Privacy policy

Last updated: 04.11.2026

This policy explains how Uncensored, LLC ("we") processes your personal data in the Adult Canvas service. It also covers the information required for users in Türkiye under Law No. 6698 on the Protection of Personal Data (KVKK) and for users in the EU and UK under the GDPR. Data controller: Uncensored, LLC, U.S..

Data we collect

You can't upload photos to the Service, so we don't receive photos of you. The characters and all content on the Service are AI-generated.

Account details: the email address, name and profile picture shared when you sign in with Google, and account data such as your credit balance, your invite code, who invited you and when you accepted the terms.
Chat messages: the messages you send to the AI characters and their replies, including the photos and voice notes created in your chats.
Videos: the videos you make from your chat photos (deleted automatically after 24 hours, see below).
Credit history: every change to your credit balance since 3 November 2026: the date, the amount, the balance after it and the reason (for example a purchase, a photo unlock or a refund). You can see it under "My account".
Usage records: the time of each request, which characters you chat with, the credits and free messages used, the photos and voice notes you unlock and the video options you choose.
Payment records: the Telegram payment ID, the ID of the Telegram account that paid, the amount and the credits bought. Your card details never reach us; Telegram takes the payment. For crypto payments: the sending wallet address, the transaction ID and the amount. Blockchain transfers are public and permanent: anyone can see a transfer from your wallet to ours.
Analytics: the pages you visit and what you do on the site (for example opening a chat, unlocking a photo or buying credits), with browser and device details, through Google Analytics. These records are linked to a random account ID, not to your name or email, and contain no chat messages. Analytics is on by default and you can switch it off at any time, see "Cookies and browser storage" below.
How you found us: when you sign up, the kind of page you first opened on the site (for example the home page or a character's page, never its address), the language it was in and when you opened it, and the marketing link you first came from (its campaign tags, for example utm_source=x) or the name of the website that sent you (for example t.co), so we can tell which of our pages, posts and links bring people. Nothing is kept if you switched analytics off. It is stored with your account and kept while your account exists.
Technical data: your IP address and browser details, which our hosting and infrastructure providers process to deliver the site and keep it secure.
Language, time zone and country: the language you use the site in, your device's time zone and the country of your internet connection (worked out from your IP address). We use them to send you a character's messages in your language and at a sensible hour for you.
Messages while you're away: when you haven't chatted for a few days, the character you talked to most may write you a message in your chat, and, if you connected Telegram, you also get a short heads-up there. We record when each of these messages was sent, whether it reached you and whether you opened it. These records contain no message text and aren't shared with anyone.
Telegram notifications (only if you connect them): your Telegram chat ID, so our notification bot can send you a short heads-up on Telegram when one of those messages is waiting in your chat. Every such message says how to stop them: tap "Stop these messages", send /stop or reply REJECT to the bot, or use "Disconnect" under "Telegram notifications" in your account menu; any of these deletes your chat ID. If you block the bot, we delete it too.
Messages to our Instagram account: if you reply to a story of one of our characters' Instagram accounts or send it a direct message, Meta passes that message to us so we can answer with a short automatic greeting. We read the message only to choose the language of the greeting. We don't store its text, your Instagram username or your Instagram ID. So that you get at most one greeting a day, we keep a keyed hash of your Instagram ID for 2 days. None of this is linked to an account on the site.
Abuse prevention: to prevent abuse of free trials (opening many accounts to get the free allowance again), we store a hash of a random device identifier that our site keeps in your browser, and a keyed hash of the IP address from your account's first visit. To limit order spam, each crypto order also stores a keyed hash of the IP address it was opened from. We don't store the identifier or the IP address themselves for this purpose.

Why we process it

To provide the Service: write the characters' replies, create voice notes, photos and videos, show them to you and keep your chats and balance.
To handle payments and credits, return credits automatically when something can't be created, and meet legal obligations.
Safety: to enforce the age limit and the rules in the Terms of use, apply usage limits and prevent abuse.
To run and improve the Service: our team may look at chats, for example to check the quality of replies and fix problems.
To understand how the site is used (analytics).
To answer messages sent to our Instagram accounts with a short automatic greeting.
To let a character write to you when you've been away (in your chat, with a short heads-up on Telegram if you connected it) and to count how many of these messages are sent and opened.

Who we share it with

We don't sell your data or use it for ads. To run the Service we share only what is needed with the providers below:

Cloud infrastructure provider: database, sign-in and file storage (USA)
AI infrastructure providers: writing the characters' replies, creating voice notes, photos and videos, and automatic checks of chat messages (for example whether you asked for a photo or a voice note)
Google: sign in with Google and website analytics (Google Analytics)
Telegram: payments and, if you connect Telegram notifications, sending you a short heads-up there when a character has written to you
Meta (Instagram): receiving the story replies and direct messages sent to our Instagram accounts, and sending the automatic greeting
Blockchain data provider: reading USDT payments to our wallet from the public BNB Smart Chain blockchain through a blockchain node (we only send our own wallet address and the IDs of payment transactions)
Storage provider: archive of older chat messages
Hosting provider: website hosting

International transfers

We are a company based in the United States. Your data is processed and stored outside the country where you live, mainly in the United States and in the countries where the providers above operate. By starting to use the Service you agree to this transfer.

