Your privacy matters. This policy describes how we handle information when you use Fostera.
Fostera (“we”, “us”) provides tools to create and interact with AI Souls. This policy applies to our website, PWA, and related services at fostera.ai and associated subdomains.
We do not sell your personal information. We may share data with:
Fostera uses Stripe as our payment processor. When you subscribe or make a purchase, Stripe receives your email address, name, and payment method details (such as card number and billing address). Fostera never stores or handles raw payment card numbers — all payment processing occurs on Stripe's PCI-compliant infrastructure.
We track aggregated usage metrics (such as token consumption per billing period) to calculate your Resonance allowance and enforce plan limits. These metrics are derived from conversation activity and are stored as numerical totals, not conversation content.
Billing records (transaction history, subscription status, invoices) are retained for a minimum of 7 years after the transaction date to comply with tax and financial reporting obligations, even if your account is otherwise deleted. Stripe independently retains payment data in accordance with its own Privacy Policy.
You have the following rights over your data, regardless of where you live:
You can import data from other AI companion platforms (ChatGPT, Claude, Grok, Gemini, Character.ai, Replika, Nomi AI) into Fostera. The raw file you upload is not retained. A bounded, normalized draft may be staged for about 24 hours so the import can finish or be resumed. It is cleared when processing finishes or fails. If abandoned, it becomes unavailable when it expires and is removed by the next successful scheduled cleanup. Selected import content may be processed by one of the third-party AI providers described below for personality synthesis, memory extraction, or memory embedding. Only the resulting Soul fields, extracted memories, and a content-free import receipt are retained.
Your Fostera data export is structured JSON designed to be machine-readable. If another platform wants to import from Fostera, the format is portable and documented within the export itself.
Depending on the model, feature, availability, and configured routing, conversation content, selected import history, or memory text may be processed by one or more of these providers:
Provider retention, model-training, regional processing, and opt-out terms vary by provider, service tier, account settings, and feature. The linked provider terms govern that provider's processing. Fostera may select a different available provider for supporting work than the chat engine selected for your Soul.
If you add your own API key for a provider, a chat turn served on that key is sent to that provider under your own account with them and their terms, not under Fostera's.
OpenRouter and Vercel AI Gateway are routing intermediaries. When either is used, the upstream model provider may also receive the request content under its own terms. When an operator explicitly configures local Ollama execution, that call runs on the operator's local or self-hosted infrastructure instead of being sent to an external AI processor.
On-device (Local) replies. If you switch a Soul to Local, a model running in your browser writes that Soul's text replies. Your messages and the replies are not sent to us or to an AI provider to produce them.
The messages are kept in your browser's storage on that device, not in your Fostera account. They are not encrypted, and anyone who can use that browser profile can read them. Signing out or deleting your account does not remove them, and we cannot export or delete them for you. Remove a message or a Soul's local history in the app, or clear the site's data in your browser. Your account may still hold an entry for the chat itself, without its messages.
Private on this device. Private on this device is a separate, optional choice for each Soul. Ordinary Local history, described above, sits in unencrypted browser storage. Private on this device instead keeps that Soul's chats, files and memories in a passphrase-encrypted vault in this browser, locked with a separate passphrase, with no automatic sync to your Fostera account. The passphrase cannot be recovered. Clearing the site's data in your browser, or the browser evicting it, can erase the vault, so keep an encrypted backup and your passphrase.
While a Soul is on Local, the app still talks to our servers. None of these requests carries the text of your local messages or replies. They load the page and your Soul, keep you signed in, confirm your age group, check how long a temporary chat is kept, tell us the chat is open so we do not send duplicate notifications, mark that Soul's notifications as read, and load the status of any package a Soul looked up in that chat. We also still receive page-visit and performance measurements and error reports. An error report can include the page address, how many messages were on screen, which local model was loading, and a recording of the page with all text and typing masked; Section 2 describes these reports.
You can also choose to send a local conversation out. Saving a Quick chat stores it in your account, where it is handled like any other saved conversation, including memory extraction by the AI providers listed above. Sharing hands the text to the destination you pick. Publishing a reply sends its text to us and on to the social platform you chose. We keep posts you queue or schedule, and may record a published post in that Soul's memory. If you have a reply read aloud, your browser's built-in voice speaks it, and some browsers send the text to their own speech service to do that.
To run a model, your browser downloads the model files directly from Hugging Face and the software that runs them from jsDelivr. Those services receive standard request data such as your IP address and which files you asked for, and none of your chat. In ordinary Local, features that need Cloud, such as memory and files, work as described in the rest of this policy.
