Sovvi Privacy Policy

Last updated: November 2, 2026 Effective date: November 2, 2026

This Privacy Policy explains what personal information OPENIM CORPORATION LIMITED (the "Platform", "we", "us") collects when you use the Sovvi iOS app, its sharing web pages and related services (the "Service"), how we use it, who receives it, how we store and protect it, how long we keep it, and the rights you have. It forms one agreement with our Terms of Service. This policy explains our information practices; where processing requires your consent, we explain it and obtain that consent separately.

In short

• We collect only the information the Service needs. We do not sell your personal information, show no ads, do not track you across other apps or websites, and the app contains no third-party advertising or analytics SDKs.
• Once you consent to AI processing, the ideas, answers, text and material descriptions needed for creation are sent to DeepSeek in China. Photo description suggestions send a thumbnail of the photo. Picture and sound creation materials themselves are not sent; see section 3 for the full scope.
• Your saved items, browsing history and idea note stay on your device.
• You can delete your account in the app at any time, and deletion takes effect immediately.

1 What we collect and why

1.1 What you give us

1. Account information
   • What: your email address and password when you sign up with email; the account identifier, email address and name that Apple or Google gives us when you sign in with them.
   • Why: to create your account and sign you in, verify your email, reset your password, and send account and security notices. We keep only a salted hash of your password, never the password itself; codes we email you are also kept only as hashes and expire after 15 minutes. We keep an email address from Apple or Google only if the provider verified it (with Apple you can choose to share only an Apple relay address); the name is only your first nickname, and you can change it. We never get your Apple or Google password. Without account information you cannot use the features that need an account.
2. Profile
   • What: your nickname and profile picture (a preset picture or a photo you upload).
   • Why: shown to others on your profile, posts, comments, messages and in works' lists of participants. An uploaded photo is re-encoded as a square image without any metadata.
3. What you post and do
   • What: photos, videos, text and works you post; comments, likes, follows and blocks; what you do in works (progress, choices, contributions such as text, scores, pictures and places, and leaderboard scores); direct and group messages (text, photos, videos, post cards); the interests you pick when you first start.
   • Why: to show your content to the audience you choose, provide the social features, keep your progress and show public contributions to people who can see the work, deliver messages and keep them on our servers so you can read them on your devices, arrange recommendations, and keep the Service safe. Your phone removes location and other metadata from photos, and our server re-encodes them keeping only the picture; videos are converted on your phone without metadata.
4. AI creation
   • What: your ideas, answers to questions, change requests, materials you upload (pictures, sounds, text), and the drafts and versions that are generated.
   • Why: to make and change your works (see section 3).
5. Reports, appeals and feedback
   • What: the reasons and notes you give when you report or appeal, and emails you send us.
   • Why: to check reports, handle appeals, reply to you and provide support.

1.2 What we collect automatically

1. Sign-in sessions: the kind of device (for example "Sovvi for iPhone"), when each session started and was last used; our servers keep only a hash of the credential. To keep you signed in and list your devices under Signed-in devices.
2. Push notifications: when you allow notifications, your phone's push token and the app's language, the kinds of notification you turned off, and the chats you muted. To send notifications. The token goes with the sign-in session and is deleted when you sign out or delete your account. The words of a message in a notification pass through our server's memory only and are not stored.
3. What you see in recommendations and Explore: the posts you have seen and the posts you marked as not interested. Used only to order recommendations.
4. Consent records: the abilities you allowed each work to use; when you ticked your agreement to the Terms and this policy (at sign-up); and when you agreed to AI processing. To record your consent and handle withdrawal; the time you agreed to AI processing is cleared when you withdraw it, and both are cleared when you delete your account.
5. Rooms and message records: the rooms of multiplayer works you were in (which room, which seat, when), and a record of each message you sent (message ID, sender, conversation, a SHA-256 digest of its words, never the words). To handle reports and prevent abuse; what happens in rooms is not saved.
6. Server access logs: IP address, time, the address requested, and the type of app or browser. For security, troubleshooting and preventing abuse; the IP address is also briefly used in memory for rate limiting. Search terms are not stored in the database, and access logs record only the path requested, not search terms or other query parameters or the referring page.

We do not collect precise location, contacts, the advertising identifier (IDFA), health data or payment information, do not collect crash or performance statistics, and do not work out your location from your IP address.

