Privacy Policy

Information you give CaveSignal

We process account details such as your email, display name, and sign-in identifiers. For your private character, we store the name, chosen Nova or Ember artwork collection, theme, optional fictional description, its owner-authored identity version, selected private long-term memories when you turn memory on, and states you explicitly select. We also process support preferences, private notes, consent records, trusted-circle activity, invitations, referral-reward status, deliberate sharing, and Cave Notes you choose to create. CaveSignal does not ask for a character photo, voice, date of birth, exact age, address, exact location, diagnosis, or medical condition.

Google sign-in data

If you choose Continue with Google, CaveSignal requests only the standard OpenID Connect identity scopes needed to sign you in: openid, email, and profile. We use the returned Google account identifier, verified email, and basic profile details only to authenticate you, create or locate your CaveSignal account, and display your name. CaveSignal does not access Google Drive, Gmail, contacts, calendars, or passwords, and does not use Google user data for advertising or AI model training. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Google sign-in is also governed by Google's Privacy Policy and Terms of Service.

Why we process information

We use information to authenticate you, save your private character and history, provide features you request, deliver service messages, process a subscription when requested, prevent abuse, and keep the service reliable. Product measurement is limited to server-side daily counts and first-use milestone times. It never includes the character name, selected state, support preference, private note, Cave Note text, email, or trusted recipient.

Character privacy and trusted sharing

Your character row, full history, and optional private notes are visible only to your account. Creating or accepting a trusted connection does not reveal them. When you confirm a share, CaveSignal creates a separate, fixed copy of that shared update containing only the character name and saved Nova or Ember artwork collection and theme needed for presentation, selected state, support preference if you choose to include it, an optional message, and required timestamps. Private notes are not included. Stopping a share removes the recipient's access. CaveSignal does not sell character-state or journal data or use it for targeted advertising.

A Circle connection alone does not show your characters. If you separately review and share a Circle character card with one person, CaveSignal saves a fixed copy of only its name, Nova or Ember artwork collection, theme, and optional fictional description. Later private edits do not update that copy automatically. Removing or blocking the connection stops the person from reading the card through CaveSignal. Private memories, conversations, notes, and history are not included.

A separate character connection also requires both owners' explicit approval for specific characters. Only their reviewed Circle cards are used for the shared presentation. If an encounter is later approved, its fictional transcript and pair-specific memory belong to that character pair, not to either owner's private character memory. Either owner can end the character connection. Ending it, removing or blocking the underlying Circle connection, or deleting a participating character or account immediately removes the shared encounter transcripts and pair memory from the active database, without an undo or individual recovery path. Newly generated account exports then exclude that deleted content. Infrastructure backups expire under provider retention and are not used to restore an individually deleted relationship.

For an email invitation, we use the address you enter to deliver the invitation through Resend and keep a keyed one-way match value so only a signed-in account with that verified email can accept it. We do not keep the invitation address in plaintext in the invitation record or offer an email directory. Invitations expire after seven days, can be revoked, and do not reveal to the sender whether the address has an account or whether delivery was possible. You can turn off Circle invitation emails in Account notification preferences; this does not end connections you already accepted.

Optional public character information

A public character page is optional and off by default. If you review the separate publication notice and enable one, CaveSignal copies only the public character name, Nova or Ember artwork collection, theme, fictional description, and any current character vibe you explicitly publish into separate public records. It does not automatically publish your private character record, account name, email, private history, private notes, support choices, Circle, Inbox, Cave Notes, Insights, or billing information. Saving a private entry never changes a public vibe.

Anyone with the random public link can view the information you choose to publish and may copy, screenshot, or redistribute it. Disabling or deleting the page removes access through CaveSignal but cannot remove copies made outside CaveSignal. Public character pages are excluded from CaveSignal's sitemap and use technical controls intended to limit search-engine indexing in this release; those controls are not an absolute guarantee that a third party will never retain or discover a link.

No emotional or mental-health inference

You choose what your character feels. CaveSignal does not analyze a photo, face, or voice, and does not infer or predict your real emotional or mental-health condition. If you choose to use AI character conversations, the message is processed to moderate and generate a fictional reply; it does not determine your state or assess you.

Optional AI character conversations

AI conversations are optional and require a separate, affirmative notice acceptance before use. For each request, CaveSignal sends the new message to OpenAI for moderation. If it passes, the configured AI provider receives only the character name, Nova or Ember artwork collection, fictional description, the latest state you explicitly selected, the character's separate fictional conversation affect, up to 20 recent messages from that conversation, your new message, and, only while character memory is on, a small set of relevant owner-private memories and the current identity version. We do not send your email, account ID, billing details, private entry notes, Cave Notes, Circle, public-page slug, or unrelated history. Conversation messages, fictional affect, your consent, and limited provider-usage records are saved in your account. They do not create or change check-ins, update public presentations, or become ordinary character history. Ordinary AI conversation consent does not also consent to improving CaveMind. Only eligible future messages you write may become private research candidates if you separately enable Help improve CaveMind; generated replies are excluded. Candidates are not automatically exported or used to train a model.

