Privacy

hikomi · Privacy Policy

Last updated 10 October 2026, with version 0.5.3. When a feature changes what is sent, stored or shared, this page changes in the same release.

Dasar ini juga ada dalam Bahasa Melayu: gethikomi.com/privasi

The short version

We keep what hikomi needs to work: your account details (from Google, or the email and name you sign up with), your conversations so the characters remember you, your credits and payments, and counts of how the app is used.
We don't sell your data, we don't show ads, we don't use tracking cookies, and we don't use your conversations to train AI.
So that the characters can answer, your messages go to Anthropic, the company whose AI (Claude) writes the replies. Each message also gets a quick automated safety check by TypeSafe. With web lookups on in Assistant mode, the search words written from your message and the addresses of pages opened also go to Anthropic and its search provider. Everything else stays on our servers in Malaysia.
A 3D model of your own, if you add one in the desktop app, stays on your computer. We never receive the file; a small picture of it reaches us only if you choose that.
A VRM file you export from a model you brought, in the desktop app, is made on your computer and saved where you choose (exporting a character you made in the creator isn't available yet). We keep a record that an export happened, so your plan can count it: when, which character (for a model you brought, only that it was a model) and how it ended (finished or given back - or, if hikomi was never told how it went, nothing more than that the place was taken, which stays counted). Nothing about the file is kept. The zip of moves that can come with it is made and saved the same way, and nothing about it is counted.
You can download everything we keep about you, or delete all of it, from the account menu at any time.

Who is responsible for your data

hikomi is run by HIKOMI LABS, a business registered in Malaysia (SSM registration no. 202603256310 (TR0350156-T)), of 46, Jalan 17/43, 46400 Petaling Jaya, Selangor, Malaysia, which decides how your data is used and is responsible for it. For anything about your data, email support@gethikomi.com, or use the contact form at gethikomi.com/contact and pick "My data or privacy".

This policy covers hikomi's websites - hikomi.ai, where you find out about hikomi, and gethikomi.com, where the app, accounts and payments are - and the hikomi desktop app. It doesn't cover Google's sign-in or Stripe's payment pages, which have their own privacy policies. The hikomi Discord bot, in the hikomi Discord server, has its own page: gethikomi.com/discord-privacy.

What we keep, and why

Your account. If you use Google: your email address, your name, your profile picture and Google's ID for your account, from Google when you sign in. If you sign up with an email instead: your email address, the name you give (if any), and your password - kept only as a salted, one-way hash, so nobody, including us, can read it back. Either way we also keep when you joined and last signed in, when you agreed to the terms and which version, and the age group you told us (18 or over, or 16-17). We need these to sign you in, to show who is signed in, to show what you agreed to, and to apply the right rules for your age. If you set them in the account menu, your daily spending limit and warning level, with your device clock's offset from UTC (to know when your day starts), are kept until you change them or delete your account, and are in "Download my data". The app also sends that offset when it asks for your balance, to show what you have spent today; it is not kept unless you save a setting.

Sign-up and password codes. When you sign up with an email, or ask to reset your password, we email you a six-digit code. Until it's used, we keep a one-way hash of the code, your email address and (for a sign-up) the name and hashed password you chose, for at most 15 minutes. To stop people guessing passwords or flooding inboxes, we also count sign-in attempts and codes sent for each email address and internet address, in memory only, for up to an hour.

Where you came from. If you reach hikomi through a link that carries a tag (like hikomi.ai/?ref=a-post), or by clicking a link on another website, the page remembers one short label in your browser for up to 30 days: the tag, or "site:" and only the other website's name (like reddit.com) - never the page you were on, and never anything about you. If you then make an account, that label is kept with it, once, so that the developer can count which posts and communities bring people in, and how many of those go on to use hikomi or pay. It is not shared with anyone, and it is deleted with your account (or, if you don't make one, when you clear your browser's site data, or after 30 days). Each of our two addresses keeps its own browser storage, so when you go from hikomi.ai to gethikomi.com (where accounts are made), the label goes along in the link. If your browser sends "Do Not Track" or "Global Privacy Control", none of this happens.

Your conversations. What you say to each character and what it says back, a summary of the older part of long conversations, and a note whenever a screenshot, or text you had copied, went with a message (never the picture or the text itself - though the character's reply is kept as written, even where it quotes what you copied). This is how the character remembers you. Kept until you erase that character's memory or delete your account.

