Privacy Policy

Effective date: May 10, 2026 · Last updated: October 28, 2026

Selfa ("we", "us", "our") is operated by CHALENCY Inc. (founder: Saeed Rezaei), based in Toronto, Ontario, Canada. This Privacy Policy describes how Selfa collects, uses, shares and protects your personal information when you use the Selfa iOS app or our service at app.selfa.ca and www.selfa.ca.

1. Information We Collect

• Account information: email address, authentication credentials.
• Identity-creation data: what you provide when creating a Selfa identity — the identity's name, your answers to the interview questions, any text you write, and any optional document (.md / .txt) you add.
• Conversation data: messages you send to your Selfa AI identity, which we store to provide long-term memory features, plus the concepts, summaries and profile notes Selfa derives from them.
• Usage data: tier, wallet balance, subscription status, message counts.
• Payment information: processed exclusively by Stripe Inc. We do not store full credit card numbers on our servers. We retain the last 4 digits and expiration date for receipt purposes only.
• Voice/audio data: when you use voice conversation, your speech is processed to convert it to text and to generate a spoken response. Audio is not retained beyond what is needed to provide this feature.
• Technical data: IP address, browser type, device information for security and analytics purposes.

How we collect it: almost everything is provided directly by you inside the app — when you sign in (email, or Sign in with Apple / Google), when you type or speak to Selfa, when you answer the identity-creation questions, and when you add an optional document. Usage and technical data are recorded automatically by our servers when the app talks to them. Purchase records come from Apple (via RevenueCat) or Stripe.

2. How We Use Your Information

• To provide and personalize the Selfa AI companion experience.
• To process subscriptions and wallet top-ups via Stripe (website) or Apple In-App Purchase (iOS app).
• To maintain long-term memory across your conversations (a core product feature).
• To send service-related communications (receipts, billing notices).
• To detect fraud, abuse, and security threats.
• To comply with legal obligations.

3. Sharing Data with Third-Party AI Services

Selfa does not run its own AI model. To build your identity and to reply to you, Selfa sends some of your personal data to the third-party AI services listed below. We ask for your permission inside the app before any of your data is sent to these services (the "Sharing data with AI services" screen shown after sign-in). If you choose "Don't allow", nothing is sent, but Selfa cannot build an identity or reply.

What data is sent

• The messages you write in conversations.
• Your identity-creation input: the identity's name, interview answers, text you write and any optional document you add.
• Context needed for a personal reply: summaries of past conversations, your Selfa's concepts and profile notes.
• Your voice audio, only when you use voice conversation.

Your email address, password, account identifiers and payment details are not sent to AI services.

Who receives it, and why

• Anthropic, PBC (Claude API) — the main service: generates conversation replies, builds your identity's concepts, and runs web searches when a reply needs current information. Selfa's optional background "reading" feature also sends your identity description to Anthropic. Anthropic privacy policy
• OpenAI, L.L.C. — generates conversation replies only when you pick an OpenAI model from the model menu. OpenAI privacy policy
• X.AI LLC (Grok) — generates conversation replies only when you pick a Grok model from the model menu. xAI privacy policy
• ElevenLabs Inc. — converts your speech to text and Selfa's replies to speech, only during voice conversation. ElevenLabs privacy policy

How these services protect your data

These providers receive your data through their business APIs and process it only to return the requested response. Their API terms and data-processing commitments provide the same or equal protection of user data as described in this Privacy Policy, including encryption in transit and limits on how long data is kept. We do not sell your data and do not allow these providers to use it for advertising.

Withdrawing permission

You can see and withdraw this permission at any time in the app: Settings › Account › Privacy — AI data sharing › Withdraw permission. Once withdrawn, Selfa's servers stop sending any of your data to AI services (including background features) until you allow it again. Withdrawing does not delete your saved data; to delete everything, use Settings › Account › Delete account.

3a. Other Service Providers

Selfa also uses the following services to operate. None of them receives your conversations for AI processing:

• Stripe: processes website payments. Stripe's privacy practices are governed by their own policy at stripe.com/privacy.
• Apple and RevenueCat: purchases made in the iOS app are processed by Apple. RevenueCat Inc. receives your purchase records and an anonymous account identifier so we can apply your subscription or credit. Neither receives your conversations.
• Supabase: stores your account data and conversation history in encrypted form.
• Vercel: hosts the application infrastructure.

4. Data Retention

We retain your conversation history for as long as your account is active, because long-term memory is a core feature of Selfa. You can delete your account and all associated data at any time from inside the app (Settings › Account › Delete account) or by emailing us.

5. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and data.
• Export your conversation history.
• Withdraw your permission for sharing data with AI services at any time, in Settings › Account › Privacy — AI data sharing.

Canadian residents have additional rights under PIPEDA. EU residents have rights under GDPR. To exercise any of these rights, contact us at the email below.

6. Security

We use industry-standard security measures including encryption at rest (Supabase), encryption in transit (HTTPS/TLS), and encrypted API keys (per-user encryption with our ENCRYPTION_KEY). However, no system is 100% secure; you use the service at your own risk.

7. Children

Selfa is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us for immediate deletion.

8. Changes to This Policy

We may update this policy. Material changes will be communicated via email or in-app notification at least 30 days before taking effect.

9. Contact

For privacy questions, data requests, or complaints:

Email: saretocan@gmail.com
Operator: Saeed Rezaei
Location: Toronto, Ontario, Canada