How long we keep it

Chat messages: Your chats are kept in your account so you can continue them on any device, until you delete them. Messages older than 30 days (except the last 60 of each chat) are moved to an encrypted archive with our storage provider and load again when you scroll up; they are kept just like the rest of the chat. You can delete a chat at any time with the trash icon on the chat page; its messages, archived messages, photos and voice notes are removed right away. Chats are also deleted when your account is deleted (see "Deleting your account" below). If a chat is hidden because it broke our rules on minors or because you said you are under 18 (see sections 3 and 4 of the Terms), we keep a copy of its recent messages and a note on your account for review, also after you delete the chat; the copy of the messages is deleted when your account is deleted.
Chat photos and voice notes: The files of photos and voice notes created in your chats are deleted automatically 24 hours after they are created. The message stays in the chat and is shown as expired.
Approved photos and videos: Within those 24 hours we may review the AI photos and videos created in chats and keep the good ones, with a short AI-written description of what the photo shows or how she moves, in a library of that character's photos and videos. For a video made with a wish, neither the wish nor the motion is kept, only the fact that a wish was used. Kept photos and videos have no time limit, stay after the chat or the account is deleted, and may be sent to other users. They are made by AI and contain none of your messages or account details, and we don't keep photos or videos that show anything personal. Photos and videos from accounts flagged under our rules on minors or age (see sections 3 and 4 of the Terms) are never kept. We also record which library photos and videos your account has received, so that you never get the same one twice; this record is deleted with your account.
Videos: Videos you make, and the copy of the chat photo used to make them, are deleted automatically 24 hours after they are created.
AI providers: To write a reply or create a photo, recent messages of the chat are sent to our AI infrastructure providers. A voice note is made from the character's reply, and a video from the chat photo and the video options you choose. Copies held by the providers are subject to their own retention rules.
Usage records: Records such as the time of a request, the characters you chat with and the credits used contain no chat messages, photos or videos. They stay when you delete a chat (for example, so that a character doesn't send you her first photos again) and are kept while your account exists. If an automatic safety check blocks a message, we keep a short note of why, not the message itself (except for hidden chats, see above).
Abuse-prevention data: The device identifier hash and the IP address hash described above are deleted automatically after 30 days. The IP address hash of a crypto order is deleted automatically after 24 hours.
Language, time zone and country: kept with your account and updated when they change.
Prices and 10-minute bonus: the price group your account is in (it decides the prices you see and pay) and the time you first opened the buy screen (it starts the one-time 10-minute bonus timer), kept with your account.
Telegram notifications: your Telegram chat ID is kept until you disconnect, send /stop to the bot or block it.
Instagram messages: their text isn't stored; the hash of your Instagram ID is deleted automatically after 2 days.
Messages while you're away: the records of when they were sent and opened are deleted after 180 days. The messages themselves are part of your chat (see "Chat messages" above).
Account and payments: Your account details are kept until your account is deleted. Payment records are kept for the legally required period.

Deleting your account

You can delete your account yourself under "My account" → "Delete account". For your safety we ask you to type your email and, if you signed in a while ago, to sign in again.

Right away: your account is closed and you are signed out. It can't be used, receives no messages from the characters, and any open crypto order and Telegram notification link are removed.
30 days to change your mind: if you sign in within 30 days, you can restore your account with everything in it, including your credits.
After 30 days: your chats, photos, voice notes, videos, settings, usage and abuse-prevention records are deleted, your email, name, Telegram details and invite code are removed from the account, and your sign-in is deleted. Any credits left are lost and are not refunded. This can't be undone.
What we keep, and why: payment records (including the Telegram payment and account IDs and, for crypto, the transaction) for accounting, tax and refunds; your credit history and the records of any ban, without your name or email; for safety, the fact that a chat was hidden under our rules on minors or age (see sections 3 and 4 of the Terms) and why, but not the messages; and approved AI photos and videos in the library, which contain nothing about you.
Email fingerprint: we keep a keyed hash of your email address (a code made with a secret key, from which the email can't be read back). If a new account is opened with the same email, it gets no free messages; if your account was banned, the ban applies to the new account too, and if it was flagged under our rules on minors or age, the flag applies to the new account too.

Google user data

When you sign in with Google, we receive only your name, email address and profile picture (the openid, email and profile scopes). We use this information only to create your account, confirm that it is you signing in, and contact you about support requests.