What the character knows about you. From your conversation, a small AI pass (Claude, from Anthropic) keeps short notes about you for each character - like the name you go by, what you're working on, people and pets you've mentioned - each with the message it came from, and up to five things you said you'd do or were waiting on (an interview, an exam), with a date if you gave one. The notes go to the AI with your messages, so the character remembers; a follow-up is asked about once - in reply to what you next say, or, unless you turn it off under History > About you, by the character starting the conversation when you come back - when the page opens or comes back to the front, when you use it again after a while, or in the desktop app when you use the keyboard or mouse again after 20 minutes away (that is checked on your computer and not sent anywhere); the request carries your device's date and time zone, which aren't kept - and then kept only so it isn't asked again. You can see all of it under History > About you: forget a note, correct it, pin it, add your own (and choose whether every character you talk to sees one you wrote), or dismiss a follow-up. A note you forget is kept, marked, so the character won't bring it up and it isn't noted again; after a change, a short line about it waits for the character's next reply, for up to a day. All of this is kept with that character's conversation, erased with it ("History", then "Clear") or with your account, and included in "Download my data".

Your card and how close you are. Under History > About you you can also fill in a card - what to call you, your pronouns, your time zone and a few lines about you, 600 characters in all - which every character you talk to sees, and choose, for each character, how close the two of you are (from Stranger to Close friend; Crush and Partner only for adult accounts, and only with a character that allows it). Both go to the AI with your messages. If you give a time zone, it is also used to work out when a follow-up you mentioned is due. With each message, the app also sends your device's time zone and today's date there, so that the character is told the date and whether it is morning, afternoon, evening or night where you are, and how long it has been since you last talked to it; they are used for that reply and not kept. The card is kept until you change it or delete your account; the choice for a character is erased with that character's memory. Both are included in "Download my data".

Journal. Earlier versions of the desktop app could ask one short question about your day in the evening, and kept the question and your answer in History > Journal. That has been removed and nothing new is added. Entries already saved stay with that character's conversation until you remove one in the Journal, or all of them with "Clear"; they are included in "Download my data".

Web lookups (Reply Mode: Assistant, Settings > Assistant, on unless you turn it off). When a question needs something current - news, a price, a version, a page you named - the character can search the web or open a page before it answers. The search words are written by the AI from your message, and they, and the addresses of the pages it opens, go to Anthropic and the search provider it uses; the pages are opened by Anthropic's servers, not from your device, so the websites see Anthropic, not you. We keep no search words and no page text - only the titles and addresses of the pages an answer used, shown under it as sources and kept with the conversation like the rest of it (erased with it, and included in "Download my data"). What a page says is never acted on: the character can only read.

Characters you make. Their name, the personality you wrote, the voice you chose (and, if you shaped it, its pitch, speed, warmth and liveliness), and their look - which body, and the hairstyle, outfit, colours, sizes, accessories, face marks and art style you picked in the creator. What a character notices on your screen ("What the character notices" in Settings > Comments, or the creator's Screen tab): up to three things to always notice, up to three to leave alone and a tone for remarks, as you typed them. For a character you make they are kept with it; for the app's own characters they are kept with your account. They go to the AI with each Comments look and Live comments glance (as your words, not as something on the screen), are deleted with the character or your account, and are in "Download my data". The look is kept as settings, never as a model file - and a 3D model of your own, in the desktop app, is never part of the character (see "Your own 3D models (desktop app)" below). When you save a character, the creator also draws a small picture of it from those settings, which shows it on its card on hikomi's front page - only to you. Nothing of yours is uploaded to make it. Kept until you delete them or your account. Characters you make in the desktop app while signed in are kept with your account the same way, since the replies are written on our servers; one made there before version 0.5.0, kept only on your computer, is moved to your account the next time the app lists your characters. The desktop app asks you to log in before you make one. For a character that wears a 3D model of your own, what reaches our servers is only the model's name, a short code made from the file and which of hikomi's bodies - or just a picture - stands in for it elsewhere; the model file never does.

