We Value Your Privacy

We use essential cookies for authentication and optional analytics and advertising measurement only with your consent. Learn more

Privacy Policy

Last Updated: October 3, 2026

Introduction

Wallies LLC ("we", "our", "us") operates Wallies, a creator-economy platform. Our products and surfaces include:

  • Lubs — personalized AI companions with chat, voice, memory, and 3D avatars
  • Rooms — short-form video feed (upload, discovery, comments, likes, reposts)
  • Closets — community servers with text channels, voice channels, threads, and bots
  • Banter — community-driven posts, discussions, comments, and voting
  • Ink — serialized written content (chapters, series, paid memberships)
  • Music — track uploads, albums, playlists, fan memberships, mailing lists, listening analytics
  • Livestreams — live broadcasts, tipping, gifts, paid stream tickets
  • Direct Messages — 1:1 and group messaging, attachments, voice messages
  • Marketplace — user-created avatars, animations, music, themes, chat backgrounds, and digital assets
  • Drops — limited-edition releases sold by creators
  • Storefronts — creator-owned shops
  • Handles — unique username inventory, listings, and resale marketplace
  • Hosted Video — creators paying other users to display their video posts
  • Forge — AI-powered no-code app and game builder, plus the Forge directory where users discover, install, and purchase apps and games (formerly "App Store")
  • Allforge — trading card game with AI-generated card art, decks, binders, and matches
  • WalliesCards — founder, referral, and developer cards with platform benefits
  • ILY Economy — in-app currency, rewards, daily claims, creator earnings, payouts, and cash-outs

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information across all of these surfaces, in compliance with GDPR, CCPA, and other applicable privacy laws.

1. Information We Collect

1.1 Information You Provide

  • Account information (name, email, date of birth, handle)
  • Parental/guardian consent records (for users 13–17)
  • Conversation data with your AI companion
  • User-generated content (videos, posts, music, avatars, photos, memories, animations, apps, drops, storefronts, handles)
  • Companion customization, room/closet settings, and marketplace listings
  • Messaging and community content in Closets, DMs, and hosted rooms
  • KYC / identity verification documents where required for payouts or creator activation

1.2 Automatically Collected Information

  • Device information (browser type, OS, device identifiers)
  • Usage data (features used, session duration, interactions)
  • IP address and geolocation (country/region level)
  • Cookies and similar tracking technologies

1.3 Voice & Audio Data (with explicit consent)

Wallies handles audio differently depending on the feature:

  • Companion voice commands: Your speech is transcribed to text in your browser. The raw audio is not uploaded or stored — only the resulting text transcript is saved.
  • Uploaded videos: The audio track of videos you upload is transcribed (via OpenAI Whisper) for accessibility, captions, and safety moderation. The video file itself, including its audio, is stored to serve the post.
  • Voice rooms, livestreams, and voice messages: Audio is transmitted in real time through our voice/streaming providers (Daily.co, Mux, Cloudflare) so other participants can hear you. Livestreams may be recorded by the streamer or the platform for replay and safety review. Voice messages you send are stored as audio files.
  • Voice usage statistics (frequency, last used date)
  • Voice data retention preferences

1.4 Information from Third Parties

  • Payment and payout information from Stripe (we do not store full card numbers or bank details)
  • Video delivery, encoding, and analytics from Bunny Stream, Mux, and Cloudflare Stream
  • Voice / livestream session metadata from Daily.co and Cloudflare
  • Google Account data (name, email, profile picture) if you sign in with Google
  • GIF search metadata from GIPHY when you insert a GIF

1.5 Data Sent To Third-Party AI & Safety Providers

To power AI features and enforce safety, certain content you submit is sent to specialized third-party processors. These providers act on our behalf under contract and are not permitted to use your data to train their own generalized models:

