Privacy Policy

1. Who we are

Outthinkr Ltd ("Naughtii") is based in the United Kingdom and processes data in accordance with UK GDPR. For your own data - your account, AI profile and usage - we are the data controller. For the conversation excerpts you send us to draft replies, you are the controller of your correspondence and we act as your processor, on the terms set out in section 4a of our Terms of Service.

2. What we collect

• Account data - email address, display name, encrypted password (handled by our authentication provider).
• AI profile data - the persona, niche, tone of voice, boundaries, price menu and writing samples you choose to provide.
• Conversation excerpts - when you request reply suggestions, the recent messages in the conversation you are viewing are sent to our servers to generate suggestions. We process these transiently to serve your request; we do not build a store of your fans' conversations.
• Chat screenshots (iPhone shortcut) - when you use the Naughtii Reply shortcut, a reduced-size screenshot of the chat on your screen, with its metadata removed, is sent to our servers together with the text read from it on your device. Our AI provider reads the screenshot to reconstruct the conversation and draft suggestions. The screenshot is processed in memory for that single request and is not stored by us.
• Usage data - counts and timestamps of generations, used for fair-use limits and service analytics.

3. How we use your data

We use your data solely to provide the Service: authenticating you, generating reply suggestions in your voice, enforcing fair-use limits, and improving reliability. We do not sell your data or use it for third-party advertising.

4. AI processing

Reply suggestions are generated using a third-party large language model API operated by xAI in the United States. Your AI profile and the conversation excerpt you are replying to - or, from the iPhone shortcut, the chat screenshot - are sent to that provider to fulfil your request. Requests are made server-to-server through Naughtii's infrastructure; our API credentials and your data are never exposed to other users.

4a. Product analytics

We use PostHog, a product analytics service, hosted in the EU, to understand which parts of Naughtii help creators (for example, whether the extension setup succeeds). It is configured conservatively: no advertising trackers, no session recording, no automatic click capture, and it honours your browser's Do Not Track setting. Analytics events describe your use of Naughtii itself - they never include your fans' messages or your generated replies.

5. Legal bases

We process your data to perform our contract with you (providing the Service), and on the basis of legitimate interests (service security and fair-use enforcement). Where your profile content reveals sensitive information, we process it with your explicit consent, which you may withdraw by deleting that content or your account.

6. Retention and deletion

Account and profile data are retained while your account is active. Deleting your account deletes your profile and usage records. You can request a copy or deletion of your data at any time at privacy@naughtii.com.

7. Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted, and sensitive credentials are additionally encrypted at the application layer.

8. Your rights

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. You may also complain to the ICO (ico.org.uk). To exercise any right, email privacy@naughtii.com.

9. Changes

We will notify registered users of material changes to this policy.