Voices you make from a personality. If you use "Make a new voice from the personality" in the creator (where it is offered), TypeSafe's check reads the character's name and personality and answers a few fixed questions about the voice: a woman's or a man's, how old, how low or high, how warm and lively, whether it has an accent or a husky sound, and whether the words ask for a real person's voice or for a child's. hikomi's code writes a short description of the voice from those answers; the name and personality are never kept, and never reach the model that makes the voice. That model - an open-source one, Qwen3-TTS or VoxCPM2, that runs on our own servers - makes three voices from the description, each saying the same fixed sentence; a second open-source model, Resemble Enhance, which also runs on our own servers, then cleans up each recording; each is checked, and played back to you in the creator. For a day we keep that round: the three recordings, the lines you hear them say, the description, which model made them and when. If you keep one, we keep it with your account (see "How long we keep it"): its recording of the fixed sentence, the description, which model made it and when, how far its moods move the voice, and which character it was saved with. A recording is made by the model: it is not a recording of any person, and nothing about you goes into it. A working copy of each recording that is used sits on the machine that makes our voices (Azure, in Malaysia), so that it can speak; it is deleted with the voice - at once from a machine that is running, and from one that is off at its first voice request after it starts. A voice is private to your account and belongs to one character, and you can have at most 20 kept voices. A voice you keep is included in "Download my data" (its description, which model made it, the fixed sentence and its recording), and it goes, with any round still kept, when you delete your account.

Exports of characters you made and models you brought (desktop app). Exporting a character you made in the creator isn't available yet. In the desktop app you can export a model you brought (a VRM 1.0, GLB, glTF or FBX file) as a VRM file: it is made on your computer from the model in hikomi's folder and saved where you choose, and it is never sent to hikomi, to Anthropic or to anyone. So that a plan's exports can be counted, hikomi records that an export happened: when you asked for it, which character, whether it was finished or given back (or, if hikomi was never told how it went, only that the place was taken, which stays counted), and when that was - nothing about the file, its name, its look or its size. For a model you brought the record says only that it was a model, in the place of the character: nothing about the model is sent or kept, not its name, its kind, its size or its code. These records are used for the count and nothing else, and are included in "Download my data". The record of an export that was given back is deleted a month later; the others are kept until you delete your account. The zip of moves that can come with an export (a box in the export window, ticked to start) is made on your computer from the moves the app already has and saved where you choose; it is never sent to hikomi, to Anthropic or to anyone, and nothing about it is recorded: not that it was made, saved or left out.

Credits and payments. Your credit history (what was charged for each reply, voice or screenshot, and what was added), your plan and its status, and a record of each payment: which plan or pack, how many credits, the amount and the date - and of any refund or chargeback on it, with the credits it took back. We need these to run your balance and for our accounts. Stripe handles your card; we never see or store card details.

Usage counts. For each reply: how long it took, whether it failed, whether a screenshot went with it, whether a close-up around your mouse went with it, whether text you had copied went with it, whether you spoke your message with the talk key, whether the voice was off for that chat, which of the app's characters it was (one you made is counted only as "custom"), what you told the app you mostly use the character for (gaming, coding, studying, company, watching, everyday help - the choice only, and when and where in the app you set or changed it), and which version of the instructions wrote it. For the voice: the time to the first sound, how many seconds, and whether you had to wait for it to start. In the creator: when a voice is fitted to a personality (and which voice it started from, or that it was refused as a real person's), and when a shaped voice is previewed (which voice, how many seconds, and whether it was free), and each round of new voices made from a personality (which model, how many seconds it took, how many voices came out, whether it was free or what it cost, or that it failed - whether or not you keep one - and when a request is refused as a real person's voice or a child's). Also running out of credits, reaching a daily limit you set (with what had been spent that day), the first time you opened the pinned window (recorded once, with whether it was the app's or the browser's floating one), how often the safety check showed the help card (and whether you closed it with "Not about me") or kept a message for an age check, when a screenshot was left out because your message didn't need it, whether a Live comments glance was for a character with screen settings, when a message complained about the character's last reply (and what kind of complaint - so we can tell whether a change to the characters made them better or worse), when a reply broke one of the promises on the Safety page, whether a suggestion like "share your screen" was shown and taken, and errors (where, and what kind). Separately, what kind of conversation each message was part of (companionship, a story, gaming, studying, work, language practice, questions about the app), counted with the character but not with your account. The counts linked to your account are also grouped by the week you signed up, so the developer can see how far people who joined in the same week get (for example, how many try a reply, share their screen, use the talk key, pin the character to their screen or pay). Never the text of a message or reply, and never audio or pictures. We use these to see what works and what to fix.

