Davia — Privacy Policy

Effective date: 16 October 2026 · Version: 1.3

This Privacy Policy explains how Davia Labs, Inc. ("Davia," "we," "us," or "our") collects, uses, discloses, and retains personal information when you use the Davia game on the web, iOS, or Android, its creator tools, connected integrations, and related services (the "Service").

Davia Labs, Inc. is a Delaware corporation with a registered office at c/o Resident Agents Inc., 8 The Green, Suite R, Dover, DE 19901, USA. For privacy questions or requests, email contact@davia.ai.

This Policy covers the Davia website and apps that link to it. Your account, game progress, and eligible purchases may be used across these platforms. A different Davia product that provides its own privacy notice remains subject to that notice.

---

1. Information we collect

The information we collect depends on whether you browse, use a guest session, connect an account, play, create, publish, remix, make a purchase, or contact us.

Account and profile information

We may collect:

• an internal user identifier;
• email address and authentication status;
• name, display name, and profile image supplied by you or your sign-in provider;
• authentication provider and related account metadata;
• whether an account is a guest or connected account; and
• interface language and other account preferences.

If you use Google or Apple sign-in, that provider supplies account information according to the sign-in flow. Apple may supply a private relay email address if you choose to hide your email. Email sign-in uses a verification code. Guest accounts receive an identifier but may not include an email address.

Your display name and profile image may be visible on a public profile page associated with your user identifier. Do not use a name or image that you do not want other people to see.

Gameplay, conversations, and memory

We collect the information needed to run and preserve your game, including:

• selected game, character, language, and in-game settings;
• actions, free-text instructions, selected or edited suggestions, drawings, and other inputs;
• conversations with characters and AI-generated responses;
• playthrough state, world events, locations within the fictional map, statistics, choices, timestamps, and progress;
• summaries, memories, recent exchanges, and other context used to maintain continuity; and
• technical traces, staged events, errors, and diagnostic information created while a turn or conversation is processed.

An in-game location or story time zone describes the fictional world. We do not ask for your device's precise physical location to play the game. Providers may still infer an approximate location from an IP address for security, routing, or legal-compliance purposes.

Creator, publication, and remix information

When you use creator features, we may collect:

• drafts, prompts, files, maps, map cells, world descriptions, rules, premises, characters, entities, points of interest, statistics, and related metadata;
• uploaded or generated images, audio, music, visual references, and other assets;
• publication state, version history, creator identifier, and timestamps; and
• remix lineage, including the source game, source version, source creator, remixer, and resulting copy.

Drafts are not public by default. Published games and their associated content may be displayed publicly, indexed by search engines, shared, played, and remixed as explained in the Terms of Use. A remix is an independent copy, so deleting or unpublishing a source does not automatically delete existing remixes.

Multiplayer and community activity

We collect room membership, invitations, selected characters, actions, votes, participation status, and shared game history to run multiplayer games. We also process comments, replies, reactions, and related notifications. Where players share a turn's cost, we record the paying participants, decisions to cover another player's share, and each participant's credit usage. Section 5 explains what other users can see.

Generated media and safety information

For AI and media features, we may collect or create:

• prompts, conversation context, world state, visual descriptions, and reference images;
• generated text, images, music, sound, and narrated speech;
• provider, model, request, and generation identifiers;
• generation timing, quality, and error information; and
• automated safety classifications, risk scores, moderation results, and provenance information.

Purchases, subscriptions, credits, rewards, and referrals

Purchases may be processed through Stripe, including Link for Stripe Managed Payments, or through Apple's App Store or Google Play. We use RevenueCat to verify and synchronize mobile purchases with your Davia account. Davia may receive and retain:

• customer, checkout, subscription, invoice, product, receipt, and transaction identifiers from the relevant payment provider or store;
• purchase amount, currency, product, credits granted, transaction status, and timestamps;
• credit balances, subscription allowances, usage, and credit-movement history;
• subscription status, renewal, cancellation, and purchase-restoration information;
• automatic-reload preferences, authorization records, and limited saved-payment details, such as card brand and last digits; and
• refund, dispute, chargeback, and fraud-prevention information.

Davia does not receive or store your full payment-card number from these purchase flows. RevenueCat receives your internal Davia account identifier and store purchase information so we can grant the right benefits and recognize restored purchases without granting spent credits again.