1.3 What your device's permissions allow

These abilities are used only when you use the relevant feature, never silently in the background. Abilities requiring system authorization request that permission; you can refuse or turn it off in device settings. You actively select photos and videos in the system picker, without giving the app access to your whole library.

1. Notifications (optional): to tell you about messages, comments and replies, new followers, likes, taking part and remixes, review results and system notices; each kind can be turned off in the app under Settings › Notifications.
2. Photos (optional): when you post or use a work, the app gets only the photos or videos you pick in the system photo picker; a work gets only the one photo you pick, which is uploaded only if the work submits it as a picture in a shared work. Saving to your photos only writes; it does not read your library.
3. Approximate location (optional): read once, only when a work asks, rounded to two decimal places (about 1 km) before the work gets it; we never use your precise location. When a work needs a city name, this approximate location is sent to Apple's geocoding service. If a work writes a place into your contribution, it is stored with the contribution and visible to everyone who can see the work.
4. Microphone (optional): works get only loudness and pitch; nothing is recorded, and the sound never leaves your device.
5. Motion and orientation: given to works on your device only and never uploaded.
6. Reminders: a work's reminders are local notifications on your device and never pass through our servers.

The app does not use the camera and does not read your contacts. If a future version needs a new permission for a new feature, we will tell you and ask for your consent first.

1.4 What stays only on your device

Saved items, browsing history, the idea note, unsent posts you chose to keep, caches of works and thumbnails, and this device's copy of your messages. The first items are never uploaded to our servers; they stay when you sign out and are cleared when you delete your account. The copy of your messages is deleted when you sign out. Your sign-in credentials and messaging token are kept in the system keychain. Drafts and versions made with AI are stored on our servers (see 1.1).

1.5 When you are not signed in

When you browse without signing in, the Service gives you a temporary guest session (24 hours); interests you pick during it are deleted when it expires. Without an account you cannot like, comment, save, post, create or send messages, but you can report posts, comments and profiles; we do not link what you browsed as a guest to an account you sign in to later. The sharing web pages use no cookies and only keep actions not yet confirmed in your browser's local storage.

2 How we use and show information

2.1 How we use it

1. Providing the Service: accounts, showing content, running works and taking part in them, direct messages, group chats and multiplayer rooms, and AI creation.
2. Recommendations: ordering recommendations by the interests you picked and the posts you have seen or marked as not interested. You can change your interests at any time under Settings › Topics you like, or choose "Not interested" on a post.
3. Safety and moderation: reviewing the posts and works you publish, handling reports and appeals, preventing spam and abuse, and enforcing the Terms. Direct messages and group chats are checked only when they are reported.
4. Notifications: sending you activity alerts and necessary service notices.
5. Improving the Service: troubleshooting and learning whether features work well, using only aggregated or de-identified data.
6. Legal obligations: cooperating with lawful investigations by competent law enforcement, judicial or regulatory authorities where the law requires it.

We do not use your information for advertising or to train our own AI models, and we do not use it for any purpose unrelated to this policy.

2.2 Who can see your information

1. Other users: your nickname and profile picture, the content you post (to the audience you choose), your comments, your contributions in shared works (with your nickname and profile picture), and your seat and nickname in multiplayer rooms. Your email address is never shown to other users.
2. Direct messages and group chats: only the people in the conversation.
3. Works: the information you allowed when you took part (see 1.3).
4. Our staff: only designated staff, as needed to review content, handle reports and appeals, and provide support. Viewing an account's email address is recorded in an audit log.
5. Disclosure required by law: where applicable law or a competent court or authority requires it; where necessary to protect users, the public or our rights and safety (for example, reporting child sexual exploitation); and in a merger, acquisition or asset transfer, where the recipient remains bound by this policy.

3 Third-party AI and other service providers

We do not sell or rent your personal information to anyone. We give the following providers only the information needed for each function and require them to process it only on our instructions and with appropriate security. Direct messages are handled by systems we run ourselves and are not given to third parties (except the content of notifications, see the table).

Consent to AI processing: before you first create with AI, the app tells you what is sent and to whom, and asks for your consent; until you agree, nothing you create and none of your photos is sent to the model provider. You can withdraw it at any time by turning off "AI creation and photo descriptions" in the app's Settings; you then cannot create with AI and get no description suggestions for photos. You can use the rest of the Service without agreeing.

