Legal

Privacy Policy

What information Myrlo collects, how we use it, who we share it with, and the choices you have.

Effective

This Privacy Policy explains what information Myrlo collects, how we use it, who we share it with, and the choices you have. It applies to the Myrlo website and web app at myrlo.app and the Myrlo iOS app (together, "Myrlo" or the "Service").

Myrlo is operated by Brandon Diaz LLC, an Oregon limited liability company ("we," "us," "our").

1. Myrlo is for adults only

Myrlo is for people 18 and older. We don't offer accounts for anyone under 18, and there are no parental controls. The iOS app is rated 18+ on the App Store. By using Myrlo, you confirm that you're at least 18 (or the age of majority where you live, if that's higher). If we learn an account belongs to someone under 18, we'll close it.

2. Information we collect

Information you give us

  • Account information. Your email address. You sign in with either:
    • Email one-time code: we email a short code to the address you enter. It expires soon after it's sent.
    • Sign in with Apple: Apple sends us a verified email address (this may be an Apple "Hide My Email" relay address) and a token, which we store with your account.
  • Username. If you set a public handle, it appears on your public creator profile along with the date you joined.
  • Your Lives and chats. The messages you write, the story text the AI writes back, and the story state that keeps your Life consistent (for example, characters you've met, places, relationships, and memory or continuity notes). Private chat may include mature 18+ fiction.
  • Personas (the character you play). The details you give it: name, backstory, gender identity, sex, pronouns, age band, and appearance and style (for example species, ancestry or ethnicity, hair, eyes, build). We use these to write your story and create portraits.
  • Preferences. Settings such as which characters you'd like cast as romantic interests, narration model, text size, theme, speed, and haptics.
  • Content you create. Stories, Characters, Pathways, Qualities, library entries, drafts, images you generate for them, and your conversations with Myrlo's creator assistant.
  • Community activity. Reports you file, content you save, votes, and Fragment tips you send or receive.
  • Messages to us. If you use the contact form (myrlo.app/contact) or in-app feedback, we collect your name, email address, and message.

Information collected automatically

  • Usage and activity. For example: sign-ins, Lives and Stories started, messages sent, retries and rewinds, images generated, Fragments earned, spent, and tipped, Contracts completed, rewarded ads watched, searches, catalog pages visited, and when you were last active.
  • Safety signals. Automated moderation results for AI requests and responses, and records of messages our prompt-injection filter strips or blocks. These records can include the original message text.
  • AI usage records. Technical details of AI requests, such as the model used, token counts, and timing.
  • Device and technical information. IP address, browser or device type, app version, and request details in server logs. We also collect your time-zone offset, which we use for in-story time. We use your IP address or account ID to rate-limit requests.
  • Purchase information. Whether you have Premium, when it expires, and purchase or transfer events from our payment partners. We never receive or store your full card number.
  • Push notification token (iOS). If you allow notifications, we receive a device token so we can send you push notifications.
  • Advertising data (iOS). If you watch optional rewarded ads in the iOS app, Google AdMob collects device and ad-interaction data. If you allow personalized ads, it also collects your advertising identifier. See section 9 for your choices.
  • Website analytics. Our public website uses Databuddy, a cookieless, privacy-focused analytics tool, to measure page visits, engagement, and outbound link clicks. Databuddy isn't used inside the web app at myrlo.app/play.

Cookies and on-device storage

Myrlo itself doesn't use advertising cookies. The app keeps your sign-in token, a cached Fragment balance, and simple counters (like how many times you've opened the app) in your browser's local storage or in the app's storage. On iOS, the app may check your battery level on your device to decide when to show a "rate this app" prompt. That reading isn't sent to us. Third-party payment providers, such as RevenueCat and Stripe during web checkout, may use their own cookies or similar technologies under their own policies.

3. How we use information

  • To create and secure your account and sign you in.
  • To run your Lives: generating story responses, keeping continuity and memory, casting characters, and generating images you ask for.
  • To show content creators choose to publish, and to run creator tools.
  • To process Premium subscriptions and any Fragment purchases, grant daily Fragments and rewards, process tips, and deliver ad rewards.
  • To keep Myrlo safe: automated moderation, prompt-injection filtering, handling reports, reviewing published content, preventing fraud and abuse, and enforcing our Terms and Community Guidelines.
  • To provide support and respond to messages.
  • To send service emails (like sign-in codes), push notifications, and product emails (like welcome, getting-started, and "we miss you" messages).
  • To understand usage, fix bugs, improve performance, and plan features.
  • To comply with legal obligations.

