Privacy Policy

Banterfox — Version 1.0 · Effective 2026-10-19 · Last updated 21 October 2026

This Privacy Policy is the transparency notice under Articles 12, 13 and 14 GDPR for Banterfox, a flirting and conversation coach for adults: mobile apps for Android and iOS in which you practise conversations with AI characters, talk to an AI coach about real situations and get feedback on chats you paste in, together with the server those apps use and the Banterfox website. It describes what personal data Banterfox stores, why, on what legal basis, where, for how long, and who else receives it. It describes the actual behaviour of the deployed system, not intentions.

Banterfox is about dating and flirting. What you tell it can reveal your sex life and your sexual orientation, which the GDPR treats as special categories of personal data (Article 9). Section 5 explains how Banterfox handles that, and section 9 explains what happens with information about other people that you mention or paste in.

This Policy is a standalone document. It forms an integral part of the Terms of Use, which govern the contract between you and the provider; on questions of data protection, this Policy prevails.

1. Controller and contact

The controller for the processing described here is:

No data protection officer has been appointed. The controller is a sole trader; the appointment obligation under Article 37 GDPR and section 5 DSG is reassessed whenever the scope of processing changes.

Full statutory disclosure under section 5 ECG, section 14 UGB and section 25 MedienG is published in the Impressum.

2. The short version

• You create an account in the app with a first name, your birthday and a confirmation that you are 18 or older, and you give two separate consents (section 5). No email address, phone number or password is needed. Your account is identified by a random token stored encrypted on your device.
• Your conversations with the coach and the practice partners, your chat reviews, your scores and what the coach remembers about you are stored on Banterfox's database in Frankfurt, Germany, strictly separated by user.
• To write replies, the server sends the relevant text to an AI model provider (section 6). One of them, MiniMax, is located outside the EU (section 7).
• Banterfox shows no advertising, contains no analytics or tracking SDK, does not sell or share your data for marketing, and does not train AI models on your conversations.
• Payments are handled entirely by Google Play or the App Store. Banterfox never sees your card or bank details.
• You can delete conversations and delete your whole account in the app at any time. Accounts that are not used for 12 months are deleted automatically (section 10).

3. Infrastructure and processing locations

No user data is stored at rest outside the EU. Personal data leaves the EU only as the content of a request to an AI provider outside the EU — see section 7.

All data — accounts, profiles and consent records, conversations, memory including its embeddings, progress, reviews, feedback, and purchase and credit records — is stored in one managed PostgreSQL database at Neon, located in Frankfurt, Germany. The application server at Hetzner processes requests but keeps no user data on its disk. Every row of user data carries that user's ID, and every query is restricted to the ID of the signed-in user, so one user's data can never surface for another user. Deleting an account deletes all of that user's rows.

4. What is processed, and why

a) Account and profile

b) Requests from the app

c) Conversations: coach chat, roleplay, hints and debriefs

Practice partners are fictional AI characters. Within a roleplay, what you write is treated as practice, not as facts about your life (see (d)).

d) Long-term memory

The coach remembers things you tell it, so it can follow up ("how did the date on Friday go?"). This works as follows:

Privacy phrases. If you write phrases such as "off the record", "don't remember this" or "keep this between us" (at present these are recognised in English), that message and the reply to it are redacted from the memory log and never turned into memories. They still appear in the conversation itself until you delete it.

You can ask for a list of the facts Banterfox keeps about you and have any of them deleted, by writing to the address in section 1; where the app offers a screen for this, you can do it there yourself. A deleted fact is removed for good.

Embeddings are computed by a small open embedding model that runs on the Banterfox server itself. No memory or message text is sent to a third party to compute embeddings.

e) Chat reviews

Pasted chats are not added to the long-term memory log.

f) Program, progress and gamification

g) Purchases and entitlements

Banterfox never receives your name, email address, card or bank details from the stores. Invoicing, payment and VAT are handled by the store (section 6).

h) Server logs

The Banterfox application writes no message content to its logs.

i) The website

The website is a static site hosted on AWS Amplify in Frankfurt (section 3). When you visit it, your browser sends the usual request data (IP address, time, requested page, browser type, language) to the web host, which needs it to deliver the page (Art. 6(1)(f) GDPR). The controller does not keep access logs of the website beyond a maximum of 14 days, longer only for security incidents. The website contains no analytics, no tracking, no advertising, no social-media plug-ins and no third-party scripts; its fonts are served from the site itself, so no request goes to Google Fonts or any other third party. The only cookie is described in section 4(k).

j) On your device

Your conversations are not kept in a separate store on the device; the app loads them from the server.