For gift cards, we keep purchase, ownership, transfer, and redemption records, including the accounts involved and credits granted. For creator rewards, we process game attribution and eligible usage to calculate and record the reward.

For rewards and referrals, we may collect referral codes, inviter and invitee identifiers, activation and claim history, eligibility information, and anti-abuse signals. When a connected user accepts a referral, we currently create a cryptographic hash derived from the request IP address and a secret to limit rapid repeated rewarded signups from the same network. Sharing a network does not by itself permanently prevent another person from receiving a referral bonus. We store the hash, not the raw address in the referral profile field, although raw IP addresses may also appear in ordinary provider or security logs.

When a connected user accepts a referral, FingerprintJS processes browser and device characteristics locally to generate a pseudonymous visitor identifier. We send that identifier to our server, transform it into a keyed cryptographic hash, and store only the hash in the referral anti-abuse table to detect a repeated rewarded signup from the same browser. We do not store the raw visitor identifier or the individual browser and device characteristics in that table.

Communications, support, and reports

We collect the content and metadata of messages you send us, including support requests, feedback, rights notices, content reports, appeals, and billing questions. This can include your contact information, the reported content, supporting evidence, and our response or decision.

An in-app bug report may include the description and screenshots you submit, account and game identifiers, page or screen, language, device information, and a session-replay link when available. Reports and some support replies are forwarded to our team's private Discord channels. We may use an AI provider to translate a report or reply for support. These reports are not public community posts. Avoid including passwords, payment details, or unnecessary personal information in descriptions and screenshots.

We may send lifecycle emails through Resend, including a one-time feedback request after a connected user's first playthrough and a message when daily credits become available after inactivity. For these workflows, we send Resend the recipient email address, selected template, continuation link when needed, and unsubscribe links. We retain an internal delivery record. To honor an unsubscribe request without duplicating the address, we retain a one-way hash of the normalized email address, an opaque unsubscribe token, and the suppression timestamp. Each lifecycle email includes a link to unsubscribe from future lifecycle emails.

We also send messages about creator and community activity, such as game plays, remixes, comments, replies, and reactions, and transactional messages such as automatic-reload confirmations. These messages can include the relevant public profile, game, comment, or transaction information.

Usage, device, analytics, and diagnostic information

We and our providers may automatically collect:

• IP address, request time, browser, device, operating system, language, referring page, and network information;
• authentication, cookie, local-storage, session, and similar identifiers;
• pages viewed, buttons used, games played or shared, feature events, purchase flow events, and related story or playthrough identifiers;
• authentication state, credit balance at the time of certain events, and account identifier; and
• errors, stack traces, performance traces, logs, and session-replay data.

When a user is signed in, PostHog and Sentry currently receive the user's internal identifier and email address. Our self-hosted OpenReplay instance on Google Cloud receives the internal identifier and, for connected accounts, the email address to identify session replays. Guest accounts are identified by their internal identifier. Replays may record text displayed on screen, images and other media, and canvas or map activity. Input values are masked by default. This can include gameplay, conversation, and creator content visible during the recorded session. See Section 7 for choices and important limitations.

The mobile apps also use native diagnostic tools, including Sentry and Expo Observe, for errors, performance, navigation, and device/app information. Expo Observe telemetry is sent to our Google Cloud collection service.

Microphone and photo access

Voice dictation uses your microphone after you grant the relevant browser or device permission. Uploading a profile image or other supported image uses the files you select through the device picker or photo-access permission. You can manage these permissions in your browser or device settings; refusing access can prevent the corresponding feature from working. Permission to use a device feature is separate from the privacy choices described in this Policy.

2. Where information comes from

We obtain personal information:

• from you, when you sign in, play, create, upload, purchase, publish, report, or contact us;
• automatically, from your browser, device, use of the Service, cookies, logs, analytics, and security systems;
• from service providers and stores, such as Apple, Google, Supabase, Stripe/Link, RevenueCat, AI providers, and communications providers;
• from other users, for example when someone refers you, remixes a game, reports content, or submits information involving you; and
• from public or licensed sources, when creator content, maps, assets, or reports include public information.

3. Why we use information and our legal bases

We use personal information for the following purposes. Where European or UK data-protection law applies, the table also describes the legal bases on which we rely.

