Privacy Policy

01Who we are and what this covers

WARMTH LABS, operating as Warmth (“we,” “us,” or “our”) makes Warmth, an AI companion desktop app for Mac, Windows, and Linux. This policy explains what personal information we collect through the desktop app, warmth.so, your account, and your voice and text conversations with your companion, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.

We are the controller of that information. For questions or requests, write to team@warmth.so.

02What we collect

Information you give us

• Your email and account credentials. You sign up using Google or an email and password. Supabase manages your credentials and confirms your email; Resend delivers verification and password reset codes. Passwords are not stored in our website account database.
• Google sign-in information. If you choose Google sign-in, Google shares your account email and basic profile information with Supabase for authentication. We use the resulting identity to create or access your Warmth account.
• Your name or chosen display name, so your companion knows what to call you.
• Your answers during setup. The onboarding questions ask about your conversation preferences, what you want remembered, how you handle a hard day, and how you want to personalize your companion. These shape your experience in the desktop app.
• Your confirmation that you are 18 or over. We record the answer, not a date of birth.
• Your time zone, to support time-sensitive features and account information. It may come from your browser or device settings. We store the time zone rather than a precise location history.
• Your conversations. The text you type, the replies your companion generates, and any content you choose to share through a supported feature. If you use voice conversation, this includes the audio you provide, any transcripts created for the conversation, and generated spoken responses.
• Billing details. Our payment processor collects and holds your card details. We receive your subscription status, plan, renewal date, and the last four digits and card brand. We never see or store your full card number.
• Anything you send to support, including the content of your emails to us.

Information we collect automatically

• Device and log data such as IP address, browser, operating system, app version, referring page, pages or features used, and diagnostic information about errors. We use IP address for security and rate limiting, and to infer only a coarse region.
• Usage and session replay data about how far you got in the signup flow, which elements you interacted with, pointer and touch movement, navigation, and how far you scrolled. We use event totals and masked replays to find where people get stuck and to diagnose failures. Replay is enabled for every website session in which analytics loads. Ordinary interface text is visible so the replay is useful, but all form values and text that displays personal or sensitive information are masked before the replay leaves your browser. Setup-answer controls and sensitive account panels are blocked from replay entirely.
• Conversation metadata such as timestamps, whether you used voice or text, and information needed to process a conversation or diagnose a failed response.
• Cookies and similar technologies, listed in Section 8.

Information from others

• Our authentication provider tells us whether your Google sign-in, password or email code was confirmed.
• Our payment processor tells us about payments, refunds, disputes, and fraud signals.

We do not buy personal information from data brokers, and we do not collect government identifiers, precise location histories, or biometric identifiers.

03How we use it

We use personal information to:

• create and manage your Warmth account and provide access to the desktop app;
• generate your companion’s text and spoken replies, process voice input, and support memory and personalization;
• verify that you control your email address, and that you are at least 18;
• take payment, manage your subscription, and handle refunds;
• answer your support requests;
• keep the Service safe: detect fraud, abuse, spam, and attempts to break our rules, and enforce our Terms of Service;
• run our safety protocols, including surfacing crisis resources when a conversation suggests someone may be at risk, as described in our Terms of Service;
• understand how the product is used, including where people get stuck, so we can improve it;
• send you service messages about your account, billing, and changes to these policies, and marketing messages where you have agreed to them; and
• comply with the law and respond to lawful requests.

04AI processing, memory, and model training

Warmth uses AI models to generate your companion’s responses. Conversation content is sent to model providers that act as our processors under contract. Voice features may also use service providers to process audio, create transcripts, or generate spoken replies. Installing a desktop app does not mean that these features run entirely on your computer or work offline.

Memory. The Service automatically extracts details from your conversations, such as names, preferences, plans, and things going on in your life, and stores them so that later conversations can refer back to them. These extracted memories can include inferences about you, and those inferences can be wrong. You can ask us to correct or delete them.

Training. We do not sell your conversations, and we do not use the content of your conversations to train publicly available foundation models. Our model providers are contractually prohibited from using your content to train their own models. We may use your conversations to operate, evaluate, and improve Warmth, including reviewing a small number of conversations for safety and quality. Where we do that, we minimize and de-identify the data wherever it is possible to do so.