Whether you're online. While you're signed in, the website and the app tell us about once a minute that they're open, and whether it's the app or the website (in the desktop app, it goes through the app to us). We keep only the last time we heard, in memory and not on disk, and forget it about two minutes after you close them. The people who run hikomi use it to see how many people are using hikomi right now, alongside the list of accounts. From the internet address those messages come from, our server also works out which country you're connecting from, at most once a day, using a list of address ranges kept on our server (DB-IP's free country list) - the address isn't sent anywhere to look it up. We keep only the country with your account, never the address; it shows in the list of accounts the people who run hikomi see, it's included in "Download my data", and it goes when you delete your account. While the desktop app runs in the tray with its window closed, it is still open, so while you're signed in it sends the same once-a-minute message.

Reports you send. When you use "Report reply" and tick the box: your last message and the reply, the reason you picked and your note. We use them to improve the characters.

Safety and age checks. While the character writes its reply, an automated check (TypeSafe's Jev model) reads your message, with the last few messages before it (so that it can tell a game, a story or a joke from real life), for two things. First, signs that you may be going through something serious, like thoughts of suicide or self-harm: if it finds them, the app shows you where to find real help, and all we keep is a count. Second, signs that you are younger than the age you told us: if it is fairly sure, we keep that one message, the character's line before it, the age group you gave and how sure the check was, so that a person can look at it. Nothing happens to your account automatically - the developer decides whether to ask you about it, change your age group, or close the account under the terms. We do this to keep people safe and to keep hikomi to the ages it is meant for.

Other quick checks. The same check also answers a few small questions so the app works better, and keeps nothing but the counts above: while you share your screen, whether your message needs the screenshot at all (if not, it is left out - not sent to Anthropic and not charged); while Comments is on, whether you are asking the character to be quiet about your screen, or to start again; whether your message complains about the character's last reply; what kind of conversation it is part of (above); when you're not sharing your screen, whether the message needs it (the app may then offer to share it); and whether you are asking the app itself to do something - switch character, pin the character on top, share your screen, turn Comments on or off, hide the controls - in which case a button for it appears (for this the check is also told which of those you could do right now, and the names of the characters you can switch to). And when a message seems to refer back to something from longer ago ("remember when I told you about..."), a few older exchanges from your conversation with that character that share its words are checked for the one you mean, and that one goes to the character with your message, so that it remembers the detail. When you talk by voice, speech recognition is told the character's name first, and if part of what it heard still sounds like the name ("hey called me" for "Hikomi"), the check decides whether that is the name misheard and puts it right - only the text is used, never the recording, and in the desktop app the text goes to gethikomi.com for this. After each reply, the reply is checked against the promises on the Safety page - if it breaks one, only a count is kept, and in a conversation with someone who told us they are 16 or 17, a romantic reply means the character is reminded of the rules on the next message. Before the character says something unprompted about your screen, that remark is checked too: if it repeats what it already said, or reads out something private (a password, an address, a balance, someone's message), it isn't said. Separately, the sentences the character says aloud are checked for a gesture that goes with them (a wave on "hi"), and the character's stage directions (like "*waves*") that the app doesn't recognise are matched to a gesture.

Characters you make. When you save a character's name or personality, the same kind of automated check reads them for the rules in the terms (not under 18, not a real person, not from a franchise, not telling the AI to break its rules). If it finds a likely break, we keep that name and personality, which rules and how sure the check was, so that a person can look at it; nothing happens to the character automatically. Characters made in the desktop app are checked the same way, through gethikomi.com. When you press "Fit the voice to the personality" in the creator, the same check reads the character's name and personality to pick one of the creator's voices and how to shape it; we keep only the count above, never the name or personality, and if they ask for a real person's voice, it is refused. "Make a new voice from the personality" works the same way: the check reads the name and personality to answer the fixed questions described under "Voices you make from a personality" above (and, if it can't tell whether a woman's or a man's voice is wanted, you are asked); we keep only the description and the counts, never the name or personality, and a request for a real person's voice, or for a child's or childlike one, is refused. So that you aren't asked twice, the check's answers - never the words - are held in memory for ten minutes.

Messages to us. What you send through the contact form or by email, and the email address we reply to.

Server logs. Technical records of what the servers did - requests, errors and times, with account numbers rather than names. They never contain the text of conversations.

What you must give, and what is up to you. An account (with Google, or an email address and password), agreeing to the terms, and answering the age question are required: without them we can't create your account or let you chat. Everything else - what you say, the characters you make, buying credits, reports and messages to us - is up to you, and comes to us only when you use those features.