  • OpenAI — companion chat prompts, message moderation classification, audio transcription (Whisper) for uploaded videos, and memory embeddings.
  • ElevenLabs — companion text-to-speech synthesis (text you send is converted to audio).
  • Google Cloud Vision — automated scanning of uploaded images, video thumbnails, and sampled video frames for prohibited content (CSAM, sexual content involving minors, violence).
  • Cloudmersive — virus and malware scanning on uploaded files (marketplace assets, message attachments, app uploads).
  • Perceptual hashing — we compute a perceptual fingerprint (pHash) of uploaded thumbnails and images to detect re-uploads of previously-blocked or infringing content. The hash is stored; the original image is not stored solely for this purpose.
  • Meta, TikTok, and Google Ads Conversions / Pixel APIs — if you arrived from a Meta, TikTok, or Google Ads campaign, hashed identifiers and event metadata may be sent to measure ad effectiveness. You can opt out via your cookie preferences.

See our Subprocessors List for the full list of processors and their roles.

2. How We Use Your Information

We use your information to:

  • Provide and personalize Wallies features (Lubs, Rooms, Closets, Banter, Ink, Music, Livestreams, Direct Messages, Marketplace, Drops, Storefronts, Handles, Hosted Video, Forge, Allforge, WalliesCards)
  • Deliver, recommend, and promote content uploaded by creators
  • Process payments, subscriptions, and creator payouts via Stripe
  • Power the ILY economy (purchases, earnings, settlement, chargeback protection)
  • Improve AI responses, moderation, and discovery
  • Communicate service updates, security notices, and support
  • Ensure safety, enforce our Terms, and run moderation and appeals
  • Comply with legal, regulatory, and tax obligations
  • Prevent fraud, abuse, and platform manipulation

Human Review of Companion Conversations & User Content

To enforce our safety policies, investigate abuse reports, respond to safety signals (including suspected harm to minors, CSAM, self-harm, threats, or platform abuse), debug technical issues, improve moderation systems and AI quality, and personalize user experiences, authorized Wallies personnel may review individual companion conversations, direct messages, room messages, and other user-authored content. Such review is logged internally, limited to what is necessary for the operational purpose, and never used for advertising or sold to third parties. We do not routinely browse user conversations.

Automated Safety Systems

We use automated systems — including content classifiers, perceptual hash matching, and AI moderation models — to detect prohibited content such as CSAM, sexual content involving minors, threats of violence, self-harm intent, and hate speech. These systems may automatically block, flag for human review, or restrict content. You have the right to appeal automated moderation decisions via the in-app appeals flow.

Music Platform Specific:

We collect only the data necessary to operate the music streaming platform.

  • We do NOT sell user data
  • Artist content is displayed with proper attribution
  • Listening analytics help improve discovery algorithms

2.1 AI Conversations & Safety — How We Process AI Interactions

Wallies operates AI companions (Lubs), AI-assisted moderation, AI-powered app generation (Forge), and AI card-art generation (Allforge). Because companion conversations and AI interactions often carry higher emotional and privacy expectations than ordinary product features, this section explicitly describes how those interactions are handled.

Automated Processing (always applied)

  • Your messages are sent to the configured LLM provider (OpenAI by default; alternative providers available on eligible tiers) to generate a response.
  • Every input and output is scanned by automated moderation classifiers for safety violations — including CSAM, sexual content involving minors, threats of violence, self-harm intent, and hate speech.
  • Selected messages may be embedded into long-term memory vectors so your companion can recall context across sessions. You can review and delete memories in Settings.
  • Aggregated, non-identifying signals (error rates, latency, refusal counts) are used for service quality and reliability monitoring.

Limited Human Review (for legitimate operational purposes)

Authorized Wallies personnel may review individual companion conversations, prompts, AI outputs, direct messages, room messages, comments, and other user-authored interactions for the following operational purposes:

  • Investigating abuse reports or safety incidents
  • Responding to suspected harm to minors, CSAM, self-harm, threats, or platform abuse
  • Enforcing our Terms, Acceptable Use Policy, and Community Guidelines
  • Debugging, quality assurance, and resolving technical issues
  • Improving moderation systems, AI response quality, companion behavior, and user experience
  • Personalizing your experience and tuning memory/recommendation features
  • Responding to valid legal process

Review is limited to what is necessary for the purpose and is not used for advertising or sold to third parties. Each access event is logged with the responsible employee, the reason, and (where applicable) the linked incident or ticket ID. See AI Ethics & Transparency → "Internal Access Governance" for the full access-control framework.