Voice input. If you use the microphone button, speech is turned into text by your phone's built-in speech recognition (on Android the system speech service, usually Google's; on iOS Apple's, on the device where supported). Banterfox receives only the resulting text, never audio. The speech service is provided by Google or Apple under their own privacy terms.

k) Cookies and similar technologies

The apps use no cookies, no advertising identifier and no tracking.

The website sets at most one cookie:

The website therefore shows no cookie banner.

l) What is not processed

Banterfox uses no analytics or crash-reporting service, no advertising network, no tracking pixels, no session recording, no A/B testing service and no data broker. Both apps contain an analytics interface that is wired to a no-op implementation: nothing is collected or sent. Banterfox does not access your contacts, photos, location, or other apps. It does not send push notifications.

m) Feedback and testimonials

The suitability check sends only the feedback text and its star rating to one of the AI providers in section 6 — never your name, account or conversations. It is not a decision with legal or similarly significant effect on you (Art. 22 GDPR): it only decides whether a quote is shown publicly. Publicly, a quote appears with the name and illustration you chose and the month it was written; it is shown only once at least ten quotes have been approved. You can object at any time by deleting the feedback (Profile → Give feedback).

n) Reports of AI replies

You can report a reply of the coach or a practice partner (long-press the message → Report).

The server log records only the report's ID and reason, never its content. Reports are not shared with anyone and are not used to train AI models.

5. Special categories of data and your consent

Conversations about dating and flirting regularly reveal information about your sex life, and your profile settings for gender and who you want to flirt with can reveal your sexual orientation. You may also choose to mention your health (for example anxiety). Under Article 9 GDPR these are special categories of personal data.

Banterfox processes them only on the basis of your explicit consent (Art. 9(2)(a) GDPR). On the last step of sign-up, where your account is created, the app shows two separate checkboxes, neither of them ticked in advance, and the account can only be created once you have ticked both:

1. Terms and Privacy Policy — that you accept the Terms of Use and have read this Privacy Policy (both are linked right there);
2. Explicit consent to sensitive data — that Banterfox may process what you share about your dating and love life, including your gender and who you want to practise with, which can reveal your sexual orientation and sex life, in order to coach you. This consent covers sending that content to the AI providers listed in section 6, including MiniMax outside the EU (section 7).

The server records, with your account, the versions of the Terms of Use and of this Privacy Policy you accepted, that you gave the Art. 9 consent, and the time (Art. 7(1) GDPR). This record cannot be changed afterwards and is part of your data export.

The service cannot work without this data: a dating coach cannot coach without hearing about your dating life. If you do not want to give consent, you cannot use Banterfox. You can withdraw consent at any time, with effect for the future. Because Banterfox cannot provide its service without it, withdrawal is done by deleting your account in the app (section 10.2), or by writing to the address in section 1, which leads to the deletion of the account. Withdrawal does not affect the lawfulness of processing before it.

Your gender (woman, man or nonbinary) is required when you create your account, because practice partners and advice are chosen on that basis; it is processed only with the explicit consent described above. Beyond that, please share only what you are comfortable with. You do not need to use real names.

6. Recipients and processors

The following recipients process personal data on the controller's behalf (processors, Article 28 GDPR) or receive it as independent controllers. The controller concludes a data processing agreement with every processor.

Infrastructure

AI model providers — data in transit

Banterfox is still evaluating which models give the best and safest coaching. The list below is the complete list of providers in use; it is kept current here, and a provider is added to this list before it receives any data.

Embeddings are not on this list because they are computed on the Banterfox server itself (section 4(d)).

What is sent to an AI provider. For each request the server builds the model's instructions and sends only what that task needs:

• for a coach reply: the coach persona, your profile lines (first name, age, gender, who you want to flirt with, goals, tastes), your memory card and the memories relevant to your message, the summary and recent messages of the conversation, and your new message;
• for a practice partner reply: the partner persona and scenario, the conversation so far and your new message — not your profile or memories; a second, smaller request classifies the signals in your message (section 4(c));
• for a chat review: the pasted text, your note and your profile card;
• for background tasks (debrief, summaries, memory extraction): the messages of the session concerned and, for memory, your existing facts.

No account ID, token, IP address or device identifier of yours is sent. The request comes from the Banterfox server.

App stores — independent controllers

Google and Apple also process data when you download the app and, under their own terms, may provide the developer with aggregated, non-identifying statistics (for example installs and crashes reported through the store consoles).

Authorities. Data is disclosed to authorities only where the law requires it.

