Privacy Policy

1. Introduction

This Privacy Policy describes how Podnami ("we," "us," or "our") collects, uses, and discloses information when you use our AI-powered podcast co-host service ("the Service"). By using the Service, you consent to the data practices described in this policy.

Important: We make reasonable efforts to protect your information, but we cannot guarantee absolute security. You use the Service at your own risk.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, password (encrypted), name, and profile data
• Payment Information: Billing details processed by third-party payment processors (we do not store full credit card numbers)
• User Content: Audio recordings you choose to save, voice and text input, and AI interaction data. We do not retain transcripts of your conversations in our server logs. Conversation text is held only for the duration of your session and is sent to our AI providers (see section 4.1) to generate replies.
• Settings and Preferences: Bot configurations, voice selections, LLM settings, and customization choices
• Communications: Support requests, feedback, and correspondence with us

2.2 Information Collected Automatically

• Usage Data: Features used, time spent, interaction patterns, and service usage statistics
• Device Information: Browser type, operating system, device identifiers, IP address
• Cookies and Tracking: Session cookies, authentication tokens, and analytics data
• Log Data: Access times, pages viewed, errors encountered, system events, and session metadata such as your account identifier, connection times and activity counts. Our logs record that a conversation took place, not what was said — conversation content is removed before it reaches them.

2.3 Information from Third Parties

• OAuth Providers: If you sign in with Google or GitHub, we receive basic profile information
• AI Service Providers: Data may be processed by OpenAI, OpenRouter, LemonFox, and other integrated services
• Payment Processors: Transaction confirmations and payment status

3. How We Use Your Information

We use collected information for the following purposes:

• Service Delivery: To provide, maintain, and improve the Service
• AI Processing: To generate AI responses, create TTS audio, and power conversational features
• Personalization: To customize your experience and remember your preferences
• Communication: To send service updates, technical notices, and support messages
• Analytics: To understand usage patterns and improve service quality
• Security: To detect fraud, prevent abuse, and protect user accounts
• Legal Compliance: To comply with legal obligations and enforce our Terms
• Billing: To process payments and manage subscriptions

4. Data Sharing and Disclosure

4.1 Third-Party Service Providers

We share data with third-party services that power our platform:

• Language-model providers (AI inference, primarily United States): receive your prompt and recent conversation context in order to generate a co-host reply.
• Speech-synthesis providers (text-to-speech, primarily United States and Europe): receive the reply text in order to generate audio.
• Speech-recognition providers (automatic transcription, primarily United States): receive short audio segments when server-side transcription is used.
• Database and authentication platform (managed database hosting, Europe/United States): stores your account, settings and billing records.
• Payment processor (online payments, United States/Europe): processes subscriptions and credit purchases.
• Image library (stock photography, United States): receives only short search terms for the Vibe Visualizer, never conversation content.
• Infrastructure provider (cloud server hosting, United States): hosts our services.
• Approximate location is derived on our own servers from a local database. Your IP address is not sent to a location provider.
• A current list of the specific companies acting as our processors is available on request from the contact address in section 19.
• Payment Processors: Process transactions (subject to their privacy policies)

Important: These third parties have their own privacy policies. We are not responsible for their data practices or security measures.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or legal process, or to:

• Comply with legal obligations or government requests
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Prevent fraud, security threats, or illegal activity
• Protect the rights, property, or safety of our users or the public

4.3 Business Transfers

If Podnami is involved in a merger, acquisition, or asset sale, your information may be transferred. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

4.4 Aggregated Data

We may share aggregated, anonymized data that does not directly identify you for research, marketing, or other purposes.

5. Data Security

We implement reasonable security measures to protect your information, including:

• Encryption of data in transit (HTTPS/SSL)
• Encrypted storage of sensitive data
• Access controls and authentication mechanisms
• Regular security assessments
• Multi-tenant isolation to separate user data

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your information. You acknowledge that you provide information at your own risk.