Personalization & Service Improvement

  • Your conversation history personalizes your companion's tone, memory, and behavior for you specifically.
  • De-identified, aggregated patterns may be used to improve Wallies' own moderation classifiers and prompt safety.
  • We do not use your conversations to train generalized/foundation AI models — neither ours nor any third-party provider's. Our agreements with OpenAI, ElevenLabs, and Google Cloud Vision specifically prohibit use of your data for their generalized model training.

What We Never Do

  • Sell, rent, or share your conversation content with advertisers or data brokers
  • Allow casual or unsupervised browsing of user conversations by Wallies staff
  • Read conversations of users who have not been flagged, reported, or otherwise tied to a legitimate operational purpose
  • Use your conversations to train generalized AI models

Companion AI Disclosures

Because companions can feel personal, we want to be explicit:

  • AI responses may be imperfect, factually wrong, or inconsistent. Do not rely on companion output for medical, legal, financial, or safety-critical decisions.
  • Companion personality is software simulation — it does not feel emotions, consciousness, or reciprocal connection.
  • All companion interactions are subject to automated moderation and the limited human review described above.
  • Memory and personalization may persist across sessions; you can review and delete memories at any time in Settings.
  • Prohibited-content boundaries apply at all times: CSAM, sexual content involving minors, threats, self-harm coaching, and illegal-activity coaching are blocked regardless of user request or roleplay framing.
  • Sexual roleplay, sexually explicit imagery, and sexual content are prohibited for all users regardless of age. See our Mature Content & Age Restrictions policy.

3. Legal Basis for Processing (GDPR)

We process your data based on:

  • Contract Performance: To provide services you've subscribed to
  • Consent: For optional features (e.g., specific AI providers, voice)
  • Legitimate Interest: For service improvement and fraud prevention
  • Legal Obligation: To comply with laws and regulations

4. Data Sharing & Disclosure

We do NOT sell your personal data. We share data only as follows:

  • Service Providers: Stripe (payments & payouts), OpenAI and ElevenLabs (AI chat, transcription, and voice synthesis), Google Cloud Vision (automated image safety scanning), Cloudmersive (virus/malware scanning), Bunny Stream, Mux, and Cloudflare Stream (video encoding & delivery), Daily.co (voice/video rooms), Google (optional sign-in), GIPHY (GIF search). See our Subprocessors List.
  • Advertising & Analytics Partners: On the website, Meta (Facebook/Instagram), TikTok, and Google Ads may receive hashed identifiers and event metadata for ad attribution and measurement only after cookie consent. Under CCPA/CPRA, this may be considered "sharing" of personal information for cross-context behavioral advertising. Advertising tracking, advertising cookies, click-ID collection, and advertising-partner disclosures are disabled in the iOS App Store version.
  • Legal Requirements: When required by law, court order, or to protect rights
  • Business Transfers: In case of merger, acquisition, or asset sale (with notice)

4.1 Google User Data (Google OAuth / Sign-In with Google)

Wallies, developed and operated by Wallies LLC, uses Google OAuth 2.0 to allow users to sign in with their Google Account. This section specifically discloses how our application accesses, uses, stores, and shares Google user data, in compliance with the Google API Services User Data Policy, including the Limited Use requirements.

What Google user data we access:

  • Your Google Account email address
  • Your basic profile information (name and profile picture)
  • Your Google Account unique identifier (sub / openid)

We request only the minimum scopes required to authenticate you: openid, email, and profile. We do not access Gmail, Drive, Calendar, Contacts, Photos, or any other Google service data.