When we rely on legitimate interests, we consider the purpose, necessity, and effects of the processing. You may object as described in Section 10.

We do not use personal information for advertising based on activity across unrelated websites or services.

Some information is necessary to provide a feature. For example, an account identifier and gameplay input are needed to preserve a playthrough, an email is needed for a connected email account, and the payment provider or store must process purchase information if you buy something. If you do not provide required information, the relevant feature may be unavailable. Publishing, adding optional profile details, accepting a referral, and sending non-essential feedback are optional.

4. AI processing and model improvement

The Service sends inputs and relevant context to AI and media providers to generate text, images, music, sound, narrated speech, transcriptions, suggestions, safety classifications, and other requested features, or to translate support messages. Depending on the feature, that context can include conversation history, actions, world state, character descriptions, public or private creator content, prompts, and reference images.

Davia does not currently use private conversations or creator content to train a general-purpose Davia AI model. We may still process that information to provide the requested output, maintain game memory, evaluate quality and safety, debug failures, prevent abuse, and improve the Service's prompts, workflows, and product behavior.

AI providers may retain inputs and outputs for limited periods or process them for security, abuse prevention, service operation, or other purposes permitted by the applicable provider terms, configurations, and contracts. These practices can vary by provider and feature. Do not submit highly sensitive personal information that is not needed for the experience.

5. When we disclose information

We do not sell or rent personal information for money. We disclose information in the following circumstances.

Service providers

Provider selection can vary by feature, availability, and fallback path. Current provider categories include:

These providers process information under their agreements with us and their applicable policies. Some providers act as independent controllers for parts of their service, such as Apple, Google, or Stripe/Link when you interact directly with their stores, checkout, or sign-in interfaces. Their own privacy notices also apply to those activities.

When you use voice dictation, your browser or app requests microphone permission. After you stop recording, we send the audio to OpenRouter and its transcription provider to turn it into an editable draft. The app may use a temporary local audio file during recording and processing; Davia does not retain the microphone recording as part of your saved game history. Provider processing and retention are governed by their applicable policies. The resulting text is saved as gameplay content only when you submit it. You can cancel a recording before it is sent; cancelling an in-flight transcription does not recall audio already sent to the provider or reverse its usage charge.

Narration is different from dictation: we send game text to speech providers and store the resulting audio for playback. Narration files are private and access is checked against participation in the relevant game.

Other players and connected assistants

In multiplayer, participants can see the shared world, journal, and information made available to the room, including player profiles and participation status. Private character conversations are not made public simply because you join a room. Comments and reactions are visible in the relevant community feature. A gift recipient can see who sent the gift. Other players may retain shared game history after you leave; Section 9 explains retention.

If you authorize an external assistant or application to connect to Davia, including through our MCP integration, it can access or edit the drafts and content covered by that authorization. The assistant provider receives the information returned to it and handles it under its own terms and privacy policy. Only connect services you trust; disconnecting later does not recall data already received by that provider.

Public disclosures

Information you publish is disclosed to the public. This may include a profile name and image, games, worlds, characters, maps, assets, creator attribution, version history, and remix lineage. Public content can be copied or indexed by other people and search engines outside our control.

Private playthroughs and drafts are not publicly displayed by default. They are still disclosed to the providers needed to operate, secure, and support the Service.

Legal, safety, and business disclosures

We may disclose information:

• to comply with law, court orders, or valid governmental requests;
• to protect a person's safety or the rights and security of users, Davia, or others;
• to investigate fraud, abuse, security incidents, or violations;
• to establish, exercise, or defend legal claims;
• with professional advisers, auditors, insurers, and corporate service providers under appropriate duties; or
• as part of a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law.

If you submit a copyright notice or counter-notice, we may share it, including contact information, with the person who published the reported content or the original claimant as described in our Copyright, Trademark & Intellectual Property Policy.

6. Public content, deletion, and remixes

You decide whether to publish a creator game. Once published, the content is public and other authenticated users may create independent remixes under the Terms of Use.

If you delete or unpublish a source game:

• the source may become unavailable after a reasonable propagation period;
• search engines, caches, recipients, or backups may retain copies for a time;
• remixes already created do not automatically disappear; and
• we may preserve limited source, version, creator, remix-lineage, moderation, and rights-enforcement records.

A legal or safety report may lead us to review and restrict a source, related remixes, or both, depending on what each version contains.

