Privacy Policy
Facelet gives your ChatGPT a face. This policy explains what we collect through the website and the app, why we collect it, and what we never touch. It is written to be read.
The app-specific details below describe the released Mac app. A native Windows version is being prepared; its platform-specific data handling will be documented before public downloads open. See Windows availability.
The short version
- We collect your email address and your billing record so we can deliver and support your subscription.
- When you ask for a trial, and while the app is open, we note your IP address and the approximate place it points to, and the app tells us what kind of Mac it runs on and how long you use it and each character.
- Your conversations happen between you and ChatGPT under your own OpenAI account or, in Cloud conversations, between your Mac and Anthropic or OpenAI under your own API key. They do not pass through Facelet’s servers, and Facelet never reads your chat history or stores your ChatGPT password.
- The app animates the face on your Mac. Audio is processed locally to move the face. It is not uploaded to us.
- We do not sell personal data, and the website uses no advertising or analytics trackers.
Who we are
Facelet (“Facelet”, “we”, “us”) operates facelet.app and makes the Facelet app for Mac. You can reach us through the contact page.
What we collect, and why
When you subscribe
Your email address, the plan and price you chose, your Stripe customer and subscription IDs, billing dates and status, payment references, and the hosted invoice link when a payment needs attention. Payments are handled by Stripe; we never see or store your card number. Stripe’s own privacy policy applies to payments and to updating your card, viewing invoices or canceling through the billing page your account opens.
We email you about your subscription: its start, payment problems, scheduled cancellation and ending. If a payment arrives after a subscription has ended, we keep a billing review record so support can resolve it.
When you sign in
We send a single-use link to your email. Following it creates a session, stored in a single essential cookie on your browser for up to 30 days. There is no password to store.
When you confirm your age
Facelet is for adults 18 and older. When you ask for a trial or a sign-in link and tick “I’m 18 or older”, on this website or in the app, we record the time of your first confirmation with your account record.
When you activate the app
The app sends us your email and an identifier and name for your Mac so we can issue your license and record the activation. The license itself is stored on your Mac.
When you ask for a free trial
Your email address, the time you asked, the kind of device you asked from (such as Mac, iPhone or Android, read from your browser, or the Mac app), the IP address you asked from and the approximate place that Amazon CloudFront, which carries our website, estimates from it (city, region, country and time zone), and what came of it (a trial link, a sign-in link because you already had a subscription or seat, or a note that your trial had ended). Signing in from the app with an email without a license or an earlier trial counts as asking for one, and is recorded the same way. We keep that record for a year so we can see how many people try Facelet and where from, then it is deleted. Starting the trial creates the same activation record as a subscription.
While the app is open
Once when it opens and then every ten minutes, the app tells us that it is open, under your license: the Mac identifier from activation, the app version, whether the license is a free trial, which characters you have downloaded (each by its id, such as nora, not its name), and your Mac’s model, chip, memory, number of graphics cores and macOS version. From newer versions it also sends how long each character was on screen and how long you were in a conversation with it since the last check-in, and how long in each conversation mode (Cloud or ChatGPT): numbers of seconds, never what was said. With each one we keep the IP address it came from and the approximate place Amazon CloudFront estimates from it (city, region, country and time zone). That is all, and it is how we know how many people use Facelet, on which Macs and where, and which characters they download and use. It never includes anything about your conversation. From these check-ins we keep a daily total for each Mac: how long the app was open, how many times it was opened, each character’s time on screen and in conversation, and the time in each conversation mode. You can turn it off in the app’s account menu (“Share App Usage”). Each Mac’s latest check-in is deleted after 30 days, and the daily totals are kept for a year.
When the app downloads a character
Ari comes with the app. Every other character is downloaded from inside it, one file at a time, under your license, so we can check that your license is active before we send it. That request is made whatever “Share App Usage” is set to, because the download cannot happen without it, so facelet.app sees which characters each license downloads. The line we log for it holds the first part of the download’s id, the file name and your Mac’s identifier, not your email address. The general server logs below still record the request itself.
When the app unlocks a character
Every character, Ari included, is locked with its own key, and the app asks us for the keys under your license. First it registers your Mac, once per license and again after you sign in: it sends your license, your Mac’s identifier and a public key made by your Mac’s Secure Enclave, and on macOS 27 or later Apple’s App Attest confirmation that the request comes from a genuine copy of Facelet with the Mac’s security protections on. We keep that registration (the license, the Mac identifier, the public key, whether Apple confirmed it, whether this Mac has ever been confirmed, and Apple’s key for this copy of the app with a running count of its uses) with the license record, and replace it when your Mac registers again. Before each registration or key request the app asks for a single-use challenge; that record holds the license key and the Mac identifier, is deleted when it is used or expires after five minutes, and is removed from our table within a few days. Each time the app then asks for the keys, we record the license, the Mac identifier, the platform, our answer and the time, and keep that record for 90 days, so we can see a license unlocking characters on more Macs than it should. The keys are sent locked to your Mac’s Secure Enclave and are kept in the app’s protected storage on your Mac. The registration and the records hold no email address and nothing about your conversations.
When you send feedback from the app
Your message, the kind you chose (bug, idea, feature or general), your email so we can reply, and, only if you leave the box ticked, the app’s own details: its version, your macOS version, the chip, and the rendering level it settled on. Never your conversation.
