Aveil Privacy Policy

Aveil (hereinafter referred to as "we") attaches great importance to the protection of users' (hereinafter referred to as "you" or "your") personal information. This Policy explains how we collect, use, store, share, entrust the processing of, protect, and manage your personal data when you use the Aveil application and related services, and safeguards your right to be informed of and exercise control over your data. Please read this Policy carefully before using the Service.

I. How We Collect and Use Personal Information

1.1 Guest Mode, Account, and Profile Information

Aveil supports guest (visitor) mode and registered/logged-in account mode. Depending on your chosen method of use, we may collect the following information:

• Guest (Visitor) Mode Data: anonymous user ID, guest ID, device information, application instance identifier, Firebase Installation ID, device or other IDs, and basic usage status, chat interaction records, level, or virtual asset data (where applicable) associated with the guest identity.
• Account Registration and Login Data: mobile phone number, verification code login status, third-party authorized login information (such as Apple, Google, Facebook, TikTok, and LINE, subject to the actual methods provided in the App), email address (if returned by the third-party authorization or voluntarily provided by you), user ID, and account binding status.
• Profile Data: nickname, avatar, gender, date of birth, age, preferences, and other profile data that you voluntarily provide or upload.

If you use the Service in guest mode, relevant data may be associated with anonymous identifiers or device information. If you delete the App, clear application data, change devices, lose guest identification information, or fail to bind guest data to a formal account, some data, chat records, virtual assets, or entitlements may become irretrievable.

1.2 Information Generated During Use

• Chat interaction records, IM messages, AI conversation content, script/storyline interaction content, and other in-app messages, primarily used for functionality implementation, AI responses, contextual continuity, security and risk control, and service optimization, and shall not be publicly displayed.
• Photos, text content, profile content, feedback, reports, or customer service communications that you actively upload or input.
• Voice Data: When you use the "speech-to-text" or microphone input feature, we will request microphone permission; recorded audio is primarily used for real-time conversion to text, feature implementation, and necessary security processing, and will not be used for purposes unrelated to such features.
• Payment and Transaction Data: When you top up, purchase virtual currency, membership, items, or other value-added services, we may record transaction records, order numbers, product information, purchase time, amount, currency, payment status, refund status, virtual asset balance, and consumption records. Complete bank card, credit card, payment account numbers, and other full payment method information are typically processed by Google Play or other payment channels, and we do not actively collect complete payment card numbers or payment account passwords.
• Device Information and Device or Other IDs: such as device model, operating system version, language settings, time zone settings, network status, IP address, approximate location information, as well as Firebase Installation ID, App Instance ID, advertising identifiers (IDFA on iOS / Google Advertising ID on Android, where applicable and subject to your authorization), and other device or other identifiers.

1.3 Logs, Operations, and Application Performance Data

• Usage time, page views, click behavior, app interactions, in-app search records (if any), feature usage, other operational records, and content type data generated by users.
• Error reports, crash logs, diagnostic information, performance data, load times, latency, device status, and other data used for troubleshooting, product stability optimization, and user experience enhancement.

1.4 Third-Party Services and SDKs

To enable application data analysis, install source attribution, advertising delivery and effectiveness measurement, product optimization, service stability maintenance, and security and risk control, we currently use the following third-party services. Each may process or collect data pursuant to its own service mechanisms:

(a) Google Firebase / Google Analytics for Firebase — application data analysis, attribution, crash and performance monitoring:

• Firebase Installation ID, App Instance ID, advertising identifiers (where applicable), and other device or other IDs;
• Device model, operating system version, language, IP address, approximate location information, and network status;
• App launches, page views, clicks, feature usage, event statistics, install source, channel attribution, and advertising effectiveness data;
• Crash logs, diagnostic information, performance data, and other necessary technical information.

