1. Scope
This policy applies to the ConTavern iOS app and its Conven first-party account, hosted AI, points, purchase verification, feedback, and device connection services. Apple, the hosted AI upstream provider, email delivery providers, and custom AI endpoints operate independently under their own terms and privacy policies.
2. Data stored on your device
Your worlds, characters, stories, memories, resources, app settings, and imported images are stored locally. Creating or editing them does not automatically upload them to Conven servers.
AI service API keys are stored in Apple Keychain. Endpoint addresses, models, and generation settings remain in local app settings. Conven does not receive or store your API keys through its first-party servers.
3. Data sent when using AI services
Only when you start a generation request does the app send the inputs, prompts, character and world details, story context, memories, model settings, and other data needed for that request. Requests using your own AI configuration go directly to your selected provider or custom endpoint. Requests using Conven hosted AI are relayed through Conven servers to our configured upstream AI provider.
Conven and the applicable AI provider may process network information such as IP address and request time. Conven does not write hosted AI prompts or generated text to its primary database. To support reliable retries, the upstream response may be temporarily cached in Redis, normally for no more than 24 hours, before automatic expiry. Usage metadata described below is retained separately. Review the applicable provider’s privacy policy and avoid submitting sensitive information you do not want processed.
4. Data handled by Conven first-party services
Account registration and sign-in
When you register or sign in, we process your email address, one-way password hash, verification status, account identifier, sign-in time, session information, and security data such as IP-based rate-limit records. Verification codes are short-lived and an email delivery provider may process your address and verification message. Your plaintext password is not stored.
Hosted AI and points
We maintain your point balance, registration reward, point changes, AI usage totals, token counts, request status, timestamps, and related identifiers so we can provide hosted AI, calculate charges, prevent duplicate settlement, show account history, and investigate abuse. Hosted AI prompt and response text is not written to our primary database.
Apple in-app purchases
To verify and credit point purchases, we process Apple-provided product and transaction identifiers, an app account token, purchase environment, quantity, price, currency, storefront, purchase and signing times, verification status, and cryptographic payload hashes. We do not receive your full payment-card details.
Feedback and support
Only when you submit feedback does the app send the feedback type, email address, message, and any optional contact details to conven.cn. We use this information to handle and reply to your request and let you look up its status with the submitted email address.
Device connection
While the app is active, it sends an in-app device identifier to conven.cn over an encrypted WebSocket connection and maintains a heartbeat. The server processes that identifier, IP address, online status, first and latest connection times, connection count, and online duration to maintain the connection, diagnose service issues, protect security, and produce aggregate operational statistics.
The device identifier is based on the device vendor identifier. If unavailable, the app generates a random identifier and stores it locally. It is not used for advertising or to identify activity in other companies’ apps or websites.
5. How data is used and shared
We use first-party service data only to create and secure accounts, provide hosted AI, manage point balances, verify purchases, show transaction history, handle feedback, maintain device connections, compile operational statistics, troubleshoot, and prevent abuse.
- We do not sell or rent your personal information.
- We do not include third-party advertising SDKs or use data for cross-app or cross-site tracking.
- Custom AI requests go to the provider or endpoint you choose; hosted AI requests go through Conven to the configured upstream AI provider.
- Apple, AI and email delivery providers, infrastructure providers, or authorities may process data only as needed to provide the relevant service, meet legal obligations, or protect users and service security.
6. Retention and deletion
Local content remains until you delete the corresponding content or settings in the app. Verification codes and temporary hosted AI response caches expire automatically. While an account is active, its identity, wallet, AI usage metadata, and purchase associations are retained to provide the service and prevent fraud or duplicate crediting. Separately submitted feedback, device connection, and security records are retained only as long as needed to resolve requests, maintain security, or meet applicable requirements, then deleted or de-identified where appropriate.
You can delete worlds, stories, resources, images, AI configurations, and API keys in the app. You can also request account deletion from Account Settings after re-entering your current password. Account access is revoked immediately; a scheduled task physically deletes the account and its associated wallet, transaction, purchase, product-login, and hosted-AI usage data beginning the next day and within three days, then sends a result notice to the account email. Use Feedback for access or correction requests, or for deletion of separately submitted service records.
7. Data security
We use reasonable safeguards such as HTTPS/WSS transport, one-way password hashing, short-lived verification codes, server-side sessions, rate limits, the system keychain, and access controls. No storage or network transmission method is completely secure, so protect your password and API keys and configure only endpoints you trust.
8. Policy updates and contact
We may update this policy when product features, data practices, or legal requirements change and will revise the Last updated date on this page. Material changes will be highlighted appropriately.
For questions about this policy or data handling, use Feedback in the ConTavern app or visit the Conven website.