How we use Google user data:

  • To create and authenticate your Wallies user account
  • To display your name and profile picture inside the app
  • To send essential service and account-related emails to your Google email address
  • To prevent fraud, abuse, and duplicate accounts

We do not use Google user data for advertising, to train generalized AI/ML models, or for any purpose unrelated to providing and improving the Wallies service you requested.

How we store Google user data:

  • Stored encrypted in transit (TLS) and at rest (AES-256) on our managed infrastructure
  • Access is restricted to authorized personnel on a need-to-know basis
  • Retained for the life of your account; deleted within 90 days of account deletion
  • We do not store your Google password — authentication is handled entirely by Google

How we share Google user data:

We do NOT sell, rent, or transfer your Google user data to third parties for independent use, advertising, or marketing. We share Google user data only with:

  • Our authentication and hosting infrastructure providers, acting strictly as processors on our behalf (see our Subprocessors List)
  • Law enforcement or regulators when required by valid legal process
  • A successor entity in the event of a merger, acquisition, or asset sale (with notice to you)

Limited Use compliance:

Wallies' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

  • Use Google user data to serve advertisements
  • Transfer Google user data to third parties except as necessary to provide or improve the app, comply with law, or as part of a merger/acquisition
  • Allow humans to read Google user data unless we have your affirmative consent, it is necessary for security, to comply with law, or the data has been aggregated and anonymized
  • Use Google user data to develop, improve, or train generalized/non-personalized AI or ML models

You may revoke our access to your Google Account at any time at myaccount.google.com/permissions, or by deleting your Wallies account in Settings.

5. Data Retention

We retain your data:

  • Account data: Until you delete your account + 90 days
  • Conversation data (companion chats, DMs, room messages, comments): Stored on our managed servers (encrypted in transit and at rest) so you can access your history across devices, for up to 3 years from creation by default (longer only where content is flagged, under a safety review, or subject to legal hold). Deleted within 90 days of account deletion, except where retention is required for safety, legal, or compliance reasons (see safety retention below).
  • Voice transcripts: According to your retention settings (30, 90, 180 days, or never delete). Default: 90 days. You can delete all voice data at any time in Settings → Privacy.
  • Payment records: 7 years (tax/legal requirements)
  • Safety, moderation, and compliance records (flagged content, abuse reports, moderation decisions, security audit logs): Retained as required by law and our safety obligations, typically 1–7 years depending on category. CSAM-related evidence is preserved for a minimum of 90 days per 18 U.S.C. § 2258A.
  • Backup data: Up to 90 days in secure backups

5.1 Voice Data & Microphone Permissions

How Companion Voice Commands Work:

This subsection applies only to talking to your AI companion by voice. Voice rooms, livestreams, voice messages, and uploaded video audio are covered in Section 1.3 above.

  • Your voice is transcribed to text in real-time using browser APIs
  • For companion voice commands, the raw audio is not uploaded or stored on our servers
  • Only text transcripts are stored to improve companion responses
  • Transcripts are retained based on your chosen retention period
  • You can delete all companion voice transcripts at any time

Parental Consent for Minors:

  • Users aged 13–17 require verifiable parental/guardian consent to enable microphone features
  • Parent/guardian email is collected for verification purposes
  • Parents can revoke microphone access at any time
  • Enhanced safety controls for voice data of minors

Your Voice Data Rights:

  • View voice usage statistics (total commands, last used date)
  • Choose retention period: 30, 90, 180 days, or never delete
  • Delete all voice transcripts with one click
  • Revoke microphone permission at any time
  • Export voice transcripts as part of data export (GDPR)

Manage your voice settings at: Settings → Privacy → Microphone Permissions & Voice Data

6. Your Privacy Rights

All Users Have the Right To:

  • Access your personal data
  • Correct inaccurate information
  • Request deletion ("Right to be Forgotten")
  • Export your data in portable format
  • Withdraw consent for optional processing

Additional Rights (GDPR - EU/EEA/UK):

