Privacy Policy

Last updated: 2 October 2026

1. Who we are

Outthinkr Ltd ("Naughtii") is based in the United Kingdom and processes data in accordance with UK GDPR. For your own data - your account, AI profile and usage - we are the data controller. For the conversation excerpts you send us to draft replies, you are the controller of your correspondence and we act as your processor, on the terms set out in section 4a of our Terms of Service.

2. What we collect

  • Account data - email address, display name, encrypted password (handled by our authentication provider).
  • AI profile data - the persona, niche, tone of voice, boundaries, price menu and writing samples you choose to provide.
  • Conversation excerpts - when you request reply suggestions, the recent messages in the conversation you are viewing are sent to our servers to generate suggestions. We process these transiently to serve your request; we do not build a store of your fans' conversations.
  • Chat screenshots (iPhone shortcut) - when you use the Naughtii Reply shortcut, a reduced-size screenshot of the chat on your screen, with its metadata removed, is sent to our servers together with the text read from it on your device. Our AI provider reads the screenshot to reconstruct the conversation and draft suggestions. The screenshot is processed in memory for that single request and is not stored by us.
  • Usage data - counts and timestamps of generations, used for fair-use limits and service analytics.

3. How we use your data

We use your data solely to provide the Service: authenticating you, generating reply suggestions in your voice, enforcing fair-use limits, and improving reliability. We do not sell your data, and nothing you put into Naughtii - your email, AI profile, your fans' messages or your replies - is used for advertising. Our public pages and sign-up page do use Meta's pixel to measure our own ads, as set out in section 4b.

4. AI processing

Reply suggestions are generated using a third-party large language model API operated by xAI in the United States. Your AI profile and the conversation excerpt you are replying to - or, from the iPhone shortcut, the chat screenshot - are sent to that provider to fulfil your request. Requests are made server-to-server through Naughtii's infrastructure; our API credentials and your data are never exposed to other users.

4a. Product analytics

We use PostHog, a product analytics service, hosted in the EU, to understand which parts of Naughtii help creators (for example, whether the extension setup succeeds). It is configured conservatively: no session recording, no automatic click capture, and it honours your browser's Do Not Track setting. Analytics events describe your use of Naughtii itself - they never include your fans' messages or your generated replies. When you insert or copy one of the suggested replies, Naughtii records which of the three you chose (its position, plus rough measurements such as its length and whether it asks a question), never the reply itself, so suggestions can get closer to your voice over time. The short steer notes you type (“shorter”, “more emoji”) are kept for 90 days so that one you keep repeating can be offered as a line in your profile; nothing is added to your profile unless you accept it.

4b. Advertising measurement (Meta Pixel)

To see which of our ads bring creators to Naughtii, our public pages (the homepage, How it works, the Creator Hub, Trust, Support and these legal pages) and our sign-up page use the Meta Pixel, provided by Meta Platforms Ireland Limited. It never runs in your dashboard, in onboarding, in the Chrome extension or in the iPhone shortcut.

  • What Meta receives - the page you are on, that you clicked a link to sign up, and that an account was created. We never send your email, name, password, AI profile, your fans' messages or your replies. Meta also collects what any website visit reveals: your IP address, browser and device details, and its own cookies (such as _fbp), which Meta may link to a Facebook or Instagram account you are signed in to.
  • Your choice - in the UK, the EEA, Switzerland and Quebec the pixel stays off unless you say yes. Elsewhere it is on by default. Either way you can change your mind at any time from Cookie settings at the bottom of every public page. If your browser sends a Do Not Track or Global Privacy Control signal, the pixel never loads.
  • Who is responsible - we and Meta are joint controllers for collecting this data on our pages and passing it to Meta, under Meta's Controller Addendum. What Meta does with it afterwards, including using it to show and measure ads, is Meta's responsibility under its own Privacy Policy (facebook.com/privacy/policy). Meta may transfer the data to the United States.
  • How long - our record of your choice lasts six months, then we ask again. Meta's _fbp cookie lasts up to 90 days.

5. Legal bases

We process your data to perform our contract with you (providing the Service), and on the basis of legitimate interests (service security and fair-use enforcement). Where your profile content reveals sensitive information, we process it with your explicit consent, which you may withdraw by deleting that content or your account. The advertising pixel in section 4b runs on your consent where the law requires it (the UK, the EEA, Switzerland and Quebec) and otherwise on our legitimate interest in measuring our own advertising, which you can object to at any time from Cookie settings.

6. Retention and deletion

Account and profile data are retained while your account is active. Deleting your account deletes your profile and usage records. You can request a copy or deletion of your data at any time at privacy@naughtii.com.

7. Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted, and sensitive credentials are additionally encrypted at the application layer.

8. Your rights

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. You may also complain to the ICO (ico.org.uk). To exercise any right, email privacy@naughtii.com.

9. Changes

We will notify registered users of material changes to this policy.