Human review. Access to conversation content is restricted to the people who need it, and is logged. We may review specific conversations when we are investigating a safety report, a suspected breach of our Terms, a support request you have raised, or a legal obligation.

Automated decisions. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

05Legal bases for processing

If you are in the EEA, the UK, or Switzerland, we rely on the following legal bases.

06Who we share it with

We do not sell your personal information. We share it only in the ways described here.

Service providers. Companies that process data on our behalf, under contract, only on our instructions, and only for the purposes below.

We name categories rather than individual companies here, which is what this kind of disclosure calls for and what keeps this list accurate as providers change. If you want to know the specific companies behind any of these categories, ask us and we will tell you. That offer is open to everyone, not only to people in places where the law requires it of us.

Legal and safety. We may disclose information if we reasonably believe it is required by law, subpoena, or court order, or necessary to investigate fraud or a violation of our Terms, or to protect the rights, property, or safety of any person, including where there is a credible risk of serious harm.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that deal. We will give you notice before your information becomes subject to a materially different privacy policy.

De-identified and aggregated data. We may create and share data that cannot reasonably be used to identify you, and we will not attempt to re-identify it.

07Desktop permissions and local data

Voice conversation uses your microphone and requires any applicable device permissions. When you choose to use voice features, audio you provide and any transcripts are processed as described in Section 4. You can manage microphone access through the controls available in your operating system; disabling it may prevent voice features from working.

The app may store settings, session information, and cached data on your computer to keep it working and keep you signed in. Protect access to your computer, particularly if it is shared. Conversation windows, notification previews, and spoken replies can reveal information to people nearby or during screen sharing.

Signing out or uninstalling the app does not automatically delete information stored with your Warmth account. To request deletion of your account, conversations, or memories, follow Section 12. Desktop notifications can be managed through the app or operating system controls where available.

08Cookies and analytics

Cookies are small files a site stores in your browser. Similar technologies, including local storage and pixels, do much the same job. This is what warmth.so uses. It is a short list because we do not advertise: there are no advertising cookies here, no retargeting, and no cross-site tracking.

This section describes our website cookies and website analytics. The desktop app may use local storage for settings and sign-in state, as described in Section 7. The website session replay described below is a reconstruction of website activity, rather than a recording of your desktop or voice conversations.

What our analytics actually record

Analytics tools vary enormously in how far they go, so it is worth being specific about where ours stop:

• Session replay is switched on. For every website session where analytics loads, it reconstructs page structure and changes, pointer and touch movement, clicks, scrolling, and navigation. It is a reconstruction of the page rather than a video recording of screen pixels.
• Sensitive text and all form values are masked. Ordinary headings, instructions, buttons, and other interface copy remain visible so a replay can show what happened. Every value you type is replaced before replay data is sent. Text that displays a name, email address, verification code, location, personal setup answer, or account and billing detail is also masked. Controls where you choose personal setup answers and sensitive account panels are excluded from replay entirely.
• High-risk capture is disabled. Replays do not include canvas content, cross-origin frames, console logs, network requests, request or response headers, or request or response bodies. Query strings and URL fragments are removed from replayed page addresses.
• No profile for anonymous visitors. We do not create a person record for everyone who lands on the site.
• No personal data in events. Our funnel events carry which step you reached, not who you are.
• Crash reports are limited to diagnostics. They can include the error type, message, stack trace, current page or route category, and coarse browser information. We do not intentionally attach form values, email addresses, request bodies, or cookies.
• We do collect pageviews, clicks on elements, scroll depth, referrer, coarse device and browser information, and the masked session replay interactions described above.

Rate limiting, which stops one machine from requesting thousands of verification codes, counts requests against an IP address on our servers and does not use a cookie. These limits are not used to identify you in analytics.

How to turn them off

Every major browser lets you block or delete cookies and site storage in its settings. Blocking the strictly necessary ones will break email verification, so signup will not work. Browser content blockers can also block analytics requests. If your browser sends a Global Privacy Control signal, we do not load analytics at all for that visit. We also treat that signal as an opt-out of any sale or sharing of personal information, though as described below we do neither. You can also email team@warmth.so and we will exclude your analytics data and confirm when it is done.

If you are in the EEA or the UK. We do not set advertising cookies anywhere and we do not track you across sites. To stop the analytics above, enable Global Privacy Control, use a browser content blocker, or write to us at the address above.

