complaint; in Nevada, ag.nv.gov.
• Correction. You can review and change memories in the app at any time.

Other commitments.

• We don't use location and we never geofence health facilities.
• No third party tracks you across apps or websites through Gemnd.
• If we change how we collect, use or share consumer health data, we tell you in the app first and ask for your consent again before the change applies.

Adults only

Gemnd is only for adults 18 and older and is not directed to children. Companion chatbots may not be suitable for some minors.

• We don't knowingly collect personal information from anyone under 18.
• Before anyone can use a companion, they confirm that they are 18 or older, and we check it with their app store's age signal or a selfie age check (see Age checks and biometric information). If they say they are under 18, or the age signal shows that they are, they can't use Gemnd. That screen offers only Sign out. To have the account deleted, email privacy@gemnd.ai.
• If a message says or strongly suggests that the person writing is under 18, it is refused, and we may ask the account holder to confirm their age again.
• Age information from your device, your app store or Didit is used only to keep minors off Gemnd, to comply with the law and to apply safety settings. We never sell or share it, and we keep only the result.
• If an account's holder tells us they are under 18, or a person on our team concludes after review that an account belongs to someone under 18, we close the account: it can no longer be used, and we delete its data 30 days later. If we made a mistake, tell us within those 30 days and we reopen it.

If you believe someone under 18 is using Gemnd, or you are a parent or guardian with a concern, email privacy@gemnd.ai.

How we protect your information

We protect personal information with safeguards suited to how sensitive it is.

• In transit: connections between the app and our servers, between our services, and to our providers are encrypted. Our services verify the identity of the database server before connecting.
• At rest:
  • Our databases are encrypted with keys we manage in Google Cloud's key management service.
  • Generated media is encrypted by Cloudflare.
  • Your messages, memories (including names, aliases, claim labels and personal profile values recorded in memory), memory corrections, personal profile (nickname, occupation and description, including earlier copies kept when your profile changes), conversation summaries, companion character text and the text of your companion's spoken replies are additionally encrypted with a key unique to you, which is itself protected by a key held in Google Cloud's key management service. Their content fingerprints are keyed per user and destroyed with the key, not plain hashes. Fingerprints of the content each safety check looked at are plain one-way hashes. Those safety fingerprints are deleted with your account and leave our backups within 30 days.
  • Detailed error records that can quote your content are encrypted with that same key unique to you and kept for 14 days in a restricted log. Only our servers can decrypt them with that key, and they are unreadable once the key is destroyed with your account.
  • Reports, pending speech and purchase tokens have a further layer of encryption in our application.
• Access:
  • Our services connect to our databases with separate roles that can't change the database's structure, over connections that verify the database server's identity.
  • Access to each user's data is restricted by checks in our application.
  • Secrets are kept in a secrets manager, never in the app.
• Accounts:
  • Passwords are stored as bcrypt hashes.
  • Sign-in is protected by limits on repeated attempts and, for accounts that use it, an emailed one-time code.
  • A password reset signs you out on every device.
  • Deleting your account asks you to confirm with your password or an emailed code.
  • Your sign-in secret stays in your iPhone's Keychain, and the short-lived access token stays only in the app's memory.
• Logs and diagnostics: our application logs, telemetry and crash and error reports are built to leave out message text, email addresses and IP addresses, and identifiers in them are replaced by keyed hashes. Our hosting provider's request logs do record IP addresses and device descriptions, as described in Logs and diagnostics.
• Not end-to-end encrypted. Our servers have to read your messages to generate replies.

No method of storing or sending information is completely secure. If a security breach affects your personal information, we will notify you and the authorities as the law requires.

You can help by using a strong password you don't use elsewhere and signing out devices you no longer use (Settings → Your data and devices → Signed-in devices).

Cookies and similar technologies

• The iPhone app uses no cookies, advertising identifiers or tracking technologies.
• Our web pages, including this policy, set no cookies and load no third-party trackers or analytics. They store a display-theme preference and a technical marker that helps the page reload correctly after we update the site in your browser's storage. Both stay on your device.
• Like any website, our servers log each request, including your IP address and browser description (see How long we keep information).

Where we process information

Gemnd is offered only in the United States. This policy is written for users in the United States. Service availability in the United States is not a promise that every processor is located there.

We store your information on Google Cloud servers in Iowa (the us-central1 region), in the United States. Each provider's region is listed on our subprocessor list. We do not infer processing location from a company's headquarters. These routes have no region commitment, so their data may be processed or stored outside the United States:

• web search through Serper;
• image and video generation through fal and the model providers it runs;
• media storage with Cloudflare;
• companion replies through OpenRouter and Together AI, which makes no contractual region commitment to us;
• age checks through Didit, which stores data in the European Union by default.

If you use Gemnd from outside the United States, your information is transferred to and processed in the United States, where privacy laws may differ from those where you live. If we offer Gemnd in other countries, we will publish the additional information their laws require before we do.

Changes to this policy

The effective date at the top of this policy is the date this version took effect. We update this policy at least once every 12 months, and whenever our practices change. Each update carries a new date, even when nothing about our practices has changed.

• Material changes. A material change is one that affects the categories of information we process, why we process it, who we disclose it to, who we are, or how you exercise your rights. We email you about it at least 30 days before it takes effect. From the date it takes effect, the app shows a short notice with what changed and a link to the updated policy; it appears once, and it never stops you from using Gemnd. The updated policy describes what we do from that date. If the change would use information we already hold in a materially different way, or involves a new use of sensitive information or consumer health data or a new company receiving it, we ask for your consent separately before it applies to you, and you can say no. Reading or dismissing the notice is never treated as that consent. We record which version you saw, your answer and when. Where the law requires, we also tell the App Store before the change takes effect.
• New uses of information. We won't use information we already hold for a new purpose that you wouldn't reasonably expect without your consent.
• AI providers. If the AI providers listed on the AI processing screen change, the app asks you to review the new list and allow processing again before any new one receives your data.
• Smaller changes, such as clearer wording or updated contact details, take effect when we publish them on our website with a new date.

Earlier versions of this policy are available on request at privacy@gemnd.ai or support@gemnd.ai.

This policy is available in English, the language of the app. If you need it in a different format because of a disability, email privacy@gemnd.ai and we'll provide one. You can print or save this policy from our website at https://gemnd.ai/legal/privacy.

Contact us

• Privacy questions, requests and appeals: privacy@gemnd.ai, or Settings → Help and reports → Contact support
• Help with the app: support@gemnd.ai, or Settings → Help and reports → Contact support
• Legal notices and requests from authorities: legal@gemnd.ai
• Mail: GemndAI LLC, 160 East Sunrise Highway #1016, Freeport, NY 11520, United States
• Website: https://gemnd.ai