Privacy policy
Your memories. Your control.
This policy explains how Until Morrow accesses, processes, stores, and deletes data for its US / en-US mobile release.
1. Who this policy covers
Until Morrow is an AI companion application for adults age 18 and older. “Until Morrow,” “we,” and “us” refer to the independent developer operating the Until Morrow app. The product name and this policy identify the app covered by these practices.
2. Data that stays on your device
Your chosen companion, call sign, messages, approved memories, daily scenes, relationship state, and preferences are stored locally in an encrypted app database. They are not an account or cloud backup. Clearing the app, uninstalling it, reinstalling it, changing devices, or switching platforms can permanently remove this local relationship data. A Store purchase may be restored separately, but local relationship content cannot be reconstructed by Support unless you previously made and kept an export.
3. Data processed to provide the app
| Data | Why it is processed | Default retention |
|---|---|---|
| Message text, recent message context, and final call transcript | After your separate permission, Until Morrow’s service and OpenAI process the text needed to generate the requested reply or speech. The local call sign and approved memories are not included in AI requests, and Until Morrow requests no model-training use. | OpenAI may retain API inputs and outputs for abuse monitoring for up to 30 days by default, with longer retention where required by law or needed to prevent abuse. Until Morrow keeps no separate research copy unless you opt in. |
| Pseudonymous install and conversation identifiers | Secure app operation, privacy requests, metadata analytics, entitlement, and service protection. | For the active relationship and bounded operational or legal needs. |
| Product interactions and diagnostics | Metadata-only analytics and crash diagnosis. Conversation, memory, voice, scene, and call-sign text are prohibited. | According to the configured analytics and crash retention controls. |
| Purchase and entitlement status | Apple or Google processes payment; RevenueCat helps resolve subscription access and restore status. | According to Store, RevenueCat, tax, fraud, and legal requirements. |
| Microphone input | Your device’s speech recognition creates a final transcript for a call turn. | Until Morrow does not upload or retain raw microphone audio; only the final transcript follows the text rules above. |
4. Optional conversation research
Before the first conversation that could be retained, the app asks separately whether you allow research storage. The choice is off by default and declining does not block chat or calls. If you opt in, completed messages you send and receive and final call transcripts may be stored in a restricted Google BigQuery research dataset in Seoul, South Korea (asia-northeast3) for up to 90 days to analyze and improve Until Morrow. This content may include personal information you choose to share.
Turning future research storage off stops new research writes; it does not remove earlier retained content. Export or delete controls handle earlier retained content. BigQuery is the only Until Morrow server-side source of truth for optional research conversation text. Cloudflare D1 keeps consent and deletion controls plus separately consented reports in an isolated support table.
5. Reports and support content
Reporting content is separate from research consent and is off by default. You choose a message or final call turn, preview exactly what will be included, and give report-specific consent. Selected content is sent through the Until Morrow service to an isolated Cloudflare D1 support table for up to 90 days. Report content is not placed in email, analytics, crash reports, RevenueCat attributes, advertising systems, ordinary service logs, or the BigQuery research dataset automatically.
6. Service providers and disclosure
Until Morrow uses Apple or Google for app distribution and purchases, RevenueCat for subscription entitlement, OpenAI for AI reply and speech processing, Cloudflare for the application service, control metadata, and separately consented support reports, Google Cloud for optional restricted research storage, and Firebase for metadata-only analytics and crash reporting. They process data under their own terms and our instructions where applicable.
We do not sell personal data, share it for cross-context behavioral advertising, or use conversation content for third-party ads. We may disclose information when required by law, to protect users or the service, or during a lawful business transfer with appropriate safeguards.
7. Security
Local relationship content uses encryption at rest. Network requests use encrypted transport. Restricted research and isolated support storage use limited access, bounded retention, and deletion controls. No method is perfectly secure, so collection remains limited and production collection must stop when required safeguards fail.
8. Retention and deletion
- On-device content remains until you clear it, reset the relationship, or remove the app.
- Optional conversation research and separately consented report content are each retained for no more than 90 days.
- Accepted server-deletion requests target completion within 24 hours. BigQuery research deletion may have a short time-travel and fail-safe boundary of no more than 9 additional days while making deleted rows unavailable for ordinary use; D1 support reports are removed from the active table.
- Operational metadata is kept only as long as needed for app function, security, purchase obligations, analytics configuration, or law.
Use Privacy choices for in-app controls and Data deletion for the external request path. Until Morrow deletion controls apply to data controlled by Until Morrow; they do not control OpenAI’s separate abuse-monitoring logs, which follow OpenAI’s retention rules described above.
9. Children
Until Morrow is only for people age 18 and older. We do not knowingly offer the service to children or collect a date of birth. If you believe a minor has used the service, contact us.
10. International processing
Service providers may process data in countries other than yours. Until Morrow’s optional research dataset is restricted to Google Cloud’s Seoul region. Separately consented reports use Cloudflare D1, and OpenAI processing is disclosed separately; neither is described as occurring in Korea.
11. Browser privacy signals
These trust pages do not use tracking scripts, and Until Morrow does not sell personal data or share it for cross-context behavioral advertising. Browser Do Not Track and Global Privacy Control signals therefore do not change site behavior; there is no sale, targeted-ad sharing, or browser tracker to opt out from.
12. Changes
Material changes will be dated here and, when appropriate, presented in the app before the changed practice applies. A new purpose for optional content requires a new disclosure and choice.
13. Contact
For privacy questions or requests, email elrqleldh@gmail.com. Do not include conversation, memory, call, or report content in email. Include only the request type and the privacy receipt or reference shown by the app when available.
Start a privacy request