7. Cookies, analytics, and session replay

The Service uses cookies, local storage, mobile SDKs, and similar technologies for:

• authentication and session security;
• language and interface preferences;
• fraud prevention and referral handling;
• remembering purchase-flow context;
• analytics and product measurement; and
• error monitoring, performance tracing, and session replay.

Essential technologies are needed for sign-in, security, and requested features. PostHog analytics and Sentry diagnostics may start when the Service loads. OpenReplay buffers recent session activity locally and sends replays for sampled sessions or when you open a bug report. The mobile apps also capture selected sessions and may start recording when you open a bug report. As explained in Section 1, replays may capture visible content, media, and canvas activity; input values are masked.

You can use browser controls to delete or block cookies and local storage, but blocking essential technologies may prevent sign-in or other features from working. Applicable law may require prior consent for non-essential analytics or replay technologies. The Service does not yet offer a complete in-product consent-management interface; this is an operational limitation, and browser blocking is not equivalent to a full consent control.

8. Email and communications

We may send messages needed to authenticate your account, process payments, respond to requests, enforce our policies, or provide important Service or legal updates. We may also send the one-time feedback message described in Section 1. Creator and community activity emails and lifecycle messages are described in Section 1.

To stop non-essential email, use an unsubscribe control included in the message when available or email contact@davia.ai. We may retain limited suppression information so that we can respect the request. You cannot opt out of messages strictly necessary for an active account, transaction, safety matter, or legal obligation.

Emails may contain delivery or interaction technologies supplied by our communications providers. Applicable law may require consent or another valid basis for those technologies. The Service does not yet expose a separate in-product control for email tracking; you may object by contacting us.

9. How long we retain information

We retain information for no longer than reasonably necessary for the purposes described in this Policy. Because the Service is persistent, some categories are kept for the life of an account or content unless you request deletion.

We use the following criteria:

• Account, private gameplay, conversations, memory, and drafts: while your account or the relevant content remains active, and afterward for a reasonable deletion, backup, security, or dispute period.
• Public content and profile information: while published or needed to operate the public feature; copies outside our control and existing remixes may remain. Limited attribution and lineage may be retained as described above.
• Shared and archived games: leaving a game or closing your account does not automatically erase its turns, world, generated media, or contributions retained with the game. Attribution identifiers and shared-cost history may also remain. These records can still contain personal information; you may request their deletion under Section 10, subject to applicable exceptions and the rights of other participants.
• AI requests, outputs, traces, and safety records: for the time needed to deliver the feature, preserve game continuity, debug, evaluate safety, prevent abuse, and resolve disputes. Provider retention may differ.
• Purchases, subscriptions, reload authorizations, gift transfers and redemptions, credit ledgers, and rewards: for transaction, accounting, tax, fraud, chargeback, and legal-retention requirements.
• Referral anti-abuse hash: while needed to enforce referral limits and investigate abuse, or until the associated record is deleted when no longer needed.
• Support, reports, and rights notices: for the time needed to handle the matter, document the decision, prevent abuse, and establish or defend claims.
• Lifecycle emails and delivery records: while needed to send and evaluate messages, honor suppression requests, and maintain an auditable delivery record. A one-way email hash and suppression state may be retained as needed to ensure that an unsubscribed address is not contacted again.
• Analytics, security logs, diagnostics, and replays: according to the configured provider retention period and for as long as needed for analytics, reliability, security, and incident response.

Backups, caches, and provider systems may take additional time to purge. We may retain information longer when required by law, necessary for safety or fraud prevention, or needed to establish, exercise, or defend legal claims. We may also aggregate or de-identify information so it can no longer reasonably be linked to you.

10. Your privacy rights and choices

Depending on where you live, you may have the right to:

• know whether we process your personal information and obtain access to it;
• receive information about categories, sources, purposes, and recipients;
• correct inaccurate information;
• delete information, subject to legal and operational exceptions;
• receive a portable copy of certain information;
• restrict or object to certain processing, including processing based on legitimate interests or direct marketing;
• withdraw consent without affecting earlier lawful processing;
• opt out of a sale, sharing for cross-context behavioral advertising, targeted advertising, or certain profiling where applicable;
• limit certain uses of sensitive personal information where applicable;
• appeal a denial of a privacy request; and
• complain to your local data-protection or privacy regulator.

