Privacy Policy

1. Who we are

Outthinkr Ltd ("Naughtii") is the data controller for personal data processed through naughtii.com and the Naughtii DM Assistant extension. We are based in the United Kingdom and process data in accordance with UK GDPR.

2. What we collect

• Account data — email address, display name, encrypted password (handled by our authentication provider).
• AI profile data — the persona, niche, tone of voice, boundaries, price menu and writing samples you choose to provide.
• Conversation excerpts— when you request reply suggestions, the recent messages in the conversation you are viewing are sent to our servers to generate suggestions. We process these transiently to serve your request; we do not build a store of your fans' conversations.
• Usage data — counts and timestamps of generations, used for fair-use limits and service analytics.

3. How we use your data

We use your data solely to provide the Service: authenticating you, generating reply suggestions in your voice, enforcing fair-use limits, and improving reliability. We do not sell your data or use it for third-party advertising.

4. AI processing

Reply suggestions are generated using a third-party large language model API. Your AI profile and the conversation excerpt you are replying to are sent to that provider to fulfil your request. Requests are made server-to-server through Naughtii's infrastructure; our API credentials and your data are never exposed to other users.

4a. Product analytics

We use PostHog, a product analytics service, hosted in the EU, to understand which parts of Naughtii help creators (for example, whether the extension setup succeeds). It is configured conservatively: no advertising trackers, no session recording, no automatic click capture, and it honours your browser's Do Not Track setting. Analytics events describe your use of Naughtii itself — they never include your fans' messages or your generated replies.

5. Legal bases

We process your data to perform our contract with you (providing the Service), and on the basis of legitimate interests (service security and fair-use enforcement). Where your profile content reveals sensitive information, we process it with your explicit consent, which you may withdraw by deleting that content or your account.

6. Retention and deletion

Account and profile data are retained while your account is active. Deleting your account deletes your profile and usage records. You can request a copy or deletion of your data at any time at privacy@naughtii.com.

7. Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted, and sensitive credentials are additionally encrypted at the application layer.

8. Your rights

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. You may also complain to the ICO (ico.org.uk). To exercise any right, email privacy@naughtii.com.

9. Changes

We will notify registered users of material changes to this policy.