LORAX Privacy Policy

1. Who we are and what this policy covers

LORAX is an entertainment app in which you chat with fictional, AI-generated characters. It is operated by ASYNC YAZILIM BİLİŞİM PROGRAMLAMA SAN. VE TİC. LTD. ŞTİ., a company registered in Türkiye. We are the data controller for the personal data described in this policy, which means we decide why and how it is processed.

This policy applies to the LORAX app for iPhone, to the website at loraxchat.com, and to any support conversation you have with us. It does not cover Apple's own services (the App Store, Apple ID, iCloud, Apple Pay), which are governed by Apple's privacy policy.

We wrote this policy to be read, not skimmed. If anything is unclear, write to us and we will answer in plain language.

2. The data we collect

We collect only what the app needs to work. The categories below describe everything the app sends to us.

2.1 Your account and device

• A device identifier. LORAX does not use email addresses or passwords. When you first open the app, a random identifier is created for your device and stored in your iCloud Keychain so that your account can be restored if you get a new phone. This identifier is not your phone's serial number and is not shared with other apps.
• The profile you set up. The name you choose, your language, your time zone, and your preferences about who you would like to meet in the app.
• Age confirmation. The date of birth or age you provide to confirm that you meet the age requirement, together with the time you confirmed it.
• Consent records. The time at which you accepted these terms and the AI notice, and, if you upload a photo to create a character, the time you accepted the photo notice.
• Settings. Your notification preferences, appearance settings, and the app-lock and alternative-icon options if you turn them on.

2.2 What you write and send

• Messages. The text you write to characters, in private chats and in group chats.
• Media you send. Photos, videos and voice messages you choose to send in a chat, and posts you share in the app's status feature. Voice messages you send are converted to text so the characters can respond to them.
• What the characters send you. Their replies, the photos and voice messages generated for you, and the "memory" the characters keep about your conversations so they stay consistent over time.
• Reports. If you report a message, we receive the reported content, the reason you selected, and any note you add.

Group chats and status posts in LORAX involve you and AI characters only. There is no user-to-user messaging and there are no public profiles; nothing you write or share is shown to other people who use the app.

2.3 Photos you upload to create a character

If you use the create-your-own feature, you may optionally upload a face photo and a full-body photo. This is the most sensitive thing you can give us, so it has its own section: see section 7.

2.4 Live streams

When you start a live stream in the app, your camera image and microphone audio are processed in real time so that the characters can react to you. See section 8 for how this data is handled.

2.5 Purchases

All purchases are made through Apple's in-app purchase system. We receive from Apple a transaction identifier, the product you bought, the price and currency, the status of your subscription (active, cancelled, expired, refunded) and renewal information. We never receive your card number, billing address or bank details; Apple keeps those.

2.6 Support requests

If you contact us through the in-app support feature or by email, we receive the subject and text of your request, any screenshots you attach, your language, and technical details that help us reproduce the problem (app version, device model, iOS version). Support conversations are tied to your account so you can see our replies in the app.

2.7 Usage, diagnostics and security data

• How you use the app. Which screens you open and for how long, which features you use, and events such as sign-up, purchases and reports, tied to a random user identifier.
• Crash and error reports. If the app crashes or a request fails, we receive a technical report (the error, the app version, the device model and iOS version). Message text, photos and audio are never included in these reports.
• Interaction signals. Coarse patterns of taps and scrolling that help us tell people from automated scripts. These signals do not record what you type.
• Network data. Your IP address and standard request metadata, which every internet service receives when you connect to it. We derive an approximate country from your IP address to apply regional settings and to prevent abuse. We do not derive a street-level or city-level location from it for any product purpose.

2.8 Notifications

If you allow notifications, we receive a push token from Apple that lets us deliver them to your device. You can turn notifications off, in total or by category, in the app or in iOS Settings, and the token is removed when you delete your account.

3. The data we do not collect

• We do not access your photo library. Only the individual photos and videos you select and send are uploaded.
• We do not access your contacts, calendar, health data or files.
• We do not collect your precise location, and we never ask for location permission.
• We do not collect payment card numbers, government identification numbers or biometric identifiers used to identify you.
• We do not track you across other companies' apps and websites, we do not use an advertising identifier, and the app never shows the App Tracking Transparency prompt because there is nothing to ask for.
• We do not show third-party advertising and we do not include advertising networks' software in the app.