09How long we keep it

We keep personal information for as long as we need it for the purposes above, and then delete or de-identify it.

10Security

We take reasonable technical and organizational measures to protect your information, including encryption in transit and at rest, access controls that limit conversation data to the people who need it, session cookies that are HTTP-only and that hold random tokens we store only as hashes, rate limiting on verification, and regular review of our providers.

No system is perfectly secure. Anyone with access to your computer or signed-in account may be able to read your conversations or use the app as you. Spoken replies may be heard by people nearby. If you believe your account has been compromised, contact team@warmth.so right away.

If a breach affects your personal information, we will notify you and the relevant regulators within the timeframes the law requires, including within 72 hours to a lead supervisory authority where the GDPR applies.

11Your choices and rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you;
• name the specific companies we share it with, rather than the categories in Section 6;
• give you a copy in a portable format;
• correct anything inaccurate, including a memory Warmth got wrong;
• delete your account and the data attached to it;
• delete specific things, such as your conversation history or a single memory, without closing your account;
• stop sending you marketing messages; or
• restrict or object to certain processing, or withdraw a consent you previously gave.

You can manage desktop notifications in your app or operating system settings where available, revoke microphone access using the controls available on your device, and unsubscribe from marketing emails. Account, billing, and security emails may still be needed to provide the Service.

You will never be treated worse for exercising a privacy right. We do not charge for these requests, do not deny service because of them, and do not offer a different price or quality of service on the basis of them.

12How to make a request

Email team@warmth.sowith “Privacy Request” in the subject line, or write to us at the postal address in Section 19, and tell us what you want us to do. The subject line is not required, but it starts the clock sooner.

Verification. We verify that you control the Warmth account associated with a request, using your sign-in email or another appropriate account verification method. We do this to make sure we do not hand your conversations to somebody else. We will not ask for more information than we need.

Timing. We acknowledge requests within 10 business days and respond within 45 days, and we may extend by another 45 days where a request is complex, in which case we will tell you why.

Authorized agents. You may use an authorized agent. We will ask for written proof of their authority and may ask you to confirm it directly.

Appeals.If we decline your request, you can appeal by replying to our decision with the word “Appeal.” We will respond within 45 days with our reasoning. If we deny the appeal, you may contact your state attorney general or, in the EEA or UK, your data protection authority.

13United States state privacy rights

This section applies to residents of California, Colorado, Connecticut, Virginia, Texas, Oregon, Utah, and other states with comprehensive privacy laws.

Categories we collect

We collect these for the purposes in Section 3, from the sources in Section 2, and keep them for the periods in Section 9.

Sensitive personal information

The content of your conversations with Warmth may reveal sensitive information, because people tell a companion about their health, beliefs, relationships, or sexuality.

Warmth does draw inferences from what you share. That is what companion memory is, and Section 4 explains how it works. Being precise about where that stops matters more than a flat denial would: we use sensitive information, and the inferences we draw from it, only to provide the companion you asked for and to keep the Service safe. California treats those as purposes that do not trigger the right to limit. We do not use sensitive information to build a profile for anyone else, to advertise to you, to decide anything about you outside the conversation, or for any other purpose that would give you a right to limit its use.

Information about your health, including your mental health, gets its own treatment in Section 14.

No sale, no sharing, no targeted advertising

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not process it for targeted advertising or profiling in furtherance of decisions with legal or similarly significant effects. Because we do not do these things, there is nothing for you to opt out of, though we honour Global Privacy Control signals as an opt-out preference regardless.

Your rights

Depending on your state, you have the right to know, access, correct, delete, obtain a portable copy, limit the use of sensitive personal information, opt out of sale, sharing, targeted advertising and certain profiling, appeal a denial, and be free from retaliation for exercising any of these. Exercise them as described in Section 12.

Shine the Light. California residents may ask whether we disclosed personal information to third parties for their direct marketing purposes in the prior calendar year. We do not.

14Consumer health data

This section is our Consumer Health Data Privacy Policy. Washington, Nevada, and Connecticut have laws written specifically about health data, and they define it broadly enough to reach an ordinary conversation with a companion. If you live in one of those states, this section is the disclosure those laws ask for. We apply it everywhere anyway, because the reasoning does not stop at a state line.

