Draft

Privacy Policy

This is a draft. It may change after legal review before launch.

Last updated: November 9, 2026

At a glance

  • We don't receive your chats. Chats, memories and settings all stay on your computer.
  • Your chats go straight from your computer to the AI company you picked. They never pass through our servers.
  • Sign-in details and API keys are kept only in your Mac's Keychain.
  • If you make a shop account, we keep your email, the characters you have, your orders, who you invited, and when you first downloaded each character. We never see your card number. If you joined through an invite, we also record when you had your first chat in the app, never what it said.
  • No tracking cookies, no ads. The only cookie holds an invite code for up to 30 days, and only if you open an invite link.
  • You can delete your account any time. We keep only the transaction records the law tells us to, for as long as it says.

1. What the app handles and where it's stored

  1. Chat history, memories, what your character knows about you, and settings are stored in the app's folder on your computer. They are never sent to our servers.
  2. Sign-in tokens and API keys for AI services are stored in your operating system's secure storage (macOS Keychain or Windows Credential Manager) and are never sent anywhere except to the AI company concerned.
  3. You can view, edit and delete memories inside the app.

2. Information sent to AI companies

For a character to answer, your conversation has to be sent to the AI company you connected (OpenAI or Anthropic). These requests go directly from your computer to that company. We never receive or see their contents. How that company handles your information is governed by its own privacy policy.

3. What the website collects

  1. Launch update email. Only if you enter and submit it yourself.
  2. Your account. Your email address, when you made the account, and the invite code we make for it.
  3. Your characters. Which characters are on your account, how you got each one (free, purchase or invite), when you got it, and when you first downloaded it.
  4. Your orders. The payment provider (Toss Payments or Paddle), its order number, the amount, currency, payment status, and when you paid or cancelled. Your card number and other payment details go straight to the payment provider. We never receive or store them.
  5. Invites. Who invited whom and when, and whether (and when) the invited friend had their first chat in the app. The app only tells us that a first chat happened and when. We never receive what was said.
  6. Access logs. Cloudflare, which hosts our website, may briefly keep standard access logs for security and operations. We count visits as totals only, with Cloudflare Web Analytics, which uses no cookies. We don't use any of this to track visitors.

4. How we use it

  1. Launch update email: only to send news about the launch and the Windows version.
  2. Your account: to email you sign-in links, recognize you, and answer your questions.
  3. Your characters and orders: to put the characters you bought on your account so you can download them, confirm payments, and handle cancellations and refunds. Your first download time tells us whether an order can still be cancelled.
  4. Invites: to give invite rewards and to stop rewards being collected through fake accounts.
  5. We may show anonymous totals in the shop, such as how many people have taken each character home.

We never use this information for ads, and we never sell it or pass it on.

5. How long we keep it

  1. Your launch update email: until you unsubscribe or ask us to delete it.
  2. Your account, characters and invites: until you delete your account. Then we delete them right away.
  3. Korean e-commerce law requires us to keep some records even after you delete your account:
    • Records of contracts and cancellations: 5 years
    • Records of payments and delivery: 5 years
    • Records of complaints and disputes: 3 years
  4. When a retention period ends, we delete the information so it can't be recovered.

6. Who helps us, and who else receives information

These companies process personal information for us so we can run the Service:

  • Supabase Inc. (United States): stores accounts and our database, and sends sign-in link emails
  • Cloudflare, Inc. (United States): runs our website and server functions, and stores and delivers app and character files
  • Toss Payments Co., Ltd. (Korea): processes payments made in Korea

If you pay outside Korea, Paddle.com Market Ltd (United Kingdom) is the seller. Paddle collects your email, country and payment details directly at checkout, and its own privacy policy applies to them. To connect the payment to your account, we pass Paddle an account identifier and your email, and Paddle sends us the order number, amount, currency and payment status.

Some of these companies are outside your country, so your information may be transferred abroad. We only use companies that protect it under their own published privacy and data processing terms. If you'd rather not, you don't need an account: the app and Mongi work without one, but you won't be able to get or buy characters in the shop.

7. Cookies and browser storage

  1. Your sign-in session is kept in your browser's local storage (localStorage). It's gone when you sign out or clear your browser data.
  2. Only when you open a friend's invite link, we set a cookie called mongi_ref that holds the invite code for up to 30 days, so the invite still counts when you sign up. Only this website reads it.
  3. We don't use tracking cookies, ad cookies or third-party analytics cookies. Our fonts are hosted on this site too, so no outside font servers are called.

8. Checking for app updates

The app connects to our website to check for new versions. Only technical details, such as the app version and the type of operating system, are exchanged. No chats or personal information are sent. We only count checks per day and version, and we don't record who checked.

9. Your rights

  1. You can ask us to show, correct or delete the information we hold about you, or to stop processing it. You can also ask us to delete your account at any time.
  2. Email us from your account email at the address below. Once we've confirmed it's you, we'll take care of it within 10 days. Records the law requires us to keep are deleted when their retention period ends.
  3. Children under 14 may not make an account.

10. Keeping it safe

Everything is sent encrypted (HTTPS). Account records can be read only by that account and by our own servers, and only the people who need admin access have it.

11. Privacy officer and contact

  • Privacy officer: [Privacy officer]
  • Email: [email protected]
  • Phone: [전화번호]
  • Operator: [Operator name]

For how purchases and refunds work, see our Refund Policy.