4. How we use your data

We use the data described above for the following purposes. Where the law requires a legal basis (for example under the GDPR), it is shown next to each purpose.

Purpose	What we use	Legal basis
Running the service: generating character replies, photos and voice messages, keeping character memory, restoring your account on a new phone	Account, profile, messages, media, memory	Performance of our contract with you
Processing purchases, applying subscription benefits and credit balances, handling refunds and disputes	Purchase data from Apple	Performance of our contract; legal obligation (accounting)
Sending notifications you have allowed	Push token, notification preferences	Your consent (withdraw any time in Settings)
Keeping the service safe: preventing abuse and fraud, enforcing our rules, reviewing reports, protecting minors, detecting automated scripts	Messages and media when reported or flagged, usage and interaction signals, network data, device identifier	Our legitimate interests in a safe service; legal obligations
Answering support requests	Support messages, screenshots, technical details	Performance of our contract; legitimate interests
Understanding how the app is used and fixing errors	Usage events, crash and error reports, device and app version	Our legitimate interests in improving the app
Creating a character from a photo you upload	The uploaded photos and the identity reference derived from them	Your explicit consent (see section 7)
Complying with the law and defending legal claims	The minimum data needed in each case	Legal obligation; legitimate interests

We do not sell your personal data. We do not use it for targeted advertising, and we do not share it with data brokers. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

5. How LORAX AI handles your conversations

The characters in LORAX are powered by LORAX AI, our own AI system. It runs on private server infrastructure that we control. When you send a message, a photo, a voice message or a live-stream frame, LORAX AI interprets it and generates the character's response. This is the only way the app can work: without it, nobody writes back.

• No third-party AI providers. Your messages, media and interactions are processed by LORAX AI on our private infrastructure. No user data is sent to third-party AI providers.
• Never sold, never used for ads. Your conversations are used to write back to you and to keep the characters consistent. They are not sold, not used for advertising, and not shared with anyone for their own purposes.
• Character memory. Characters remember what you tell them so that conversations stay coherent over weeks. You can make a character forget everything about you at any time (see section 9).
• Automated safeguards. Automated systems check content against our rules, for example to block attempts to produce content involving minors and to detect automated abuse. These systems act on the content of the conversation; they do not profile you for marketing.
• Limited human access. A small number of authorised staff can access conversation content only when it is needed to review a report you or someone else submitted, to answer a support request you opened, to investigate abuse or fraud, or to fix a technical fault. Access is restricted to those cases and is logged.

6. Who receives your data

We use a small number of service providers to run LORAX. They process data on our behalf, under contracts that limit what they may do with it, and they are not allowed to use it for their own advertising or to sell it.

Provider	What they do	What they receive
LORAX AI (our private server infrastructure)	Generates character replies, photos and voice messages; keeps character memory	Messages, media you send, live-stream inputs, the identity reference for characters you create
Apple Inc. (USA)	In-app purchases and subscriptions; push notifications; iCloud Keychain backup of your device identifier	Purchase transactions; push token; the device identifier stored in your own Keychain
Amazon Web Services (EU region, Frankfurt, Germany)	Hosting of our servers and databases; encrypted storage of media files	All data stored by the service, in our own accounts, encrypted at rest for media
PostHog Inc. (USA)	Product usage analytics and crash reporting	Event names and counters, screen names, app and device version, error information, the random user identifier, and an approximate location derived from your IP address. Message text, photos and audio are never sent to PostHog.
Cloudflare, Inc. (global network)	Network security, denial-of-service protection and content delivery for our website and our servers	IP address and request metadata for the connections it protects

Beyond these providers, we disclose personal data only when the law requires it (for example a valid court order), when it is necessary to protect the safety of a person or to prevent serious harm, or, if the company or the app is ever sold or merged, to the new operator under this same policy. We will tell you before any such change of operator takes effect.