(b) Google AdMob — delivery of rewarded video advertisements within the App:

• Advertising identifiers (IDFA on iOS / Google Advertising ID on Android), device information, IP address and the approximate region inferred from it, and advertising interaction data such as impressions, completion of viewing, and revenue attribution;
• AdMob and its ad partners may use the foregoing data to deliver personalized advertising, measure advertising performance, and prevent fraud and abuse. Where you are located in a jurisdiction requiring consent, such use is subject to the consent you provide through the consent form described in Section 1.6.

(c) AppsFlyer — install source attribution and marketing effectiveness measurement:

• Advertising identifiers (where applicable and subject to your authorization), device information, IP address, install and first-launch events, in-app conversion events (such as registration and purchase), and the AppsFlyer device identifier;
• Where you have logged in, we may associate the AppsFlyer identifier with your account identifier for the purpose of attributing conversions and preventing attribution fraud.

(d) Google Play Install Referrer (Android only) — obtaining the install source and channel information passed by the app store at installation time.

(e) TikTok for Business (TikTok Business SDK) — install source attribution, advertising effectiveness measurement, and TikTok authorized login:

• Advertising identifiers (where applicable and subject to your authorization), device information, IP address, install and launch events, and in-app conversion events such as registration, login, chat milestones, and purchases;
• Where you log in through TikTok authorization, the account identifier and profile data returned by TikTok pursuant to your authorization;
• TikTok may use the foregoing data to measure and optimize the performance of the advertising campaigns we place on its platform.

(f) Meta / Facebook (Facebook SDK and Facebook App Events) — application event analysis, advertising effectiveness measurement, and Facebook authorized login:

• Application events such as launches, registration, use of key features, and purchases, together with device information and advertising identifiers (where applicable and subject to your authorization);
• Where you log in through Facebook authorization, the account identifier and profile data returned by Meta pursuant to your authorization;
• On iOS, automatic event collection by this service is enabled only after you have accepted this Policy and the App Tracking Transparency authorization described in Section 1.6 has been granted.

The foregoing services primarily act as our service providers or, in the case of advertising services, as independent controllers with respect to their own advertising purposes, and process data under our instructions or their respective service configurations and published policies. If additional third-party SDKs are introduced or material changes are made to data processing methods in the future, we will update this Policy in accordance with applicable laws, regulations, and platform rules, and obtain your authorization or consent where necessary.

1.5 Proprietary Analytics and Quality Monitoring Services

In addition to the aforementioned third-party services, to maintain service stability, conduct product feature optimization, and implement security and risk control, we also operate an analytics and event statistics system (first-party service) hosted on our own infrastructure, and relevant data is uploaded to our own server endpoints.

This system generates and uses a device-level pseudonymous identifier for your device, which is used to distinguish different devices and connect usage behaviors on the same device without directly identifying you personally. This identifier varies by platform: on iOS, it is a randomly generated code; on Android, it preferentially uses the Google App Set ID and, when unavailable, uses the device ANDROID_ID subjected to one-way hashing (SHA-256) — we do not upload or store the raw ANDROID_ID value; on web and when none of the foregoing sources are available, a randomly generated code is used.

Data collected through this system includes: device type, device brand and model, operating system and version, language settings, time zone settings, application version and install source (channel), as well as usage data such as app launches, page views, clicks, feature usage, and event statistics.

This first-party system does not collect advertising identifiers (such as IDFA / Google Advertising ID), precise location, or raw device hardware identifiers. Advertising identifiers are collected only by the third-party advertising and attribution services described in Section 1.4, for the purposes stated therein, and subject to the authorization mechanisms described in Section 1.6.

1.6 Platform Tracking Authorization and Advertising Consent

In accordance with the requirements of different platforms and jurisdictions, we provide the following mechanisms through which you may grant or refuse permission for the collection or use of specific data (such as device identifiers, advertising identifiers, and usage behavior) for advertising delivery, advertising effectiveness analysis, install source attribution, or personalized recommendations:

• App Tracking Transparency (ATT, iOS): On iOS, the system will ask whether you allow the App to track your activity across other companies' apps and websites. You may change this choice at any time in the system settings.
• Advertising identifier controls (Android): You may reset or delete your advertising ID in the system settings, or opt out of advertising personalization.
• Consent for users in the European Economic Area, the United Kingdom, and Switzerland: Before advertisements are shown to you, we present a consent form provided through Google's certified consent management platform, in which you may consent to or refuse the use of your data for personalized advertising, and review the ad partners involved and their purposes. You may reopen this form and change your choice at any time via Me > Settings > Ad privacy options within the App. This entry is displayed only to users subject to the applicable regulations.