What we don't keep

Your voice. In the desktop app, speech recognition runs on your own computer and your microphone audio never leaves it. On the website, the recording you make while holding the talk button is sent to our server, turned into text, and thrown away; the audio is never stored.

Screenshots. When you share your screen, a picture goes with your message so that the character can see it, and is discarded once the reply is written. With "Comments" switched on while you share, the character also looks unprompted: when your screen changes, and now and then (every few minutes) to check in - each look is one picture, sent and discarded the same way. With "Live comments" (beta) also switched on, a smaller picture goes every few seconds (at most every 10) while your screen is changing, only so that a quicker model can say whether it's a moment to speak up; it is discarded once it has answered, and nothing goes while your screen stays still. A "Watching" sign shows the whole time Comments is watching. When you share a whole screen in the desktop app, replies and comments about it may carry marks too, drawn on that screen the same way. In the desktop app you can also let the talk key look: with "Look at my screen when I press it" switched on (it stays off until you turn it on), pressing the talk key takes one picture of the display your mouse is on. It goes with what you then say in the same way, and is discarded in the same way. Where your mouse pointer was on that picture goes with it, so that the character can tell what "this" or "here" means; it is sent only with the talk key's picture, never on its own or with a screen you share, and is discarded with the picture. On a large display (more than about 2,100 pixels on its longer side, such as 1440p, 4K or an ultrawide), a close-up of the area around your mouse also goes with it, unless you switch "Include a close-up around my mouse" off: it is cut from the same picture at full detail, so that small text can be read, and is sent to Anthropic and discarded in the same way. The reply may then carry marks showing where on that picture is meant; they are drawn on your screen for a few seconds and are not stored either.

Apps it never looks at (desktop app on Windows). While certain apps are in front, the desktop app takes no picture of any kind: no Comments look or Live comments glance, no talk key look and no screenshot with your message. The list it comes with covers password managers (such as 1Password, Bitwarden, KeePass, LastPass, Dashlane, NordPass, Proton Pass and RoboForm), browser windows whose title says they are private (InPrivate, Incognito, Private Browsing), banking, payment and tax sites and apps (such as Maybank, CIMB, Public Bank, RHB, Hong Leong, DuitNow, Touch 'n Go, LHDN and MyTax, PayPal, online banking, TurboTax and HMRC), and Windows Security and the Windows sign-in and permission prompts; a window the app cannot read counts as one of them. To tell, the app checks the name of the program in front and its window title twice a second. That check and the lists stay on your computer and are never sent anywhere; which app is in front stays there too. While it looks away, the "Watching" sign reads "Looked away". In Settings > Comments you can remove entries or add your own ("Pick a window" shows the windows open now, read the same way and shown only to you), keep an "Only look while I'm in" list instead, and set quiet hours, when the character takes no unprompted look. These settings stay on your computer. In a browser only quiet hours apply, and the browser keeps them. The same check also notes whether a fullscreen app covers a display, so the character can use less power then (Settings > Desktop app > Low power); that is not recorded or sent, and the Low power choice is kept in a file on your computer. With "Follow my work" switched on (Settings > Pinned window, or the tray; off until you turn it on), the app also notes which display the window in front is on, so the pinned character can move there; it reads nothing else about that window, sends nothing anywhere, and keeps only the choice and where the character stood on each display, in files on your computer.

Copied text. In the desktop app you can also let the talk key bring what you just copied: with "Send what I just copied" switched on (it stays off until you turn it on), text you copied shortly before you press the talk key - within 20 seconds, or the 10, 30 or 60 seconds you choose in Settings, with a small timer beside your pointer showing how long is left unless you hide it - goes with what you then say, as text, with or without the talk key's picture. Only while that option is on, the app checks once a second whether your clipboard has changed; for that it keeps only a fingerprint of what is on it (a short code that can't be turned back into the text) - on a Mac, only macOS's count of how many times anything was copied, without looking at what - and when it last changed: never the text, and none of it leaves your computer. The text itself is read only when you press the talk key, and only if you copied it within that time; whatever was already on the clipboard when you turned the option on is never sent. It is sent to Anthropic with your message so that the character can read it (at most 4000 characters - a longer copy is cut short), and discarded once the reply is written: the character's memory only notes that copied text was sent, but the reply is kept as written, so any part of the text the reply repeats stays in that reply (and goes through the reply's safety check like any other). Anything that looks like a password, a key or token, a card number or a Malaysian IC (MyKad) number is not sent - the app checks before it leaves your computer, and our server checks again - and your message shows "clipboard skipped" instead. The check can miss one (a password made of ordinary words, say), so copy something else first if a secret is on your clipboard. Pictures you copy are never sent.

