Privacy Policy
Last updated: 22 October 2026. Wicked Crave ("the app") is operated by Elizabeth Cooper Art LTD ("we"). Contact: sustinut@gmail.com.
Wicked Crave is an 18+ app for conversations with fictional AI characters. This policy explains what data the app and our servers handle, why, where it goes and how you delete it.
The short version
- Your chats, memories, relationship progress, photos, voice notes and recordings are stored on your phone, not in a cloud account.
- To generate replies, photos, voice notes and transcripts, the relevant content is sent through our server to Google (Gemini) and OpenAI for processing. We do not keep that chat content on our server.
- An account is optional: you can use the Free plan as a guest, without one. Buying Wicked Premium or Fairy Dust needs an account (Google sign-in). The app registers an anonymous device identifier either way.
- You can delete your account and data in the app, or at https://wicked-crave-api-746672488550.europe-west2.run.app/account-deletion.
1. Using the app as a guest (without an account)
On first use the app registers an anonymous device identifier with our server. It holds no name, email or phone number. We use it to authenticate the app to our server (including while you sign in), apply fair-use limits (daily usage counters) and link any reports you send.
When it registers, the app also sends your phone's Android ID for this app (a value Android gives each app, scoped to the app, your phone and your user profile; it survives reinstalling the app and changes on a factory reset). We do not store it: our server keeps only a one-way keyed hash of it (the "install key"), used solely to stop a reinstall, or clearing or deleting the app's data, from resetting the daily message allowance and usage limits on the same phone. It is never used for advertising, never shared and never linked to your name or email.
Guests get the Free plan (20 messages a day). The welcome week and all purchases need an account.
Guest chats and your account. A guest's chats, memories, relationship progress, nicknames, profile, photos and voice notes are kept only on the phone, in the app's private storage, until you delete them, delete the app's data or uninstall it. When you sign in from a guest session, the app moves them into your account on the phone automatically: they are combined with anything your account already has on that phone (nothing is overwritten or duplicated), and the guest copy is deleted only after the move has been checked. Nothing is uploaded to us or anyone else when this happens. To avoid putting someone else's chats into your account, they are moved only into a new account created from the guest session, or into the account that was last used on that phone (or any account if none was used there before). If you sign in to a different existing account, they stay on the phone in guest mode.
2. Optional sign-in with Google
An account is needed to buy Wicked Premium or Fairy Dust, and keeps your plan and purchases on any phone. If you choose to sign in:
- Google: we receive your Google account's unique ID, your name, your email address (only if Google marks it verified) and your profile picture URL. We do not request access to Gmail, Drive, contacts, calendar or any other Google data.
We use these only to create and recognise your Wicked Crave account and to show your name and picture in the app. We do not sell or share Google user data, use it for advertising, or transfer it to anyone except our hosting provider (Google Cloud), and we delete it when you delete your account. Accounts are identified by the provider's unique ID, never matched by email or name. Signing in gives your phone a Wicked Crave session. Its credentials are stored in your phone's encrypted secure storage. Our server stores only a hash of them.
3. Age
Wicked Crave is for adults 18 or older. The app asks for your date of birth once, calculates your age on your phone, and keeps only the result (passed/refused). Your date of birth is not stored or sent to us. Signing in with Google does not count as age verification.
4. Your conversations and what is sent for AI processing
Wicked Crave's characters are powered by third-party AI models. When you use a feature, the app sends the content needed for it to our server, which forwards it to the AI provider and returns the result:
| Feature | Sent for processing | Provider |
|---|---|---|
| Character replies (chat, group chats, the Pub) | Your new message, recent messages of that conversation (up to 20), a few relevant memories the character has formed about you, relationship state, the name you chose in Profile, and the character's personality instructions | Google Gemini (default); OpenAI as a fallback |
| Safety check of every character reply | The reply the character wrote, before it is shown to you | OpenAI (moderation) |
| Asking a character for a photo | That conversation's recent messages (as above); then a written scene description and the character's own reference images to generate the photo; then the character's profile image and the new photo to check it looks like the character | OpenAI |
| Character voice notes | The text the character will speak | Google Gemini (text-to-speech) |
| Your voice messages | The audio recording, to transcribe it into text (the text is then handled like a typed message) | OpenAI |
Your profile photo and personal gallery are never sent to any AI provider or to our server. Character replies are generated with safety filters enabled, and every character reply (from Gemini or OpenAI) is checked by OpenAI's moderation service before it is shown to you.
Our server passes this content through and does not store it. Google and OpenAI process it under their API terms and policies, which may include limited retention for abuse and safety monitoring. See Gemini API terms and OpenAI policies.