If you refuse, it may affect advertising relevance, advertising effectiveness measurement, or your personalized experience, but will not affect your use of core features. Refusing consent does not prevent advertisements from being shown; it means that the advertisements shown will be non-personalized.

1.7 Advertising Services and Rewarded Advertising

The App displays rewarded video advertisements, which are shown only after you actively choose to watch them. They are currently offered at two places: obtaining gold coins in the wallet, and continuing a conversation when your balance is insufficient.

• After you complete the viewing of a rewarded advertisement, we issue the corresponding virtual currency reward to your account. If viewing is not completed, or the App is closed or moved to the background during playback, the reward may not be issued.
• To issue rewards, prevent fraudulent claiming, and reconcile revenue, we record the advertising placement, session identifier, viewing status, completion time, and reward issuance status, and associate them with your account or guest identity.
• Advertising content is provided by third-party advertisers via AdMob and does not represent the Platform's position or endorsement. Where advertising content is unlawful or inappropriate, you may report it through the reporting mechanism provided by the advertisement or by contacting our customer service.
• We do not sell your personal data to advertisers.

II. Purposes for Using Personal Data

We collect and use your personal data primarily for the following purposes:

• Providing guest mode, account registration, login, binding, identity authentication, and account management;
• Providing IM chat, AI dialogue, script/storyline interaction, virtual character interaction, contextual continuity, and content presentation;
• Providing personal growth, level systems, virtual character recommendations, content recommendations, and personalized experiences;
• Providing speech-to-text, photo upload, text input, customer service, reporting, blocking, and system notification features;
• Processing top-ups, virtual currency, membership, items, transaction records, order verification, refund disputes, virtual asset distribution, and customer service inquiries;
• Delivering advertisements (including personalized advertising where you have consented), issuing rewards for rewarded advertisements, measuring advertising performance, and preventing advertising fraud and abuse;
• Conducting application data statistics, install source attribution, advertising effectiveness measurement, product analysis, and operational optimization;
• Troubleshooting errors, fixing crashes, improving performance, and maintaining service stability;
• Conducting platform security, risk control, anti-cheating, anti-fraud, abuse prevention, compliance review, and fulfilling necessary legal obligations;
• Conducting age verification and age-appropriate content distribution: performing identity screening in accordance with app store age rating standards and platform rules, and providing you with virtual characters and script/storyline recommendations that meet age standards. This information will not be sold to any third party.

III. Data Retention and Deletion

3.1 Retention Period

Your personal data will be retained throughout the period of your use of the Service. If you delete your account, we will process the relevant data deletion request within a reasonable period, typically deleting most data within 72 hours; data in backup systems may be completely purged after a maximum of 180 days, except where retention is required by law, transaction dispute resolution, risk control and security, auditing, compliance, or other legal requirements.

Data under guest mode may be associated with anonymous user IDs, guest IDs, device information, or application instance identifiers. If you clear App data, delete the App, change devices, or fail to complete account binding, guest data may become unidentifiable or irrecoverable.

3.2 Methods of Data Deletion

You may complete account cancellation directly within the App via the following path: Me > Settings > Account & Security > Delete Account. After reading and confirming the relevant notices, the system will proceed with cancellation and data deletion in accordance with the process.

If you wish to delete guest mode data, partial data, or require customer service assistance with data deletion, data inquiries, data correction, or other matters, you may also contact us via the customer service email: contact@aveil-ai.app.

IV. Data Sharing, Entrusted Processing, and Third-Party Services

We do not sell your personal data. Except as otherwise described in this Policy, with your authorization or consent, to fulfill legal obligations, or as necessary to provide the Service, we will not provide your personal data to unrelated third parties.