Your own 3D models (desktop app). In the desktop app you can add 3D model files of your own (a VRM, an MMD model, or a GLB, glTF, FBX or Blender file, as a file, a folder or a zip) and give one to a character you make. The model is copied into the app's data folder on your computer - on Windows, in hikomi's install folder, at app\data\my-models (by default %LOCALAPPDATA%\Programs\Hikomi\app\data\my-models); on a Mac, at ~/Library/Application Support/hikomi/home/data/my-models - and nowhere else. The file is never sent to hikomi, to Anthropic or to anyone. A Blender file is turned into a model the app can show by the Blender already installed on your computer: the app starts it in the background, offline, on a copy of the file, with the file's own scripts and your Blender add-ons turned off, and deletes the copy when Blender is done. The model Blender made is kept with the Blender file in the model's folder, and neither is sent anywhere. When you add a model, the app also draws a small picture of it, to show on its tile; that picture is drawn on your computer and kept there beside the model. It is sent nowhere unless you tick "Keep a small picture of this model with my account" when you add the model, or turn that on later under Your models: then the picture is kept with your account as the picture of each character that wears the model, shown on the character's card and on your devices that don't have the model, and deleted from your account when you turn it off, remove the model from your computer, delete those characters or delete your account. Only the picture, never the file. A character you make in the desktop app that wears a model keeps only the model's name, a short code made from the file (so that the app can tell which model it is), and which of hikomi's bodies - or just its picture - to show on another device; the model itself is not part of the character. Those three things are kept with the character on our servers, like the rest of it. Beside each model the app also keeps, in the same folder, a short report of what it found in the file, the model's own terms as written in its file (and, if a readme came with it, in that readme) and the times you confirmed that you may use it (and, for a GLB, glTF or FBX you chose to export, the time you confirmed that you made it or have the right to change it and convert it); like the model, they stay on your computer and are never sent anywhere. Models are not part of "Download my data", and deleting your account or uninstalling the app doesn't remove them: they are on your computer, not with us. Remove one with "Remove from this computer" under Your models in "Beyond chat", or by deleting its folder.

The files you export. A VRM file of a character you made, or of a model you brought, is made on your computer and saved where you choose; we never receive it (see "Exports of characters you made and models you brought" above). The same goes for the zip of moves that can come with an export.

Voices. The audio of each reply is sent to you as it is made and not kept - except that very short, common phrases (like "Mhm." or "Yeah?") are kept and reused for everyone who talks to the same character, because they are stock phrases rather than anything about you. Previews of a shaped voice in the creator are two fixed sentences, the same for everyone, so they are kept and reused for anyone who picks the same voice and settings; they hold nothing about you. The voices you make from a personality are the exception: what is kept of them is described under "Voices you make from a personality" above. A preview of a voice you made is kept the same way as the others, until the room for previews is needed, and is only ever played back to you.

Your card details, which only Stripe sees.

What runs where

In a browser: Everything runs on our servers - the replies, the voices, and turning your speech into text.
In the desktop app: The character's body, expressions and speech recognition run on your computer. The first time you open each character, the app downloads its 3D model from gethikomi.com and keeps it on your computer, and the same goes for each hairstyle and outfit the first time the app shows it (nothing about you or your account is sent with these downloads; uninstalling removes them). A 3D model of your own, if you add one, stays on your computer too and is never sent anywhere (only a small picture of it, if you chose that); uninstalling doesn't remove it (see "Your own 3D models (desktop app)" above). Replies come from our servers. Voices are made on our servers.
On a Mac: The same, with two differences. macOS asks your permission before the app may use the microphone, record your screen (for sharing it, Comments and the talk key's look) or notice the talk key while you're in another app (Input Monitoring); you can change any of these in System Settings > Privacy & Security, and the app uses each only for the feature it's for. And a Mac app has no uninstaller: the app keeps the downloads above, its settings and its local data in your user folder (~/Library/Application Support/hikomi, with its logs in ~/Library/Logs/hikomi and updates being downloaded in ~/Library/Caches/hikomi). Moving the app to the Bin leaves these folders; deleting them removes everything it kept.
Our servers: Microsoft Azure, in Malaysia (Malaysia West). Your account, conversations and everything else listed above are stored there.