  • Object to automated decision-making
  • Restrict processing of your data
  • Lodge a complaint with your local Data Protection Authority

Additional Rights (CCPA / CPRA - California):

  • Know what personal information is collected, used, and shared
  • We do not "sell" personal information for money. We do "share" hashed identifiers with advertising partners (Meta, TikTok, Google Ads) for cross-context behavioral advertising as described in Section 4.
  • Right to Opt Out of Sharing: You can opt out via your cookie preferences or by emailing privacy@wallies.com
  • Right to limit use of sensitive personal information
  • Non-discrimination for exercising privacy rights

To exercise your rights, visit your account settings or contact privacy@wallies.com

7. Data Security

We protect your data with:

  • Encryption in transit (TLS/SSL) and at rest (AES-256)
  • Access controls and authentication
  • Regular security audits and monitoring
  • Secure subprocessor agreements

However, no method is 100% secure. Use strong passwords and enable two-factor authentication when available.

8. International Data Transfers

Your data may be transferred to and processed in the United States and other countries. We ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission and other appropriate safeguards.

9. Children's Privacy, Minors & NSFW Framework (COPPA & GDPR)

Minimum age: Users under 13 are strictly prohibited from creating accounts or using Wallies in any capacity. Account creation requires a valid date of birth, which is collected once at signup and cannot be changed by the user. Attempts to register as under-13 are rejected and logged.

Users 13–17: Require verifiable parental or guardian consent. Minors operate under a restricted-mode account with enhanced safety controls, disabled monetization features, and stricter content filters. Companion behavior automatically adapts based on the user's verified age.

COPPA & consent mechanism: We comply with the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506) and do not knowingly collect personal information from children under 13; if we learn we have, we delete it promptly. For users 13–17, a parent or guardian receives an invitation, creates a guardian account, and approves consent through the Guardian Portal. Guardian identity is verified (KYC) before any payout-related features are enabled, and consent is periodically re-verified.

Age-ambiguous and suspected-minor accounts: Accounts that exhibit signals consistent with underage use (bio mentions, network patterns, language patterns, face-age detection on uploads) may be flagged for review and automatically restricted pending verification, even where a date of birth has been entered claiming 18+.

Prohibited sexual content: Sexual content, sexual roleplay, sexually explicit imagery, and CSAM are prohibited on Wallies regardless of user age, account type, companion, or surface. These rules apply to companion conversations, room videos, banter posts, marketplace items, profile images, livestreams, ink chapters, and every other Wallies surface. Detection is automated and continuous; violations result in immediate content removal, account suspension, and where legally required, reporting to NCMEC under 18 U.S.C. § 2258A.

Enforcement: Suspected violations are logged, reviewed by Trust & Safety, and acted on under our Acceptable Use Policy. Bans for minor-safety or CSAM-related violations are permanent and non-appealable except where required by law.

Parents may review, modify, or delete their child's data, or revoke consent at any time, by contacting privacy@wallies.com. See also our Mature Content & Age Restrictions policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our services, legal obligations, safety practices, or data handling procedures.

When required by applicable law or when changes materially affect user rights or how personal information is used, we will provide appropriate notice through the Service, email, or other reasonable means before such changes take effect.

Certain updates related to security, abuse prevention, fraud detection, moderation, or platform safety may become effective immediately.

The "Last Updated" date indicates when this Privacy Policy was most recently revised.

11. Contact & Data Protection Officer

Wallies LLC

Data Protection Officer

66 W Flagler Street, Suite 900

Miami, Florida 33130

Email: privacy@wallies.com

General Inquiries: contact@wallies.com

EU Representative (GDPR Article 27)

EU and EEA residents may contact our EU representative regarding data protection matters at eu-representative@wallies.com. Representative details are available on request.

Do Not Sell or Share My Personal Information (CPRA)

California residents can opt out of the "sharing" of personal information for cross-context behavioral advertising from Your Privacy Choices or by emailing privacy@wallies.com. We do not sell personal information.