We do not sell data received from Google, use it for advertising, or use it to train AI models.
This data is not shared with anyone other than the service providers listed above.
It is stored with our cloud infrastructure provider and deleted 30 days after you delete your account (see "Deleting your account"; only a keyed hash of the email is kept).
You can revoke the site's access at any time at myaccount.google.com/permissions.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and browser storage

The site sets one cookie of its own (a random device identifier, to prevent abuse of free trials). It keeps a few small items in your browser's storage so that it works, and it loads Google Analytics, which sets two cookies. We don't show ads and don't use advertising cookies. Everything is listed below.

Cookie set by our site

Cookie	What it is for	How long
`device_id`	A random identifier for this browser, used only to prevent abuse of free trials (opening many accounts to get the free allowance again). We store only a hash of it, see "Data we collect".	1 year

Cookies: Google Analytics

Google Analytics (from Google, a third party) is on by default. Its cookies are set on our own domain by Google's script.

Cookie	What it is for	How long
`_ga`	Gives your browser a random ID so Google Analytics can tell visitors apart and count visits and pages.	2 years (renewed on each visit)
`_ga_8MBV47G6FE`	Keeps the state of your current visit (session) for Google Analytics.	2 years (renewed on each visit)

What Google Analytics receives: the pages you open and what you do on the site (for example opening a chat, unlocking a photo or buying credits), the page address, your browser and device details, your approximate location from your IP address and, when you are signed in, a random account ID. Your chat messages are never sent. Which scenario or role you pick is sent only as a meaningless code, not its name. Google processes this data for us under its terms, see how Google uses data from sites that use its services. Data stays in Google Analytics for the retention period set in our account, at most 14 months.

Stored in your browser (local storage)

Name	What it is for	How long
`age_ok`	Remembers that you confirmed you are 18 or older, so the age screen doesn't come back.	Until you clear your browser data
`sb-…-auth-token`	Keeps you signed in (your sign-in session, set when you sign in with Google).	Until you sign out or clear your browser data
`lang`	Remembers the language you chose.	Until you clear your browser data
`ref_code`	Remembers the invite code of an invite link you opened until your account uses it.	Until it is used or you clear your browser data
`first_touch`	Remembers the kind of page you first opened (not its address), its language and when, and the marketing link (campaign tags) or website you first came from, so they can be saved with your account when you sign up. Not set if you switched analytics off.	30 days
`device_id`	The same random identifier as the cookie above, kept here too so it survives if one of them is cleared.	Until you clear your browser data
`price_group`	The price group (1, 2 or 3) this browser was put in at random on its first visit. We test a few price levels, and the group decides which prices you are shown; once you sign in, your account's group is used and saved here instead. It is not linked to who you are, and it is kept even if you switch analytics off, because the site needs it to show you the prices you will actually pay.	Until you clear your browser data
`tg_card_at`	Remembers when you closed the "Get her messages on Telegram" card in a chat with "Not now", so it doesn't come back for 7 days.	Until you clear your browser data
`ref_banner_off`	Remembers that you hid the "Invite a friend" banner on the chat list, so it doesn't come back.	Until you clear your browser data
`analytics_off`	Your Cookie settings choice. It exists only if you switched analytics off.	Until you switch analytics back on or clear your browser data
`ga_opt_out`	Set only on devices used by the site's administrators, to leave their own visits out of analytics.	Until the browser data is cleared

While you are signed in, the browser's session storage also holds ga_login_…, which only marks that this sign-in was already counted by analytics so it isn't counted twice. While you sign in with Google, it briefly holds google_login (random security codes that check the answer really comes from the sign-in you started, removed as soon as you return) and google_login_result (whether the sign-in worked, read once for analytics and removed). All of these are removed when you close the tab.

Switching analytics off

Open Настройки cookie (the link at the bottom of every page and on the age screen) and switch off "Analytics (Google Analytics)". We then stop sending data to Google right away, delete the _ga cookies, and on your next visits don't load Google Analytics at all. Your choice is saved in this browser only (analytics_off), so it must be repeated in other browsers and after clearing your browser data. Data sent before you switched it off stays in Google Analytics for the retention period above. You can also block Google Analytics in your browser settings or with Google's opt-out add-on.

Other services your browser contacts

Google sign-in: when you sign in, you use Google's own page, and Google sets its own cookies there under its own policy.
Telegram: if you connect Telegram notifications, a Telegram link (t.me) opens, and Telegram processes it under its own policy.

Age limit

The Service is only for adults and is not intended for anyone under 18. We don't knowingly collect data from anyone under 18, and accounts that we believe belong to someone under 18 may be closed.

Your rights

Depending on where you live (for example Türkiye under the KVKK, the EU or UK under the GDPR, or certain U.S. states such as California), you may have the right to know whether your data is processed, to get a copy, to have it corrected or deleted, to object to processing, and to withdraw consent. For requests: [email protected]. We respond within 30 days.