6. Data Retention

We retain your information for as long as necessary to provide the Service or as required by law:

• Account Data: Retained while your account is active and for a reasonable period after closure
• Recordings: Retained until you delete them or your account is terminated
• Server Logs: Retained no more than 90 days. These contain session metadata (account identifier, timestamps, activity) and not conversation content. Because logs are an append-only store, individual entries cannot be removed on request; they are deleted on the retention cycle above and are never restored into active use.
• Co-host Memory: If enabled, conversation content is stored so your co-hosts can recall previous sessions. You can switch this off at any time under Settings → Memory (“Remember past sessions”), and you can erase it at any time with “Clear All Memory”.
• Billing Records: Retained as required by tax and accounting regulations

Note: We are not obligated to retain your data after account termination. We recommend backing up important content regularly.

7. Your Rights and Choices

7.1 Access and Correction

You may access and update your account information through the Service settings. You are responsible for keeping your information accurate and current.

7.2 Data Deletion

You may request deletion of your account and data by contacting us. Note that some information may be retained for legal or operational purposes. In particular, server logs cannot be edited to remove individual entries; log data relating to you is deleted on the retention cycle described in section 6 and is never restored into active use. Co-host memory can be erased immediately by you at any time under Settings → Memory.

7.3 Data Portability

You can download your recordings at any time. Upon request, we will provide your account data in a machine-readable format where technically feasible.

7.4 Marketing Communications

You may opt out of marketing emails by following the unsubscribe link. You cannot opt out of service-related communications (e.g., account verification, security alerts).

7.5 Cookies

Most browsers allow you to control cookies through settings. Disabling cookies may limit Service functionality.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using the Service, you consent to the transfer of your information to any country where we or our service providers operate.

9. Children's Privacy

The Service is not intended for children under 18 years of age. We do not knowingly collect information from children under 18. If you believe we have collected information from a child under 18, please contact us immediately.

10. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Opt-out of the "sale" of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

To exercise these rights, contact us with a verifiable request.

11. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under GDPR including:

• Right of Access: Request copies of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain types of processing
• Right to Withdraw Consent: Withdraw consent for data processing

To exercise these rights, contact us. You also have the right to lodge a complaint with your local supervisory authority.

12. AI and Data Processing Disclosure

Important Notice: Your voice input, text prompts, and interaction data are processed by third-party AI models. These services may:

• Use your data to improve their AI models (subject to their terms)
• Store your data on their servers
• Process your data in various jurisdictions
• Be subject to different privacy regulations

We are not responsible for how third-party AI providers handle your data. Review their privacy policies before using the Service.

What we do not keep: while conversation content must be sent to these providers in order to generate a reply, we do not retain it in our own server logs. Content is stored by us only where the feature you are using requires it — saved recordings, shareable clips, Tarot readings, Thinking sessions, and co-host memory. Tarot readings and Thinking sessions are kept so you can return to them and are removed when they expire or when you delete them; co-host memory can be switched off or erased at any time under Settings → Memory.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

For material changes, we will provide additional notice (e.g., email notification or prominent notice on the Service).

14. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to read their privacy policies.

15. Do Not Track Signals

We do not currently respond to "Do Not Track" browser signals. We may use cookies and tracking technologies for essential Service functionality.

16. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities as required by applicable law. However, we are not liable for any damages resulting from unauthorized access to your information.

17. User API Keys

If you provide your own API keys for third-party services (e.g., OpenAI, OpenRouter), you are responsible for:

• Keeping your API keys secure
• Monitoring your API usage and costs
• Complying with third-party service terms
• Any charges incurred through your API keys

We store encrypted API keys but cannot guarantee absolute security. Use of API keys is at your own risk.

18. No Warranty of Privacy

WHILE WE MAKE REASONABLE EFFORTS TO PROTECT YOUR INFORMATION, WE MAKE NO WARRANTIES OR GUARANTEES REGARDING THE PRIVACY OR SECURITY OF YOUR DATA. You acknowledge and accept the risks associated with transmitting information over the internet.

19. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us through the Service support system or via email.

For privacy-related inquiries, rights requests, or data deletion requests, provide:

• Your account email address
• A detailed description of your request
• Verification of your identity

We will respond to verified requests within a reasonable timeframe as required by applicable law.