7. What actually leaves the EU, and when

Nothing is transferred to a third country for storage. A transfer occurs when the server sends a request to MiniMax (section 6), which happens for every task routed to a MiniMax model — in practice for most conversations as long as MiniMax is in use.

Third-country risk you should be aware of. MiniMax is operated from the People's Republic of China / Singapore. Neither is covered by an adequacy decision under Article 45 GDPR, and the legal framework of the People's Republic of China provides state access powers that a European transfer impact assessment must weigh. The transfer is based on Standard Contractual Clauses (Article 46(2)(c) GDPR, Commission Implementing Decision (EU) 2021/914) and a transfer impact assessment. Because the content sent is intimate, your explicit consent in section 5 expressly covers this transfer as an additional safeguard — it does not replace the transfer mechanism.

AI providers are still being evaluated. The controller reviews the choice of provider regularly, and the list in section 6 is always the current one. If an EU-based model proves equally good, it will be preferred.

Scaleway processes in France and is not a third-country recipient.

8. How Banterfox uses AI

You are talking to AI. The coach and every practice partner are AI characters generated by language models. Practice partners are fictional; they are not real people and do not represent real people.

No training on your conversations. The controller does not use your conversations, memories or reviews to train, fine-tune or evaluate AI models. Product evaluations use simulated conversations, not user data. For the AI providers the position depends on their API terms:

• For Scaleway, under its published terms for Generative APIs, prompts and outputs are not used to train models.
• For MiniMax, an equivalent contractual guarantee has not been established.

Because this depends on contracts the controller does not control, no guarantee is given here beyond the controller's own conduct.

No automated decisions with legal effect. Scores, levels, the practice partner's "interest" and pass/fail results of challenges are feedback on your practice. They do not produce legal effects or similarly significant effects for you within the meaning of Article 22 GDPR. Plan and credit checks are simple rule checks.

Abusive conversations. In a roleplay, the practice partner reacts like a person would: after abuse, a repeated insult, sexually explicit messages or pushing after a "no", the partner ends the conversation, and the server accepts no further messages in that session. Model refusals are not stored as part of your history. These are automated reactions inside the practice scenario; they are not used to profile you and have no effect on your account.

9. Other people in your conversations and reviews

When you tell the coach about someone you are dating, or paste a chat with someone into a chat review, Banterfox processes personal data of people who are not Banterfox users — their name, what they wrote, and what you say about them.

• Roles. You use Banterfox for personal purposes; that use is generally covered by the household exemption (Article 2(2)(c) GDPR). The controller is responsible for the processing Banterfox performs on that content (recital 18 GDPR) and processes it on the basis of a legitimate interest (Art. 6(1)(f) GDPR): yours in getting advice about your own conversation, and the controller's in providing it. The other person's interests are protected by the measures below.
• What is stored. A pasted chat is stored with its review in your account (section 4(e)) and sent to the AI provider (section 6). It is not added to the long-term memory. In coach conversations, the memory may keep short facts that mention other people by first name, because that is how the coach can follow up (section 4(d)).
• Minimise. Paste only what you need advice on. Remove or replace surnames, phone numbers, addresses, profile links, usernames and anything else that identifies the other person, and anything they told you in confidence. You do not need real names for the coach to help.
• No other use. Content about other people is used only to give you feedback. It is never used for training, never shown to other users, and never used to contact or profile the other person.
• Their rights. A person who believes their data is in Banterfox can contact the address in section 1. Because Banterfox holds no contact data of users and stores content per user, the controller can usually not identify such content without details from that person (Article 11 GDPR); with enough detail, the request will be handled. Informing every person mentioned in a user's chats individually would be impossible or require disproportionate effort (Article 14(5)(b) GDPR); this Policy is published instead.

10. Retention, deletion and how to delete your data

10.1 Retention

• While your account exists, your data is kept so the service works, with the exceptions below.
• Deleting a conversation removes the session with all its messages, its debrief, the skill scores and challenge attempts from that session, the copies of its messages in the memory log, the memories and summary extracted from it and the open threads it created. Because the coach's profile card may contain details from it, the card is deleted too and rebuilt from your remaining memories. Progress (XP, stars, streak) is recalculated without it.
• Deleting a memory removes it and its embedding for good. Memories that were replaced by a newer fact are kept, marked as outdated, so the coach knows what changed; they are deleted with the account.
• Chat reviews are kept until your account is deleted. If you want an individual review deleted sooner, write to the address in section 1.
• Accounts that are no longer used are deleted automatically. Your account lives on your device; if you sign out, uninstall the app or lose your phone without deleting the account, the app can no longer reach it. Therefore a daily job deletes every account that has not been used for 12 months, together with all its data: conversations, memory, reviews, progress and its purchase, entitlement and credit records. Purchases remain valid with the store; subscriptions and unlocks can be restored onto a new account through "Restore purchases", unused credits cannot. The app's Profile screen states this rule.
• Backups. For disaster recovery, the database keeps a point-in-time restore history at Neon with a retention window of at most 14 days. Deleted data disappears from this history at the latest when that window has passed. The history is never used to restore individual deleted records.
• Logs are kept for the period stated in section 4(h).
• Statutory retention. Because the stores sell the subscriptions and products and issue the invoices, the controller holds no invoices or payment records about you. Store payout reports kept for accounting (seven years, section 132 BAO, section 212 UGB) contain no data that identifies you.

