Home › Privacy

Privacy policy

Plain version: we collect what we need to run your account and your chats, we log ordinary web traffic, we set a few first-party cookies (none for advertising, none from third parties), we use AI providers to generate replies and images, and you can export or delete it all. Last updated 14 November 2026.

Who we are

Velvet runs an 18+ AI companion service at velvetcompanionai.com. For any privacy question, or to exercise a right below, email support@velvetcompanionai.com.

What we collect

• Account — your email, display name, a hashed password, when you confirmed you are 18+, and your signup source if you arrived from a link.
• Your use — your companions, threads, favourites and unlocked media, token balance, plan, and the messages you send.
• Media — the portraits, sets and clips generated for you.
• Payments — the order, amount, currency and status. Crypto is handled by our processor.
• Feedback — if you answer the rating card in chat: the 1–5 rating and any comment you choose to write. You can skip it or tell it never to ask again.
• Traffic — see “What we log”.

What we log

When you open a page we write an ordinary access-log line and a shorter visit line. They carry the page, the status, the time, a request id, your IP address, your browser's user-agent, the language your browser asks for, and the host of the page that referred you (not the full URL). We also keep a salted hash of your IP so we can count unique visitors. Logs sit in rotated files on our server and in a private log archive, and are deleted after 30 days.

If the app breaks in your browser, it sends us a short technical error report: the error's name and message, where in our code it happened, which screen you were on, and the id of the last request that failed. It never includes what you typed, page text or the full address of the page.

Separately, we count page views to see how visitors move from a first visit to an account: the type of page, the campaign or partner link you arrived by, and the host that referred you, kept against a random visitor id (the velvet_aid cookie below). That record never holds your IP address or the full URL. Inside the app we also note a few steps against the same id: that the page loaded, the 18+ answer, that a sign-up prompt was shown and whether a sign-up was attempted. We run no advertising scripts and nothing from third parties.

Cookies & local storage

No advertising cookies and nothing set by third parties. Everything here is first-party. What we store on your device:

• velvet_session (cookie, up to 30 days) — keeps you signed in. Essential, so it needs no consent banner.
• velvet_aid (cookie, 180 days) — a random visitor id, set on your first page. It is our one measurement cookie: it lets us count visits and see how far visitors get, and it is joined to your account when you sign up or sign in. It is a random number, not built from your IP address or your device, and it is never shared. Block or clear it in your browser and the site works the same.
• velvet_ref, velvet_utm, velvet_cid (cookies, 60 days) — set only when you arrive by a partner or campaign link: which link it was, and the partner's click id, so the right partner is credited if you sign up.
• velvet-anon-id (local storage) — a fallback copy of the visitor id, used when the cookie is missing.
• velvet-age-ok (session storage) — remembers the 18+ gate for the tab.
• velvet-age-device (local storage) — remembers that you answered the 18+ gate on this browser, so a new tab does not ask again while you are signed in.
• velvet-utm, velvet-ref (session storage) — remember which link you arrived from, for first-touch attribution.
• velvet-evt-… (session storage) — small flags so a page load or the 18+ gate is counted once per tab.
• velvet-state-v1 (local storage) — your device UI state: chosen companion, composer drafts, preferences.

Why we use it (lawful bases)

To perform our contract: your account, chats, media and tokens. For our legitimate interests: security, abuse and fraud prevention, and aggregate traffic measurement. To comply with law: tax and accounting records. We do not sell your data.

Who processes it

We share the minimum with the providers that make the service work:

• AI providers — Sogni, Venice and OpenRouter receive the chat text and prompts needed to generate replies, images, video and voice.
• Payments — NOWPayments receives the order and, if you pay by crypto, the on-chain details.
• Hosting — our server and database host.
• Content delivery — Bunny.net delivers the site's public pictures, clips and fonts from servers near you, so it sees your IP address and the file requested. Your own and paid media are never served through it.

If you are in the EU/UK some of these sit outside it; those transfers rely on the providers' safeguards.

How long we keep it

Account and content: until you delete them. Traffic logs: short-lived and rotated on the server. Product activity: about 90 days. Full chat payloads: about 30 days, while your messages stay. Financial records (orders, grants): kept longer for tax. Delete your account and the rest goes; a few financial rows survive pseudonymised.

Your rights

You can export everything and delete your account from Settings → Privacy & data, and you can ask us to correct or explain anything. EU/UK users can object or complain to their local data-protection authority. We answer requests at support@velvetcompanionai.com.

Security & age

Passwords are salted-hashed; sessions are HttpOnly cookies, revoked on logout. The service is 18+; your age is self-reported at signup. Every companion is a fictional, AI-generated adult — no real-person likenesses.

Changes

We may update this page; the date above is the current version. Material changes will be noted in the app.