7. Photos you upload to create a character

When you create your own character you can optionally upload a face photo and a full-body photo. You can also create a character without any photo. If you do upload one, this is exactly what happens:

• Purpose. The photos are used only to generate that character's appearance and to keep it consistent in the images the character sends you later. They are processed by LORAX AI on our private image-generation infrastructure for that purpose alone.
• Identity reference. To keep the character consistent, an internal visual identity reference is derived from your photo and stored on our servers for as long as the character exists. It is never shown to you or to anyone else, and it is not used to identify you.
• What we never do with them. The photos and the identity reference are not used for advertising or marketing, not used for face recognition or identity verification, not used to train models offered to anyone else, and not shared with third parties for any of those purposes.
• Deletion. When you delete the character, or when you delete your account, the uploaded photos and the identity reference are permanently deleted.
• Your promise to us. You may only upload a photo of yourself, or of an adult who has given you their clear permission. Uploading a photo of anyone else, or of a minor, is a breach of our terms and leads to the character and, where appropriate, the account being removed.

We ask for your explicit consent in the app before any photo is uploaded. If you decline, you can still create a character without a photo.

8. Live streams

The live-stream feature lets you go on camera while the characters watch and react. During a stream, your camera image and microphone audio are sent to LORAX AI in real time so that the characters can respond to what they see and hear. The inputs from a live stream are not stored once LORAX AI has interpreted them: the camera frames and the audio are discarded, and only the resulting chat messages remain in your conversation history. Live streams are never broadcast to other people; the only audience is the AI characters.

9. Your controls inside the app

You do not have to write to us to exercise most of your choices. The app gives you direct controls:

• Remove a conversation from your app, or make a character forget everything about you. Both are available from the character's profile.
• Block a character so it can no longer write to you.
• Report a message from inside any chat, with a reason and an optional note.
• Notifications: turn them off by category, or entirely, in Profile → Notifications, or in iOS Settings.
• App lock and alternative icon: protect the app with Face ID or your passcode, and change the icon shown on your home screen.
• Delete your account: Profile → Account → Delete account. This is permanent and is described in section 10.

10. How long we keep data, and deletion

We keep your data for as long as your account exists, because the characters need it to remember you. When you delete your account in the app, the following happens:

• Your account is closed immediately and can no longer be used or restored.
• Your profile, your conversations and messages, the characters' memory of you, the media you sent, the media generated for you, and any characters you created together with their identity references are permanently deleted. Copies in our backups are removed as the backups roll off, within 30 days.
• The local copy of your data on your phone is wiped by the app.
• If you open the app again afterwards, a completely new and empty account is created. The old one never comes back, and we cannot recover it for you.

Deleting your account does not cancel an Apple subscription. Cancel the subscription in iOS Settings → your name → Subscriptions first, or Apple will keep billing you.

A limited set of records is kept after deletion, because we need it to run the service honestly and lawfully:

Record	Why we keep it	How long
Purchase and subscription records received from Apple	Accounting and tax law; refund disputes	For the period required by tax and accounting law
A hashed device identifier and counters of free allowances already used on that device, the number of accounts deleted from it, and whether a refund was granted	To prevent the free allowances from being obtained again and again by deleting and recreating accounts, and to enforce our rules against repeat violations. These records contain no messages, media or profile data.	For as long as needed to prevent abuse
Support conversations	Follow-up questions and disputes	Up to 24 months after the request is resolved
Reports you submitted, and records of enforcement actions	Safety, and defending legal claims	Up to 24 months, longer if required by law or an ongoing investigation
Server and security logs (IP address, request metadata)	Security, abuse prevention, fault diagnosis	For as long as needed for security purposes, typically no more than 12 months
Analytics events	Understanding how the app is used	Kept by our analytics provider for a limited period, then deleted or reduced to aggregated statistics that no longer identify you

Aggregated statistics (for example how many people used a feature in a month) contain nothing that identifies you and may be kept indefinitely.

11. Where your data is processed

Our servers and databases are hosted in the European Union (Amazon Web Services, Frankfurt, Germany). Our company and staff are in Türkiye, so your data is accessed from there. Our analytics provider is in the United States, Apple processes purchases and notifications through its global infrastructure, and Cloudflare operates a global network. Where personal data is transferred to a country whose laws do not provide the same level of protection as yours, we rely on the safeguards recognised by the applicable law, such as the European Commission's standard contractual clauses or an adequacy decision, and, where your local law requires it, on the consent you give in the app.