10.2 How to delete your data

1. Delete a conversation — open it in the app and delete it.
2. Delete a memory — where the app offers it, there; otherwise by writing to the address in section 1.
3. Delete your entire account — in the app under Profile → Delete account. This deletes, immediately and irreversibly, your account entry, all your rows in the database (all conversations, reviews, scores, progress, memories, feedback and reports of AI replies) and your purchase, entitlement and credit records on the server. It does not cancel a running subscription: cancel it in Google Play or the App Store, otherwise the store keeps charging you. Unused credits and unlocks are lost with the account; unlocks can be restored onto a new account through "Restore purchases", credits cannot.

If you can no longer open the app, write to [email protected]. Because Banterfox has no email address or password for you, describe the account as precisely as you can (for example the first name, birthday and approximate registration date, or a purchase receipt from the store) so that it can be identified. The controller responds within one month, extendable by two months for complex requests.

A step-by-step version of these instructions is published at Delete your account and data.

10.3 What deletion cannot reach

• AI providers. Text already sent to an AI provider was processed under its terms (sections 6 to 8).
• The stores. Your purchase history with Google or Apple is kept by them as independent controllers.
• The restore history of the database, until the window of at most 14 days has passed (section 10.1).

11. Minimum age

Banterfox is only for adults. Registration requires a birthday showing that you are at least 18 and a separate confirmation; the server refuses younger users. The birthday cannot be changed after registration. If the controller learns that an account belongs to someone under 18, the account is deleted.

12. Security measures

The controller maintains technical and organisational measures appropriate to the risk, including: transport encryption (TLS) for all connections between the apps, the website, the application server and the database, with verified certificates; encryption at rest of the database by Neon; account tokens of 256 random bits that are stored in the database only as SHA-256 hashes and can be rotated; tokens on the device protected by the Android Keystore or the iOS Keychain; strict separation of users' data — every row carries the user's ID and every query is restricted to the signed-in user; no user data stored on the application server's disk; no message content in logs; the server process runs as an unprivileged user in a container and is reachable only through the reverse proxy; embeddings computed on the controller's own server; administrative access to the server and the database restricted to the controller; and a restore history kept in Germany with a fixed window of at most 14 days.

13. Personal data breaches

If a breach of the security of personal data occurs, the controller will notify the Austrian Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33 GDPR), and will inform affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR). Because Banterfox holds no email address, affected users are informed by a notice in the app and on the website.

14. Your rights

You have the right to:

• access your personal data (Article 15 GDPR);
• rectification of inaccurate data (Article 16 GDPR) — you can change your profile in the app and delete inaccurate memories;
• erasure (Article 17 GDPR) — you can trigger it yourself, see section 10.2;
• restriction of processing (Article 18 GDPR);
• data portability in a structured, commonly used, machine-readable format (Article 20 GDPR) — on request to the address in section 1 you receive a JSON export of your data;
• object to processing based on legitimate interests, on grounds relating to your particular situation (Article 21 GDPR);
• withdraw consent at any time, with effect for the future (Article 7(3) GDPR), see section 5.

Send requests to the address in section 1. The controller responds within one month, extendable by two months for complex requests, and will tell you if an extension is needed. Because Banterfox cannot identify you by email, the controller may ask for information that proves the account is yours (Article 12(6) GDPR).

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). The competent authority for the controller is:

Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna, Austria [email protected] · www.dsb.gv.at

15. Changes to this Privacy Policy

This Policy is updated whenever the processing it describes changes — a new processor, a new or different AI model provider, or a changed retention period. AI providers in particular are still being evaluated, so this page is the place where the current list is kept. The version and effective date at the top of this page always identify the operative text.

Where a change materially affects your rights — in particular a new AI provider outside the EU or a new use of special-category data — you will be informed by a notice in the app before it takes effect, and, where the processing relies on your consent, asked for consent again. Purely clarifying or editorial changes are published without separate notice.