Privacy Policy

1. Introduction

Oncilo is operated by WITHENAI LIMITED, a company registered in Hong Kong. In this policy, “Oncilo,” “we,” “us,” and “our” refer to WITHENAI LIMITED.

Privacy questions and requests may be sent tosupport@oncilo.ai.

2. Scope

This policy applies to the Oncilo mobile application, the Oncilo website, APIs, and related services that link to it. It does not govern an independent third-party website or service that has its own privacy policy.

3. Information we collect

Account and profile information

We collect the email address, display name, password in hashed form, email-verification status, account identifiers, avatar, and profile information you provide. If you choose to personalize discovery, we also collect your optional gender selection and theme preferences. We maintain authentication tokens and account preferences needed to keep you signed in and synchronize the service.

Content you create or submit

We process content you choose to create, upload, import, or send, including characters, personas, lorebooks, writing styles, prompts, chat messages, summaries, images, files, and character-creation or editing instructions. We also process reports you submit about AI responses or official content. This content may contain personal information if you choose to include it.

Usage, security, and transaction information

We process service events needed to operate and secure Oncilo, such as IP address, request time, request identifier, authentication and rate-limit events, error information, and records of actions taken in the service. Discovery actions, such as selecting a tag, viewing, importing, remixing, or starting a character, may be associated with your account to personalize discovery. We also maintain crystal balances, model-usage records, redemption records, and related transaction history.

If purchases are made available, the applicable app store processes payment details. We may receive purchase status and transaction identifiers, but we do not receive your full payment-card number from the app store.

Information stored on your device

Oncilo stores session credentials in secure device storage where supported and may keep synchronized content, settings, and temporary files in local application storage. Removing local application data does not by itself delete information held in your Oncilo account.

Website request information

The public website has no account sign-up, analytics, advertising, or tracking technologies. Its account-deletion page collects your registered email address and verification code only to process a deletion request. The hosting service may process limited technical request data, such as IP address, browser type, requested URL, and request time, for delivery, security, and reliability. The website does not set cookies or use browser storage for analytics, advertising, profiling, or personalization.

4. How we use information

We use information to:

• create, authenticate, secure, and support your account;
• synchronize and display your content across supported devices;
• generate AI responses, summaries, characters, and requested edits;
• personalize discovery using your optional choices and interactions;
• review reports about potentially unsafe or prohibited content;
• operate crystal balances and record model usage;
• send verification, security, and service communications;
• detect abuse, fraud, security incidents, and technical failures;
• maintain, troubleshoot, and improve service reliability; and
• comply with law and enforce the User Agreement.

We do not sell personal information or use private Oncilo content for third-party advertising.

5. AI processing

When you request an AI feature, the information needed to complete that request may be sent to model-processing providers. Depending on the feature, this can include your prompt, recent conversation, selected character or persona, linked lorebook content, writing preferences, and technical parameters. Providers process this data on our behalf or under their applicable terms to return the requested output and protect their services.

Do not submit highly sensitive personal information that is not needed for your story or request. AI output may reproduce information that you include in a prompt or conversation.

6. When we share information

We may disclose information to:

• AI model and gateway providers that process prompts and return generated output;
• hosting, database, storage, network, and security providersthat run and protect the service;
• email-delivery providers that send verification and service messages;
• Apple or Google when they authenticate you, distribute the app, or process an in-app purchase under their own terms;
• professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or establish and defend legal claims; and
• a successor in connection with a merger, financing, reorganization, or sale of all or part of our business, subject to appropriate confidentiality and notice where required.

We require service providers acting for us to protect personal information and use it only for the services they provide to Oncilo.

7. International data transfers

Oncilo operates from Hong Kong, and our providers may process information in other countries or regions. Their privacy and data protection laws may differ from those where you live. Where required, we use contractual, organizational, or other lawful safeguards for international transfers.

8. Retention

We keep account information and synchronized content while your account is active and for as long as reasonably needed to provide the service. Verification records, authentication records, security logs, transaction records, support messages, and backups may be kept for shorter or longer periods according to their purpose, legal obligations, fraud prevention, dispute resolution, and backup cycles.

After a valid deletion request, we delete or de-identify associated personal information unless retention is required or permitted by law. Residual copies may remain in protected backups until overwritten in the ordinary backup cycle.

9. Your choices and rights

Oncilo provides controls to view or change account information and to delete supported content. Depending on where you live, you may also have rights to access, correct, delete, restrict, or receive a copy of personal information, or to object to certain processing.

Some rights are subject to legal exceptions. We will not discriminate against you for making a privacy request.

10. Security

We use technical and organizational safeguards designed to protect information, including encrypted transport, access controls, hashed passwords, expiring authentication credentials, and service monitoring. No storage or transmission method is completely secure, so we cannot guarantee absolute security.

11. Children

Oncilo is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If the law where you live requires a higher age to consent to an online service, you must meet that age or use Oncilo only with authorization from a parent or legal guardian. Contact us if you believe a child has provided personal information without required authorization.

12. Changes to this policy

We may update this policy as Oncilo or applicable requirements change. We will publish the revised version here and update the effective date. If a change materially affects your rights, we will provide additional notice where required.

13. Contact us

support@oncilo.ai