Who else receives your data

Anthropic (United States) receives your messages, the character's instructions and personality, a short note on how you said you use that character (for the style of the reply), today's date and the time of day where you are and how long since you last talked, the summary of long conversations, the notes about you and follow-ups described under "What the character knows about you" (and the conversation they are made from), your card and how close you chose to be, the search words and pages of web lookups (see "Web lookups"), and any screenshot that goes with your message (a screen you share, or the talk key's look, with where your mouse was on it and the close-up around it), and text you copied when "Send what I just copied" is on, so that Claude can write the reply - and, with Live comments on, the quick glances described under Screenshots. Reports you send may be passed to Claude to group them by what went wrong. Under its commercial terms, Anthropic may not use this to train its models.
TypeSafe, whose AI model (Jev) runs the checks described above, receives each message you send, with the last few messages of the conversation before it, whether you are sharing your screen and whether Comments is on (never the screenshot itself). It also receives the character's replies (to check them against the Safety page's promises), its unprompted remarks about your screen and its last few ones (to catch repeats and private details), a few older exchanges from your conversation when a message refers back to one (to find the one you mean), the sentences it says aloud and its stage directions (to pick gestures, and how strongly its face shows its mood), the name and personality of a character you make when you save it, or when you press "Fit the voice to the personality" or "Make a new voice from the personality" (to pick or describe its voice - we don't keep them then), and what you type into the creator's "Describe the look" box (to pick the hairstyle, outfit, accessories and colours - we don't keep it). Never screenshots, text you copied (though a reply that quotes it is checked like any reply), your voice or your account details.
Microsoft (Azure) hosts our servers, our database and the machine that makes the voices (where the open-source models that make a new voice from a personality and clean up its recording also run, on our own servers: nothing is sent to their makers or to anyone else). Azure also delivers our emails: the sign-up and password codes (your email address and the code), and our own alert emails, which contain counts, not your data.
Google provides sign-in if you choose it. When you use Google's button, Google sees that you signed in to hikomi. If you sign up with an email, Google isn't involved.
Namecheap (United States) hosts our email. Messages you send to support@gethikomi.com, and our replies, are stored in its mailbox service.
Stripe handles payments and plan changes on its own pages, and receives what it needs to take the payment.
GitHub (United States) hosts the desktop app's installers (for Windows and Mac) and its speech-recognition model. Downloading or updating the app, and its first start (when it fetches that model, about 145 MB), fetch them from GitHub, which sees your IP address as any website does; nothing about your account is sent.

That is the whole list. We don't sell or rent personal data, we don't share it for advertising, and we don't use advertising or analytics trackers. We would disclose data only if the law required it, and only what it required.

Anthropic and TypeSafe process messages outside Malaysia. We send them there only so that the characters can reply and so that the safety and age checks can run, under those companies' terms. The same goes for web lookups, which Anthropic runs with its search provider, also outside Malaysia.

How long we keep it

Account, conversations, characters you make, credit history: as long as your account exists. Deleted when you delete it (or, for one character's memory, when you erase it).
Usage counts: 400 days. When you delete your account they are unlinked from you, and stay only as anonymous totals.
Payment records: as long as the law requires for our accounts. When you delete your account they are unlinked from your email and name.
Reports you send: up to 180 days, and deleted with your account.
Messages kept for an age check: up to 180 days, and deleted with your account.
A made character's name and personality kept for a rules check: up to 180 days, and deleted with the character or your account.
A round of new voices made from a personality (the three voices, what they say, and the round's record): 1 day. A voice you kept: until the character it was saved with is deleted, or your account is; a voice no character uses (never saved with one, or left when its character switched to another voice), 1 week after that. At most 20 kept voices.
The working copy of a kept voice's recording on the machine that makes our voices: deleted with the voice - at once from a machine that is running, and from one that is off at its first voice request after it starts.
Messages to us: one year. Messages through the contact form are also deleted with your account.
Sign-up and password codes: 15 minutes at most, and gone once used.
Where you came from: in your browser, up to 30 days (or until you clear its site data); on your account, as long as the account exists, and deleted with it.
Records of exports (when, which character - or that it was a model you brought, with nothing about the model - how it ended and when): as long as your account exists, and deleted with it - except one that was given back, which is deleted a month after.
Your own 3D models: we don't keep them. A model stays on your computer until you remove it (uninstalling the app doesn't). A picture of one that you chose to keep with your account: until you turn that off, remove the model, or delete the character or your account.
Server logs: 30 days.

