Get the app
Legal

Privacy policy

We believe privacy is a right, not a feature. This policy explains exactly what data we collect, why we collect it, and how we protect it — in plain English, with no dark patterns.

Last updated: May 26, 2026 · Version 2.1

Summary

Gochu is an AI companion app. To provide the service we need to store your account information, your conversations, and some technical metadata. We do not sell your data. We do not show you ads based on your personal information. We use a small number of trusted third-party services to operate the platform (see Sharing).

The short version

We collect what we need to run the service. We protect it carefully. We don't sell it. You can delete everything at any time.

Who we are

Gochu is operated by Sky Labs LLC, a company registered in the United States. References to “Gochu”, “we”, “us” or “our” in this policy all refer to Sky Labs LLC.

You can reach us at [email protected] or through the support page.

What we collect

Account information

When you create an account we collect:

  • Email address
  • Username (chosen by you)
  • Date of birth (for age verification — we do not store exact dates after verification)
  • Password hash (we never store plaintext passwords)

Usage data

As you use the app we collect:

  • Conversation content (your messages and AI replies)
  • Session metadata (timestamps, session duration)
  • Feature usage events (which screens you visit, which actions you take)
  • Device type and operating system (not device identifiers)
  • IP address (used for fraud prevention, not for tracking across sessions)

Payment information

Payments are processed by our payment provider (Stripe). We do not store full card numbers or banking details. We receive a tokenised record of the transaction, the plan purchased, and the billing email.

Optional profile data

You may optionally provide a profile photo. This is stored on our servers and displayed within the app.

Technical data

Our servers automatically log standard HTTP request data including IP address, User-Agent, and timestamps. These logs are retained for 30 days for security and debugging purposes.

Why we use your data

We use your data for the following purposes:

  • Providing the service — your conversations are stored so the AI can maintain memory across sessions.
  • Account security — to detect and prevent fraud, abuse, and unauthorised access.
  • Billing — to process payments and manage subscriptions.
  • Safety — to enforce our content policies and respond to reports.
  • Product improvement — anonymised, aggregated usage analytics help us understand which features to build.
  • Legal compliance — we retain certain records as required by applicable law.

We rely on the following legal bases under GDPR: contract performance (running the service), legitimate interests (security, fraud prevention, product improvement), and legal obligation (compliance). For users in the EU/EEA, we will request explicit consent where required.

Sharing your data

We do not sell, rent, or trade your personal data. We share it only in the following limited circumstances:

  • Service providers — we use Stripe (payments), AWS (infrastructure), and a small number of other processors, all bound by data processing agreements.
  • AI model providers — your messages may be processed by third-party AI model APIs to generate responses. We have data processing agreements in place. These providers are contractually prohibited from using your data to train their models without your consent.
  • Legal requirements — if required by a court order or applicable law, we may disclose data to the relevant authority.
  • Business transfers — in the event of a merger or acquisition, data may transfer to the acquiring entity. We will notify you in advance.

Data retention

We keep your account data and conversations for as long as your account is active. When you delete your account, your profile and conversations are permanently deleted within 30 days. Backups are rotated within 90 days.

Transaction records may be retained for up to 7 years as required by financial regulations. Technical logs are retained for 30 days.

Your rights

Depending on where you live, you may have the following rights:

  • Access — request a copy of the data we hold about you.
  • Correction — ask us to correct inaccurate data.
  • Deletion — ask us to delete your account and associated data.
  • Portability — receive your data in a machine-readable format.
  • Restriction — ask us to limit processing in certain circumstances.
  • Objection — object to processing based on legitimate interests.
  • Opt-out of sale — California residents have the right to opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, email [email protected] with the subject line “Privacy Request”. We will respond within 30 days. To delete your account you can also use the account deletion form.

Security

We take security seriously. Our measures include:

  • All data in transit is encrypted with TLS 1.2 or higher.
  • Data at rest is encrypted using AES-256.
  • Passwords are stored using bcrypt with a high cost factor.
  • Access to production systems is restricted to authorised personnel only, using multi-factor authentication.
  • We conduct regular security reviews of our codebase and infrastructure.

No system is perfectly secure. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

Children

Gochu is not directed at children under 18. We do not knowingly collect data from anyone under 18. If we become aware that we have done so, we will delete the data immediately. If you believe a child has created an account, please contact us at [email protected].

International transfers

Gochu is operated from the United States. If you access the service from the EU/EEA, your data may be transferred to and processed in the US. We use Standard Contractual Clauses approved by the European Commission to ensure adequate protection for such transfers.

Changes to this policy

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, for material changes, we will notify you by email or in-app notice. Continued use of the service after the effective date constitutes acceptance of the updated policy.

Contact

For any privacy-related questions or to exercise your rights, contact us at:

If you are in the EU/EEA and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local data protection authority.