We don't sell your personal information for money, and we don't use your chat content to target ads.

4. AI processing

Myrlo works by sending your content to third-party AI model providers so they can generate responses and images:

  • Story text is generated by third-party AI model providers. Some requests go directly to a provider such as OpenAI; others go through routing services such as OpenRouter, which pass them to the model provider behind the option you picked. A request can include your recent messages, relevant story context, and your persona details.
  • Story management and creator tools (continuity tracking, memory, the creator assistant, publishing checks, and similar jobs) use OpenAI, including OpenAI's moderation checks. Instead of your email, we send OpenAI a hashed identifier derived from it, to help detect abuse.
  • Search and memory. Story and memory text is turned into search embeddings inside our database provider (MongoDB Atlas) so Myrlo can recall relevant details.
  • Images (portraits, scene photos, story art) are generated from text prompts built from your scene and persona details. They're generated on Comfy Cloud and on bare-metal image servers Myrlo operates, then stored and delivered through Cloudinary.

We don't train AI on your data. Myrlo doesn't use your content or data to train any text or image models.

AI providers have their own policies. Content we send to AI providers may be kept by them. Depending on each provider's settings and policies, they may also use it, including to improve their own models. OpenAI has data sharing and temporary storage enabled. Providers reached through OpenRouter handle data under their own retention and training policies. Please don't put information in your chats that you wouldn't want processed this way.

AI output is generated automatically and can be inaccurate, strange, or offensive. See our Terms of Service.

5. Who can see your chats

  • You. Players see only their own chats.
  • Not creators. If you play a Story or meet a Character someone else made, that creator can't read your private play.
  • Staff. Authorized Myrlo staff can access chats when needed for safety, moderation, legal compliance, or support. This access is limited and purposeful.
  • Service providers. AI and infrastructure providers process chat content to run the Service, as described in sections 4 and 6.

Content you publish (Stories, Characters, Pathways, Qualities, and their images), your username, and your join date are public. Published content can appear in, and shape, other players' Lives.

6. Service providers we share information with

We share information only as needed to run Myrlo:

  • Amazon Web Services: server hosting (all data the Service processes).
  • Cloudflare: network delivery and security (traffic data such as IP address and request details).
  • MongoDB Atlas: database and search (account data, chats, content, usage).
  • OpenAI: AI generation, story management, creator assistant, and moderation (chat and story context, created content, hashed user identifier).
  • OpenRouter and the AI model providers it routes to: AI story generation (chat and story context, persona details).
  • Comfy Cloud: image generation (image prompts built from scene and persona details).
  • Cloudinary: image storage and delivery (generated images).
  • Plunk: email delivery for sign-in codes and product emails, and forwarding contact-form and feedback messages to us (email address, sign-in codes, message contents).
  • RevenueCat: subscription and purchase management (account ID, email address, purchase history).
  • Apple: Sign in with Apple, App Store payments, and push notifications (sign-in details, device token; Apple handles App Store payment).
  • Stripe, via RevenueCat Web Billing: web checkout (your payment details go to Stripe, not to us).
  • Google AdMob (iOS): rewarded ads (device and ad-interaction data; advertising identifier if you allow personalized ads; account ID for reward verification).
  • WinwinKit: referral codes (account ID, Premium status, sign-up date).
  • Databuddy: cookieless website analytics (page visits and engagement on our public site).
  • Discord: our optional community server (only what you post there, under Discord's policies).

We may also disclose information when the law requires it, to protect people's safety, to enforce our Terms, or as part of a merger, sale, or reorganization. We may report illegal content, including child sexual abuse material, to the appropriate authorities.