Your choices and rights

You can, at any time:

download a copy of everything we keep about your account - account menu, "Download my data";
erase a character's memory of you - "History", then "Clear";
see, forget, correct or add to what a character knows about you, change your card, or choose how close you are - "History", then "About you";
remove an entry from your journal - "History", then "Journal";
remove a 3D model you added - in the desktop app, "Beyond chat", then "Your models", then "Remove from this computer" (or delete its folder) - or turn off the picture of a model kept with your account, in the same window;
delete a character you made, and the voice kept for it - in the creator, "Delete";
delete your account and everything in it - account menu, "Delete account and data";
ask us anything about your data, ask us to correct it, or object to how we use it - by email or through the contact form.

If you use Google, your name, email and picture come from your Google account and update when you next sign in; if you signed up with an email, you can reset your password from the log-in window ("Forgot password?") and ask us to change anything else through the contact form. We answer privacy requests within 21 days. If you're not happy with our answer, you can complain to the Personal Data Protection Department of Malaysia (Jabatan Perlindungan Data Peribadi), or to the data protection authority where you live.

Cookies and browser storage

The cookie that matters is the one that keeps you signed in (for up to 30 days, or until you sign out). You sign in on gethikomi.com; when you then use hikomi.ai, your browser passes by gethikomi.com for a moment so that hikomi.ai gets the same sign-in - it is one sign-in, so signing out on either ends it on both. For that, hikomi.ai also sets two small cookies with nothing about you in them: a random value for a few minutes while your browser passes by (so a sign-in can't be handed to someone else's browser), and a note that this browser has been signed in there, so it can check again if it finds itself signed out. Your light or dark mode choice is carried in the link when you go from one address to the other, and while you're signed in it is also kept with your account, so both addresses and all your devices show the same one. The browser also keeps the black boxes you draw with "Hide parts...", with the name of the screen, the window title or the number the system gives a display they belong to (at most 8 boxes for each of 24 screens, windows or displays, the oldest dropped first); what is under them never leaves your computer, only where they are goes with a picture (see Screenshots), and they don't appear on your other devices. The browser also stores a few of your settings - volume, which speaker to use, notices you've dismissed, and when you last used the app and last saw the notice that you're talking with an AI (so that it comes back on time) - on your device, never on our servers. So are any pictures you add as backgrounds: they are kept by the browser or the desktop app on that device only, never sent to us or to Anthropic, and they don't appear on your other devices. Removing one under Background (in "Beyond chat"), or clearing the browser's site data, deletes it. 3D models of your own are not kept this way: they are files on your computer (see "Your own 3D models (desktop app)" above). The browser also keeps what you told the app you use each character for; unlike those settings, that choice also goes with each message and is counted (see "Usage counts" above). If you start a round of new voices in the creator, the browser also keeps the round's number - a random code with nothing about you in it - so that the creator can show its voices again if you come back within a day; it is dropped when you keep a voice or the round fails, and it is only sent to us to ask about that round. If you arrived through a tagged link or from another website, the browser also keeps one short label saying so, for up to 30 days (see "Where you came from" above); unlike the settings, that one is sent to us - only when you make an account. There are no analytics or advertising cookies. Google's sign-in button and Stripe's checkout pages may set their own cookies, under their own policies. In the desktop app on Windows, if you turn on "Start with Windows" (Settings > Desktop app), one entry is added to Windows' own Startup list on your computer; you can see and remove it in Windows (Settings > Apps > Startup), and it is removed when you turn the setting off or uninstall the app. The desktop app also keeps, in files on your computer and never sent to us, whether closing the window keeps hikomi in the tray, the window's size and place, and whether the character was pinned to your screen when you last used the app (so it is pinned again at the next start).

Children

hikomi is for people 16 and over, and 18 and over in the United States and anywhere else whose law restricts AI companions for minors. If someone tells the app they are under 16, their account is deleted straight away. The age check described above keeps a message for a person to review when it suggests someone is younger than the age they gave. If you believe a child is using hikomi, please tell us through the contact form and we will act on it.

Security

Connections to hikomi are encrypted, our servers' disks are encrypted, access to the servers and database is limited to the developer, and card payments never touch our systems. No system is perfectly secure; if a breach ever put your data at risk, we would tell you and the authorities as the law requires.

Changes to this policy

If we change this policy in a way that matters, we tell you on the website or in the app before the change applies. The date at the top shows when it last changed.