12. Security

We protect your data with technical and organisational measures that match its sensitivity:

• Everything between your phone and our servers travels over an encrypted connection (TLS 1.3).
• Media files are stored encrypted at rest.
• Access to production systems is limited to authorised staff, protected by strong authentication, and logged.
• Our servers sit behind network protection that filters malicious traffic before it reaches them.
• We never receive or store payment card details; Apple handles all payments.

No system is perfectly secure. If you believe your account has been accessed without your permission, or you have found a security problem, write to info@loraxchat.com and we will respond quickly. If a security incident affects your personal data, we will notify you and the competent authorities as required by law.

13. Your rights

Depending on where you live, you have rights over your personal data. We honour them for everyone, regardless of location, wherever we reasonably can.

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to correct data that is inaccurate. Your name, language and preferences can be changed directly in the app.
• Deletion: delete your account in the app, or ask us to delete your data.
• Portability: ask for the data you gave us in a machine-readable format.
• Objection and restriction: object to processing based on our legitimate interests, or ask us to restrict it while a request is being handled.
• Withdraw consent: where processing is based on consent (notifications, photos uploaded to create a character), you can withdraw it at any time. Withdrawal does not affect processing that already took place.
• Complain: you can lodge a complaint with your data protection authority.

European Union, United Kingdom and Switzerland. The rights above are those set out in the GDPR, the UK GDPR and the Swiss FADP. You may complain to the supervisory authority of your country of residence.

California and other US states. You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for exercising your rights. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use sensitive personal information for purposes beyond providing the service you asked for. Because we do not sell or share, there is nothing to opt out of, and we do not respond to "Do Not Sell" browser signals differently from any other visitor: everybody is treated as opted out.

Türkiye. You have the rights listed in Article 11 of the Personal Data Protection Law (KVKK), including the right to learn whether your data is processed, to request information, to request correction or deletion, and to object to results that arise from automated analysis. Requests can be sent to the contact address below.

Brazil, Canada, Australia and elsewhere. Similar rights exist under the LGPD, PIPEDA, the Australian Privacy Act and other laws. Use the same contact address; we will apply the law that protects you.

How to make a request. Use the controls in the app, or write to info@loraxchat.com. Because LORAX accounts are tied to a device rather than an email address, we may ask you to make the request from the app on that device, or to give us details only the account holder would know, so that we do not hand your data to someone else. We respond within the time required by the applicable law, and normally within 30 days.

14. Children

LORAX is not intended for children. To use it you must have reached the age of majority in your country of residence and meet the minimum age shown for the app on the App Store. We do not knowingly collect personal data from anyone below that age. If we learn that an account belongs to someone who does not meet the requirement, we remove the account and its data. If you believe a child is using LORAX, write to info@loraxchat.com.

15. The loraxchat.com website

• No cookies. The website sets no cookies and stores nothing on your device.
• Cookieless analytics. We measure page views and clicks on the download buttons with PostHog, configured to keep nothing on your device. It receives the page you viewed, the referrer, your browser and device type, and an approximate location derived from your IP address. This measurement is not linked to any LORAX account.
• Network protection. The site is delivered through Cloudflare, which processes your IP address and request metadata to protect the site.
• Links to Apple. Download buttons lead to the App Store. They carry a campaign tag that tells us which page you came from; they carry no personal data.
• Server logs. Like every website, our server records requests (IP address, page, time, browser) for security and fault diagnosis. These logs are kept for a limited period as described in section 10.
• No forms. The site has no sign-up, login or contact forms. The only way to write to us is by email, and your email is then handled as a support request.

16. Changes to this policy

When we change this policy we update the effective date at the top of the page. If a change materially affects how we use your data, we announce it in the app before it takes effect. Continuing to use LORAX after the effective date means the updated policy applies.

17. Contact

ASYNC YAZILIM BİLİŞİM PROGRAMLAMA SAN. VE TİC. LTD. ŞTİ., Türkiye
Email: info@loraxchat.com

Related documents: Terms of Service · Support · Safety · Fiction notice