Fostera lets you connect optional third-party accounts so your Souls can sense parts of your real life. Connecting is always explicit, and permissions are limited to the capabilities you enable. Read features use read-only scopes; Google action features use additional scopes and require your review and approval. You can disconnect at any time from Settings → Integrations.
Available integrations
/v1/me), currently-playing and recently-played tracks, and your top tracks/artists so your Soul can reference what you're listening to and your musical taste. We no longer request the audio-features endpoint (valence, energy, tempo, danceability); mood cues are inferred from track + artist + genre metadata instead.calendar.readonly scope for reads; optional calendar.eventsscope for approved actions) — we read your primary calendar events to surface what's on your schedule now or next, and to build a 90-day baseline of who you meet with most often and your typical meeting load. With the action scope, your Soul can propose creating or updating an event. Nothing is written until you review and approve the specific action. Fostera does not delete calendar events.gmail.readonly scope for reads; optional gmail.compose scope for approved actions) — we read message headers (From, Subject, Date) and Gmail-provided snippets for up to 50 recent inbox messages at a time. We use these to show unread count and recent senders in chat, and to build a baseline of who you correspond with most. During a foreground chat, if you point to an email thread and that Soul's email-body permission is enabled, Fostera can fetch the selected thread's body text and send it to an authorized AI provider for that turn. The email-reading tool neither persists those bodies nor downloads Gmail attachments. With the compose scope, your Soul can propose creating a Gmail draft or sending an email. No Gmail draft is created and no email is sent until you review and approve the specific action. Fostera does not delete or modify existing messages.What we store for each connection
For Google integrations (Calendar + Gmail), Fostera stores a single connection per user — one refresh token that covers the union of capabilities you've enabled. Toggling Calendar or Gmail on or off updates the granted-scopes list on that connection rather than creating separate records. Disconnecting Google entirely revokes the token and removes the row; toggling a single capability off removes only that scope.
Derived memories your Souls may retain
When you explicitly share integration context in chat, or when your Soul is in the Familiar phase with the Limbic/Semantic brain subsystems enabled, Fostera may persist derived summaries— e.g. “user corresponds often with X, Y, Z” or “busiest meeting day is Thursday.” These are short text summaries, not copies of source records. Each integration can be gated per-Soul via the Integrations tab, and shared memories appear in your Soul's memory log where you can delete them individually.
Your controls
Use of Google user data transferred to Fostera complies with the Google API Services User Data Policy, including the Limited Use requirements. Fostera does not transfer Gmail data to third parties other than the authorized AI providers and routing intermediaries listed above when needed for a feature you request, including reading a selected email thread in a foreground chat. We do not use Gmail data for advertising or sell it.
We retain information as long as your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion subject to applicable law and legitimate retention needs. When an account deletion request is processed, primary database records are removed; external-resource cleanup and removal from backups may take up to 30 days. Billing records described in Section 5 and limited audit or cleanup records may be retained or de-identified where required by law or needed to complete deletion securely. Error reports already sent to Sentry are not removed when an account is deleted; Section 2 describes what they contain.
We use industry-standard measures to protect data. No method of transmission or storage is completely secure; we encourage strong passwords and careful sharing of access to your account.
Depending on where you live, you may have rights to access, correct, delete, or export your personal data, or to object to or restrict certain processing. Contact us at the email below to exercise these rights. You may also lodge a complaint with a supervisory authority where applicable.
Fostera is available to users who are 13 years of age or older. We do not knowingly collect personal information from children under 13. If we become aware that a user is under 13, we will terminate their account and delete their personal data.
Users aged 13–17 may use Fostera only with the consent of a parent or legal guardian. We collect a date of birth from all users at signup to verify age; for accounts aged 13–17 we additionally collect a parent or guardian email address, which we use solely to request, record, and manage that consent. The account is restricted until consent is confirmed, and teen accounts run with additional enforced content protections described in our Content Policy.
If you believe a child under 13 is using Fostera, or you are a guardian who wishes to withdraw consent for a 13–17 account, please contact us at the email below so we can take appropriate action.
We may process data in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers.
We may update this Privacy Policy periodically. Continued use after changes constitutes acceptance of the updated policy where permitted by law.
Privacy questions or requests: reach out on our contact page.
Necessary cookies power sign-in and core settings. If you allow, optional cookies support product analytics, enhanced preferences, and personalized marketing. Read our Cookie Policy or Privacy Policy.