When Facelet crashes
If Facelet or its character renderer stops unexpectedly, the app asks, the next time it runs, whether to send us the crash report so we can fix the problem, and you can let it send future reports automatically. Nothing is sent unless you agree, and “Send Crash Reports Automatically” in the app’s account menu turns automatic sending off again. A report is the technical record your Mac or the renderer wrote when it stopped: the app version, your Mac’s model, macOS version, chip and graphics details, how much memory it has, and what the app’s code was doing at that moment. The app adds which characters you have downloaded, each by its id and the short id of its download (such as nora:0123456789ab), because an out-of-date or damaged character download is one of the first things we check. Before sending, the app replaces your home folder (which carries your Mac account name) and your full name with placeholders, and removes the device and account identifiers that macOS and Unreal Engine write into their reports. It is sent under your license when you are signed in, otherwise with the same Mac identifier used for activation. It never includes your conversation. We keep crash reports for a year.
When Facelet shows crisis resources
From Facelet 0.118.0, the app shows crisis resources when ChatGPT’s reply names a crisis line such as 988 (see Safety and crisis resources), and counts how often it does, as one number per day for each kind of check, without what was said or who said it, because California’s companion chatbot law requires us to report each year how many times we showed crisis resources. About once an hour, and when you quit, the app sends its count to us, even when “Share App Usage” is off. It sends the count under your license so we can refuse made-up counts. We add it to that day’s total and keep nothing else with it: no words, no character, no license, email address, Mac identifier or time of day. The limit on how often one license can send a count is kept only in our server’s memory for the current hour and is never stored.
When you email us
We keep the correspondence so we can help you. Inbound mail is stored for 90 days by our mail forwarder and then deleted.
Server logs
Like every website, our servers record requests, including IP addresses, for security and to fix problems. Logs are kept for a limited time and are not used to profile you. Apart from the trial request and app-open records above, IP addresses are kept only in these logs.
What the app does with your conversation
Facelet connects to ChatGPT through your own OpenAI account, using the subscription you already pay for. Your voice and ChatGPT’s replies travel between your Mac and OpenAI under OpenAI’s privacy policy and terms. Facelet does not proxy, record, or store those conversations, does not read your ChatGPT chat history or memories, and does not store your ChatGPT credentials. Audio is analysed on your Mac to move the character’s face. From Facelet 0.118.0, Facelet checks ChatGPT’s replies on your Mac for the name of a crisis line, such as 988, and shows crisis resources when one appears (see Safety and crisis resources); the replies are not saved or sent to us.
In Cloud conversations
From Facelet 0.119.0 you can instead talk with your character through Claude or GPT on your own Anthropic or OpenAI API key. Your speech is recognized on your Mac and never leaves it. The words you say, the conversation so far and the character’s instructions go as text from your Mac to Anthropic or OpenAI, under your API key and that provider’s privacy policy and terms (Anthropic, OpenAI), and the reply is spoken by a voice made on your Mac. When the model searches the web for an answer, the provider runs the search. Your API key is kept in Facelet’s protected storage on your Mac and is never sent to us. Facelet does not proxy, record, or store these conversations either. Before anything you say goes to the model, Facelet checks it on your Mac for signs of crisis (see Safety and crisis resources).
Who else sees your data
We use a small number of service providers to run Facelet, each only for the purpose named: Stripe for payments and billing, Resend for sending email, Amazon Web Services for hosting, storage, and receiving email, and Cloudflare for storing and delivering app and character downloads. They process data on our behalf under their own security commitments. We do not sell personal data and we do not share it with advertisers. We will disclose data if the law requires it or to protect someone from harm.
Cookies
The website sets one cookie, the sign-in session, and only after you sign in. It is essential, it is not used for tracking, and it expires after 30 days or when you sign out. There are no analytics or advertising cookies.
How long we keep things
Account and billing records for as long as you have a subscription or seat, and afterwards as long as tax and accounting law requires. Ordinary sign-in links expire within 15 minutes, activation links within 30 minutes, and sessions within 30 days. Links in billing emails and free trial links last up to seven days and work once. Trial requests and crash reports for a year, app-open records for 30 days and daily usage totals for a year, character key requests for 90 days, Mac registrations with the license record (replaced when the Mac registers again), feedback until you ask us to delete it. Inbound email for 90 days.
The time you first confirmed you are 18 or older stays with your account record. The daily crisis-resource counts identify no one, and we keep them for the yearly reports the law requires.
Server logs are kept for up to 90 days. Recovery backups of the account database can retain deleted records for up to 35 days; we use those backups only to recover from a service failure.
Your choices and rights
You can ask us to show you the personal data we hold about you, correct it, or delete it, subject to records we must keep by law. Write to us through the contact page using the address on your account and we will respond within 30 days. If you are in the European Economic Area, the United Kingdom, or California, you have additional rights under local law, including the right to complain to your data protection authority; we honour them.
Security
Sign-in and activation links are single use and stored only as hashes. Data is encrypted in transit and at rest. Licenses are signed so they cannot be forged. No system is perfectly secure; if we learn of a breach affecting you, we will tell you.
Children
Facelet is for adults 18 and older. AI companions may not be suitable for some minors. We do not knowingly collect personal information from children under 13. If we learn that an account belongs to someone under 18, we close it; if the person is under 13, we also delete their account data, keeping only counts that identify no one; copies in our backups and server logs expire within 35 and 90 days, and payment records that tax law requires us or Stripe to keep remain. If you believe a child is using Facelet, tell us through the contact page. ChatGPT has its own age requirements.
Changes
If we change this policy in a way that matters, we will post the new version here with a new date and, for significant changes, email account holders.
Contact
Write to us through the contact page. We reply by email.