7. How long we keep information

We don't set fixed retention periods. We keep information on a rolling basis for as long as we need it to operate the Service and for security, safety, fraud prevention, and legal obligations, and we delete it periodically after that. Specifically:

  • Account data is kept while your account exists.
  • Lives and chats are kept until you delete them or delete your account. Deleting a Life removes its chat, its continuity and memory data, and that Life's persona.
  • Deleted Stories and Characters are removed from the catalog, then permanently deleted.
  • Copies held by providers (for example AI providers, email, payments, and image hosting) follow those providers' own retention policies.

8. Deleting your account

You can delete your account yourself in Settings → Delete Account. Support can't delete accounts for you, because deletion has to happen from the signed-in account to make sure we delete the right one.

When you delete your account:

  • We delete your account record (email, username, preferences, balances, and entitlements) and your story continuity and memory data.
  • We permanently delete the Stories and Characters you created, including published ones.
  • We remove every Life and chat tied to those Stories and Characters, including other players' Lives that use your published content. Those players will see that the Life can no longer be loaded and will be asked to remove it.
  • Other information linked to your account (such as logs, reports, analytics, and safety records) is deleted or kept only as needed for functionality, safety, fraud prevention, and legal purposes.

Deleting your account doesn't cancel an App Store or web subscription. Cancel it with the store you used.

Data export. You can request an export of the worlds, characters, and stories you authored from Settings → Export my data, or from an item's Export menu. We email you CSV files of that authored text and your chosen settings. Play history and generated narration are not included.

9. Your choices

  • Access and correction: view and edit your profile, personas, preferences, and content in the app.
  • Deletion: delete individual Lives, personas, and content in the app, or delete your whole account in Settings.
  • Personalized ads (iOS): the app asks whether you want to allow personalized ads. If you say no, AdMob can still show rewarded ads, but they won't be personalized. You can change this later in iOS Settings → Privacy & Security → Tracking.
  • Push notifications (iOS): turn them off anytime in iOS Settings → Notifications → Myrlo.
  • Marketing emails: unsubscribe with the link in any product email. We'll still send transactional emails, such as sign-in codes.
  • Other requests: use myrlo.app/contact.

10. If you're in the EEA, UK, or Switzerland

Myrlo is available worldwide. If the GDPR or the UK GDPR applies to you:

Controller. Brandon Diaz LLC is the controller of your personal data.

Legal bases. We process your data:

  • to perform our contract with you (providing your account, Lives, creation tools, purchases, and support);
  • for our legitimate interests (keeping the Service safe and secure, preventing fraud and abuse, moderation, analytics, and improving Myrlo), balanced against your rights;
  • with your consent (personalized ads, and marketing emails where consent is required). You can withdraw consent at any time;
  • to comply with legal obligations.

Your rights. You can ask to access, correct, or delete your data; restrict or object to certain processing; get a copy of data you gave us (data portability); and withdraw consent. You can request an authored-content export in Settings or from an item's Export menu. For other requests, use myrlo.app/contact. We may need to verify your identity. You can also complain to your local data protection authority.

International transfers. Myrlo is based in the United States. We transfer your data to the US and other countries where our providers operate. Where required, we rely on standard contractual clauses or equivalent safeguards.

11. US state privacy rights

Depending on where you live, you may have rights under US state privacy laws. Where those laws apply, you can:

  • ask to know or access the personal information we have about you;
  • ask us to delete or correct it;
  • opt out of personalized (targeted) advertising. On iOS, decline personalized ads when the app asks, turn off tracking in iOS Settings, or contact us;
  • appeal our decision on your request.

Send requests through myrlo.app/contact. We may need to verify your identity, and you can use an authorized agent where the law allows. We don't sell personal information for money. We won't discriminate against you for exercising these rights.

12. Security

We protect your data with HTTPS encryption in transit (with HSTS) and encryption at rest. We also use signed, expiring sign-in tokens, sign-in codes that expire quickly, access controls on staff tools, and rate limiting. Our database and internal cache aren't exposed to the public internet. No system is perfectly secure, and we can't guarantee absolute security.

13. International data

Your information is stored and processed in the United States and in other countries where our service providers operate.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll tell you in the app or by email before they take effect, and we'll update the effective date above.

15. Contact

For privacy questions and requests, use the support form at myrlo.app/contact, also linked in the app. Community: myrlo.app/discord.

Related: Terms of Service · Community Guidelines