We are not a healthcare provider and Warmth is not care, which our Terms say plainly. That does not settle the question: what matters under these laws is not who we are but what the data reveals.

What counts as health data here

Anything you tell Warmth from which a state of physical or mental health could reasonably be inferred, and anything the Service infers from it. In practice that means:

• what you say about how you are feeling, how you are sleeping, a diagnosis, a symptom, a medication, a treatment, or a doctor’s appointment;
• what you share about your reproductive or sexual health, or your gender-affirming care;
• your setup answers, which ask how a hard day tends to go for you;
• the memories the Service extracts from any of the above, described in Section 4; and
• the fact that our safety protocol was triggered in your conversation. Warmth is built to recognize when a conversation suggests someone may be at risk of self-harm and to surface crisis resources, which our Terms describe in full. Recognizing it means making an inference about your mental health, so we count it here rather than pretend otherwise.

Where it comes from and why we have it

All of it comes from you, in the course of using the Service you asked for. We do not buy health data, we do not receive it from other apps or from data brokers, and we do not derive it from anything other than your own messages and setup answers.

We collect and use it for one purpose: to give you the companion you signed up for, and to keep the Service safe to use. Concretely, that means generating replies, letting your companion remember what you share, and running the safety protocol. We do not use it for advertising, we do not use it to build a profile of you for anyone else, and we do not use it to make decisions about you outside the conversation.

Who it is shared with

Only the service providers in Section 6 that are needed to produce a reply and deliver it: AI service providers, voice processing providers when you use voice, and cloud hosting and database providers. They act on our instructions, under contract, and for no other purpose. It is never shared with advertisers, data brokers, or lead generators, and never for marketing. As with everything else in Section 6, we name categories here and will tell you the specific companies if you ask.

We do not sell it

We do not sell consumer health data, and we have no plans to. Selling it would require your written and signed authorization on a form these laws specify. We have never asked anyone for one and do not intend to. If that ever changed, it would take your signature, not a quiet update to this page.

Consent, and taking it back

Collecting what you say to Warmth is what providing the Service means, so for the conversation itself we rely on your having asked for it rather than on a separate consent. Where any of it goes beyond that, we ask you separately and specifically first, and you can say no without losing the Service. You can withdraw a consent you gave at any time by emailing us, which stops the processing going forward.

Your rights over it

You can ask us to:

• confirm whether we collect, share, or sell your health data;
• list the specific third parties and affiliates it has been shared with, by name;
• delete it, including from our backups on their normal cycle, and including the memories derived from it; and
• withdraw any consent you previously gave.

When you ask us to delete it, we delete it from our own records and tell every service provider holding a copy on our behalf to do the same. Email team@warmth.sowith “Health Data” or “Privacy Request” in the subject line. The timings and the identity check in Section 12 apply, and Washington residents may also contact the Washington State Attorney General.

15EEA, UK, and Swiss rights

If you are in the EEA, the UK, or Switzerland, you have the rights to access, rectification, erasure, restriction, portability, and objection under the GDPR or UK GDPR, and the right to withdraw consent at any time without affecting processing already carried out. Our legal bases are in Section 5.

You may lodge a complaint with your local supervisory authority. In the UK that is the Information Commissioner’s Office. We would appreciate the chance to address your concern first, at team@warmth.so.

16International transfers

Our providers operate in the United States and elsewhere. Your information may be transferred to and processed in those locations, where data protection law may differ from your own. Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, together with additional safeguards where they are needed. You can request a copy of the relevant safeguards from team@warmth.so.

17Children

Warmth is an adult service. It is not directed to children, we do not knowingly collect personal information from anyone under 18, and we require an age confirmation before setting up a conversation. If we learn that someone under 18 has used the Service, we will close the account and delete their information. If you are a parent or guardian and believe your child has given us information, contact team@warmth.so and we will act promptly.

18Changes to this policy

We may update this policy. When we do, we will change the effective date at the top of this page, and for material changes we will give you advance notice by email or a notice in the app or on this site. If a change would involve using information we already hold for a materially different purpose, we will ask for your consent where the law requires it.

19Contact us

One address for everything, privacy requests included. Put Privacy Request in the subject line and we will treat it as one from the moment it arrives.

team@warmth.so