4 Storage, international transfers and retention

4.1 Where information is stored and transferred

Our servers are in Singapore, and connections pass through a relay in Hong Kong; DeepSeek, our AI model provider, processes what is sent to it in China, and other providers may process information in the United States and elsewhere. Your information may therefore be transferred outside the country or region where you live. Where the data protection law that applies to you sets requirements for such transfers, we take the corresponding safeguards (such as standard contractual clauses), and protect your information with measures such as encryption in transit and access controls.

4.2 How long we keep information

We keep personal information only as long as needed for the purposes in this policy:

Deleting your account takes effect immediately and cannot be undone. We end all your sessions; withdraw your participation in works and recount their summaries; delete your likes, follows, blocks, private progress, permission records, profile, drafts and materials, and push devices and notification settings; remove the text of your comments; make your posts invisible to everyone and clear their files and text from our servers after 90 days (as for posts you delete, above); and remove your identity from reports you made. Saved items, history and the idea note that belong to the account are cleared from the device. For an account that signs in with Apple, we also ask Apple to stop Sovvi's use of your Apple ID. Your email address can later be used to register a new account. We keep only usage statistics for generation without your identity, and records the law requires us to keep or that are needed for reports or disputes still open, which we delete when that need ends.

5 Your rights

Under the data protection laws that apply to you, you have the following rights over your personal information:

1. To be informed about how we collect, use, store and share it, through this policy.
2. To access it: you can see your profile, the content you posted, your participation and your signed-in devices in the app at any time.
3. To correct it: you can change your nickname, profile picture, email address and password at any time.
4. To delete it: you can delete your posts and comments, withdraw your contributions in works, and delete your account to delete all of your personal information (see 4.2).
5. To withdraw consent: you can turn off photos, location, microphone, notifications and other system permissions in your device's settings, and withdraw consent to AI processing or turn off kinds of notification in the app's Settings. We then stop the processing concerned; what was done with your consent before is not affected.
6. To adjust recommendations: you can change your interests under Settings › Topics you like, or choose "Not interested" on a post.
7. To appeal and complain: you can appeal moderation decisions about your content or account, and complain to your data protection authority (for example the UK ICO, the Australian OAIC, the New Zealand Office of the Privacy Commissioner, Singapore's PDPC or the Office of the Privacy Commissioner of Canada).
8. To data portability: where the law provides for it and it is technically feasible, you can ask for a copy of your personal information.

Residents of certain US states: we do not sell your personal information or "share" it for cross-context behavioral advertising. You can exercise the rights your state's law gives you as described below, and we will not discriminate against you for doing so.

How to make a request and when we respond: for requests you cannot complete in the app, email us at the address at the end of this policy. To protect your account we first verify your identity, and we respond within 15 working days of verifying it (or a shorter period if the law where you live requires).

6 Children

The Service is only for people aged 18 or over. We do not knowingly collect personal information from minors. If we find an account belonging to a minor, we will disable it and delete its information. If you believe a minor is using the Service, please contact us or report it in the app.

7 Security

1. We take reasonable technical and organizational measures to protect your information, for example: encryption in transit (TLS); keeping only hashes of passwords, verification codes and sign-in credentials; running works in an isolated environment without access to your sign-in credentials; and limiting access to our admin tools to designated staff, with their actions recorded in an audit log.
2. No system is perfectly secure. If a security incident affecting your personal information occurs (such as a data breach), we will act at once to contain it and notify the authorities concerned and the affected users as the law requires.
3. Please keep your password, email verification codes and sign-in credentials safe, and do not let anyone else use your account.

8 Changes to this policy

1. We may revise this policy as our features or the applicable law change.
2. For significant changes to the purposes of processing, what we collect or your rights, we will tell you in the app or with a prominent notice; for corrections of wording or layout, we will update this page and its "Last updated" date.
3. Updating this policy does not replace any consent that must be obtained separately. When new or changed processing requires your consent under applicable law, we explain it and obtain consent before starting it. You may refuse or withdraw consent; we explain any effect on the features concerned.

9 Contact us

If you have any question, comment, complaint or request about this policy or how your personal information is handled, contact us:

• Email: contact@openim.io
• Operator: OPENIM CORPORATION LIMITED