• Service Provider Processing: To provide cloud storage, data analysis, install source attribution, payment processing, error diagnosis, customer service, security and risk control, or other necessary services, we may engage service providers to process necessary data under our instructions.
• Advertising and Attribution Partners: To deliver advertisements and measure their effectiveness, we share the data described in Section 1.4 with Google AdMob (and, through it, its ad partners), AppsFlyer, TikTok for Business, and Meta / Facebook. Where you are subject to regulations requiring consent, such sharing takes place only after you have given consent through the mechanism described in Section 1.6.
• Payment Channels: When you top up or make a purchase, Google Play or other payment channels may process payment-related data in accordance with their rules; we primarily receive data relevant to fulfilling the Service, such as completed transaction status, order status, product information, amount, time, and refund status.
• Legal and Compliance: Where required by legal process or by competent authorities or judicial authorities, we may provide necessary data in accordance with the law.
• Rights Protection: To prevent fraud, abuse, violations, information security incidents, or to protect the legitimate rights and interests of users, the platform, and third parties, we may process or provide relevant data to the extent necessary.

V. Cross-Border Data Transfers

As we may use offshore servers, cloud services, or third-party service providers (such as AWS, Google Cloud, Google Firebase, Google AdMob, AppsFlyer, TikTok for Business, Meta / Facebook, etc.), your data may be transferred to, stored in, or processed in jurisdictions outside your country/region of residence. Such data will be subject to local laws, but we will implement encryption, access controls, and other reasonable measures to safeguard data security.

VI. Protection of Minors

• The virtual social and AI interaction services provided by this platform are intended solely for users aged 18 and above (or the age of majority prescribed by the laws of your jurisdiction). We strictly prohibit any minor from registering, using the Service in guest mode, or otherwise using the Service.
• The platform may implement age verification mechanisms during registration, login, guest usage, or service usage. If we discover or are reported to have inadvertently collected personal information of a minor during operations, the platform will immediately take measures, including but not limited to restricting or suspending the Service, permanently closing the relevant account or guest identity, and deleting the relevant personal data in accordance with the law.

VII. Features and Policy Updates

Aveil currently offers features such as guest mode, IM messaging, AI script/storyline interaction, virtual character recommendations, data analysis and attribution, advertising and rewarded advertising, top-ups, and other value-added services. If features are added, adjusted, or discontinued in the future, or if new third-party SDKs, data types, purposes of use, sharing methods, or other data processing methods are introduced, we will update this Policy in accordance with applicable laws, regulations, and platform rules, notify you, and re-obtain your authorization or consent where necessary.

VIII. Information Security

We employ a range of technical and administrative measures to help safeguard the security and privacy of your data against unauthorized access, disclosure, alteration, or destruction, including but not limited to:

• Encryption of data during transmission;
• Identity authentication, access control, and risk control strategies;
• Limiting backend data access to authorized personnel to the extent necessary;
• Regular security audits, risk assessments, and vulnerability patching;
• Security monitoring of transactions, accounts, guest identities, and abnormal behavior.

IX. Your Rights

To the extent permitted by applicable law, you may, through in-App features or by contacting customer service, request to inquire about, access, correct, supplement, or delete your personal data, withdraw your authorization or consent, or apply for account cancellation. You may withdraw your consent to personalized advertising at any time through the paths described in Section 1.6. Due to technical limitations, legal obligations, transaction disputes, security and risk control, backup systems, or other lawful reasons, we may be unable to immediately or fully satisfy certain requests, but we will provide you with an explanation in accordance with the law.

X. Contact Us

If you have any questions, comments, complaints, or data rights requests regarding this Privacy Policy or the processing of personal data, please contact us at:

• Customer Service Email: contact@aveil-ai.app
• Service Hours: Monday to Friday, 10:00 - 18:00 (UTC+8)

Date of Last Update: September 3, 2026

Effective Date: September 3, 2026