Davia does not currently sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, so we do not offer an opt-out for those activities.

To exercise a right, email contact@davia.ai and describe your request. We may need to verify your identity and authority to protect your account and other people. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct verification. We will respond within the period required by applicable law.

You can request account deletion from account settings in the mobile app or email us to request account or content deletion, access, or a portable copy of your information. Account closure and data deletion are not identical: shared or archived game content, independent remixes, attribution, transaction and suppression records, and evidence may remain as described in Section 9, subject to your rights and applicable law. Public copies outside our control may also remain. Deleting the app alone does not delete your account. Closing your Davia account does not cancel an Apple or Google subscription; manage it through the store where you subscribed to stop further charges.

We will not unlawfully discriminate against you for exercising a privacy right. If we deny a request, you may reply to our decision to appeal where applicable.

European Economic Area and United Kingdom

You may object to processing based on legitimate interests. You also have the right to lodge a complaint with the supervisory authority where you live, work, or believe an infringement occurred. You may contact us first so we have an opportunity to address the concern.

United States

Residents of California and other states with applicable comprehensive privacy laws may have rights to know, access, correct, delete, and obtain a copy of personal information, as well as rights concerning sale, targeted advertising, sensitive information, profiling, and appeals. The categories collected, sources, purposes, and recipients are described throughout Sections 1 through 5. We do not knowingly use or disclose sensitive personal information for the purpose of inferring characteristics for advertising.

For purposes of U.S. state privacy-law categories, the information described in Section 1 may include identifiers and customer records; commercial information; internet or other electronic-network activity; audio, visual, and creative content; approximate location inferred from network information; inferences and safety classifications; and sensitive information such as account credentials or private communications. During the preceding 12 months, we may have disclosed these categories for the operational purposes described in Section 5 to the corresponding provider categories. We have not sold them or shared them for cross-context behavioral advertising.

Credits offered through rewards or referrals are based on eligible activity and program rules. They are not offered in exchange for permission to sell personal information or use it for targeted advertising.

11. International data transfers

Davia is based in the United States. We and our providers may process information in the United States and other countries whose laws may differ from those where you live.

Where applicable law restricts a transfer, the transfer must use an available legal mechanism and appropriate safeguards. Depending on the recipient and country, these may include an adequacy decision, standard contractual clauses, the UK international data transfer addendum or agreement, or another lawful mechanism. Contact contact@davia.ai to request information about safeguards applicable to a particular transfer.

12. Security

We use administrative, technical, and organizational measures designed to protect information, including authentication controls, role-based database access, row-level security, restricted service credentials, and encrypted network transport where supported. No system is perfectly secure, and we cannot guarantee that information will never be lost, accessed, or disclosed without authorization.

You are responsible for protecting access to your email and sign-in provider. Contact contact@davia.ai if you believe your account or information has been compromised.

13. Automated safety systems

We use automated systems to classify content, detect prompt injection, identify fraud or referral abuse, evaluate generated media, and enforce some feature limits. These systems may block, rewrite, flag, or restrict a request and can make mistakes.

Automated signals may also support content or account enforcement. To contest a restriction or decision, email contact@davia.ai with the account and content or request involved. Where applicable law gives you a right concerning solely automated decisions with legal or similarly significant effects, you may request information and human review.

14. Children

The Service is intended only for people who are at least 18 years old. We do not knowingly allow children to use the Service. The Service does not currently operate a complete age-verification system, so the contractual age requirement is not by itself proof that every user is an adult.

If you believe a person under 18 has provided personal information, contact contact@davia.ai. If we learn that a child has provided information in circumstances where processing is not permitted, we will take appropriate steps to restrict the account and delete the information, subject to legal obligations and safety needs.

15. Changes to this Policy

We may update this Policy as the Service, providers, or law changes. We will change the version and effective date and provide additional notice when a change is material or applicable law requires it. We will not treat continued use as consent where the law requires an affirmative choice.

16. Contact

Privacy questions and rights requests:

• Email: contact@davia.ai
• Company: Davia Labs, Inc.
• Address: c/o Resident Agents Inc., 8 The Green, Suite R, Dover, DE 19901, USA

Please do not send passwords, full payment-card details, government identifiers, or unnecessary sensitive information in an email request.