CaveSignal currently uses the OpenAI API to process these AI requests. CaveSignal may later use CaveMind or another provider, and this notice will be updated if the processing changes. OpenAI states that API data is not used to train its models by default. Standard abuse-monitoring logs may retain prompts and responses for up to 30 days. CaveSignal requests non-stored Responses API output with store: false; this does not mean Zero Data Retention. See OpenAI's Privacy Policy, Terms of Use, and API data controls. The separate CaveMind inference service is not enabled in this beta. AI replies may be incorrect and are fictional conversation, not professional, medical, therapeutic, or emergency support.

You can turn off AI conversations from the Talk page by withdrawing this optional consent; no new AI request is then available to your account. Withdrawing consent does not itself erase messages already saved in CaveSignal. You can delete an individual AI conversation from the Talk page or delete its character or your account. AI conversation messages and their associated fictional affect are included in the account data export. OpenAI processes a request under its own service terms and data policies; provider-side retention is separate from deletion in CaveSignal.

Optional private character memory

Character memory starts off for each character. You can turn it on, add a memory yourself, and separately allow selected useful memories from future conversations. CaveSignal does not scan older conversations when you enable that choice. A memory keeps its type, source, dates, and any owner edit or pin status so you can review why it exists. Conversation-derived candidates are proposed by OpenAI from the message you wrote and a small number of relevant existing memories; CaveSignal checks and stores only accepted private candidates.

When memory is on, CaveSignal may send up to five relevant saved memories to the configured AI provider to support a reply. Turning memory off stops new extraction and recall but keeps existing memories until you edit, forget, or reset them. Forget all removes long-term memories without deleting your character identity or original conversation history. Deleting a source conversation removes memories derived from its messages. Memory is never shared through Circle or public character pages and does not enable the separate CaveMind improvement program. Your export includes saved private memories and their provenance.

Optional CaveMind improvement program

This is separate from consent to use AI conversations and from thumbs-up or thumbs-down product feedback. If the Account setting is available, it starts off and requires a separate affirmative choice. If both your choice and the server-side capture setting are on, only eligible conversations created after that choice may be saved as private research candidates. Turning it on does not add earlier conversations.

A candidate may contain a message you wrote, limited fictional character context, your selected character state, separate fictional character affect, up to five earlier messages you wrote, provider and model information, and feedback you give on that reply. It does not copy generated provider replies: OpenAI-generated text is excluded from CaveMind candidates. Email, Google identity, billing, Circle, private notes, public links, authentication data, and unrelated CaveSignal history are excluded. Candidates remain pending for later review; there is no automatic dataset export or training in this release.

You can turn the choice off at any time. This stops future capture but does not delete ordinary AI conversations. Account also offers a separate control to remove unexported candidates, and your account export includes your retained choice history and candidate data. If material is ever used in a completed model dataset under a separately reviewed future program, it may not be possible to surgically remove that material from the already-trained model. No such export or training operation is implemented here.

Service providers and payment data

CaveSignal uses Vercel for hosting; Supabase for authentication and data storage; Cloudflare for security verification; Resend for service email; OpenAI for optional AI character conversations; and Google when you choose Google sign-in. New passwords are screened against Have I Been Pwned's Pwned Passwords service by sending only the first five characters of a one-way password hash; CaveSignal never sends the password itself.

Stripe processes checkout, payment, subscription, and billing-portal information when you choose a paid plan. CaveSignal receives billing status and Stripe identifiers but does not receive or store your full card number. Stripe handles payment information under its Privacy Policy and applicable consumer terms. Providers receive only the information needed for their role and may process it in countries where they operate.

Last-known account display on this device

To show your account navigation promptly, CaveSignal keeps a small last-known display snapshot in this browser: your display name, avatar initial, Free or Plus label, and the name and identifier of your active character. It does not contain passwords, sign-in tokens, conversations, private notes, history, or billing details. The server checks your real sign-in and plan again; the browser snapshot never grants access. It is removed when you sign out on this device and corrected when the app reconnects.

Security and abuse prevention

We use encrypted connections, server-side authorization, database row policies, security challenges, and limited data exposure. Security rate limits use a one-way keyed digest of a requesting network address and, when appropriate, the account or email being protected; raw values are not stored in the rate-limit database. Invitation secrets are stored only as one-way hashes. No online service can promise perfect security.

Retention and your choices

We retain information while it is needed to operate your account, meet security or legal requirements, prevent fraud, or resolve disputes. Deleting a character entry removes its active shares and Cave Notes from the live database with it. Residual copies may remain temporarily only where an infrastructure provider's applicable retention or recovery process keeps them. Deleting a character permanently deletes its private history, private notes, long-term private memories, active shared updates, and related Cave Notes from the live database. The Account page lets you export retained character and account data or permanently delete your account. You can also remove a published vibe, disable or delete a public character page, remove or block a trusted connection, revoke a pending invitation, and stop trusted sharing at any time. Deleting a private character or account also deletes its public character data from the live database.

Age, changes, and questions

CaveSignal's current release is limited to adults aged 18 or older. If this policy changes materially, CaveSignal will ask signed-in members to review the new version. Privacy controls are available on the Account page, and practical sharing boundaries are explained on the Safety page.