5. What is stored on your phone
Chats, character memories, relationship progress, nicknames, Pub visits and invitations, your profile name, profile photo and gallery, generated photos, character voice notes, and your own voice recordings and their transcripts are stored locally in the app's private storage. If several people use accounts on the same phone, each account's data is kept separately and hidden from the others.
What does not sync: this content is not uploaded to a cloud account. If you sign in on another phone, your account, its sign-in methods and its plan come with you, but your chats, memories, photos and voice notes do not.
6. What our server stores
| Data | Why | How long |
|---|---|---|
| Device identifier and registration details (platform, app version). It contains no name, email or phone number. | Authentication, fair-use and message limits | Until it is deleted: on request (contact us), or with your account's data when you delete your account. Uninstalling the app doesn't notify our server, so an unused identifier stays (unlinked to you) until removed. |
| Install key (a one-way keyed hash of your phone's Android ID for this app; the Android ID itself is not stored), kept with the device identifier | Fair-use and message limits: a reinstall on the same phone shares the phone's daily counters | As long as the device identifier; its daily counters expire within two days |
| Account record (ID, name, email if verified, avatar URL, linked sign-in methods, plan) | Your optional account (needed for purchases) | Until you delete the account |
| Session records (hashed, per signed-in device) | Keeping you signed in securely | Up to 90 days of inactivity; ended by signing out |
| Daily usage counters (per device, per install key and per account) | Fair-use limits | 35 days |
| Daily message allowance (messages used today and when it resets, per device, per install key and per account; never the messages themselves). To reset it at your midnight the app sends your phone's time-zone setting with chat requests; it is used for that calculation and not stored. | Your plan's daily messages | Overwritten each day; deleted with the account or device, except the install key's counter, which expires within two days |
| Purchases made through Google Play (product, Google Play order ID and purchase token, Premium status and renewal date, Fairy Dust credits and their expiry). We never receive your card or payment details. | Verifying purchases with Google Play and giving you what you bought | While your account exists; a minimal record of each order (product, order ID, no account link) is kept afterwards so a purchase can't be credited twice |
| Reports you send about AI content (the reported message, a few messages before it, how it was generated, your reason and optional comment) | Reviewing and improving AI safety | Until reviewed and resolved, or until you delete your account |
| Character requests you send (Wicked Premium): the character's name, the optional source, description and details you write, your account ID and when you sent it | Reviewing which characters to add (a request is not a promise that a character will be added) and allowing one request every 7 days | Until reviewed, or until you delete your account |
| Photos generated for you by characters | So reported images can be reviewed | 30 days, then deleted automatically |
| Technical request logs (route, status, timing, a short one-way hash of the device ID; never message content, tokens or keys) | Operating and securing the service | Per our hosting provider's log retention (typically 30 days) |
Our server runs on Google Cloud in the United Kingdom (europe-west2). AI providers may process data in other countries, including the United States.
Purchases (Wicked Premium and Fairy Dust)
Purchases are made through Google Play, which handles payment and is responsible for your payment details under its own privacy policy. To give you what you bought, the app sends our server the Google Play purchase token, our server checks it with Google Play, and Google Play sends our server updates about your subscription (renewals, cancellations, refunds). Purchases need a Wicked Crave account so they can follow you to other phones.
7. Analytics and advertising
The app contains no advertising and no third-party analytics or tracking SDKs. We do not sell your data.
Our public web pages set no cookies and use no analytics. Our hosting providers (Google Cloud, and Vercel for wicked.niklaus.app) process visitors’ IP addresses only to deliver the pages and keep them secure.
8. Deleting your data
- Delete a chat: removes its messages, photos and voice notes from your phone.
- Delete my local data (Profile → AI & data controls): removes everything stored on this phone for the current user.
- Delete account (Profile → Account details, or https://wicked-crave-api-746672488550.europe-west2.run.app/account-deletion if you can't use the app). This deletes your account, sign-in links, sessions (all devices are signed out), usage records, plan, unused Fairy Dust, reports, character requests and retained photos from our server, and your account's data on that phone. It does not delete your Google account.
- Uninstalling the app removes everything stored on that phone.
9. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, and to data portability. Contact sustinut@gmail.com. You may also complain to your data protection authority.
10. Children
Wicked Crave is not for anyone under 18. We do not knowingly collect data from minors. If you believe a minor is using the app, contact us.
11. Changes
We'll update this page when the app changes how it handles data, and change the date above. Significant changes will be shown in the app.
Legal basis (UK/EU)
We process data to provide the service you ask for (contract), to keep it secure and fair (legitimate interests), and where required by law. Governing law and jurisdiction: England and Wales.