← Back to Fantasy

Legal

Privacy Policy

Effective date: 2026-05-27

1. Who we are

Fantasy (“we”, “us”) operates the AI-chat workspace available at the domain on which you are reading this page. We act as the data controller for personal data processed in connection with your account and your conversation history. Contact: [email protected].

2. Data we collect

  • Account data. Email address, optional display name and avatar, and (for password-based accounts) a hashed password. For OAuth sign-in (Google, GitHub), we receive the provider's unique identifier and your email.
  • Conversation content. Prompts you submit, attachments you upload, and the responses generated by your selected model. Both your messages and the model's responses are encrypted at rest in our database using AES-256-GCM. Conversation titles, which are derived from your first prompt, are also encrypted.
  • Image-generation prompts. When you use the Pro image generation feature, the prompt and any generated image are stored under the same encryption-at-rest regime.
  • Billing data. If you subscribe to Pro, we receive a transaction reference and payment status from PayPal or NOWPayments. We do not see or store your card number, bank details, or crypto wallet seed.
  • Technical data. IP address, browser user-agent, timestamps, and basic request metadata used for security, rate-limiting, and abuse prevention.
  • Analytics. Aggregated, non-identifying usage statistics collected by Vercel Analytics and Vercel Speed Insights. We do not run third-party advertising or behavioural tracking pixels.

3. What we do with your conversations

Conversation content is encrypted before it touches our database and decrypted in process memory only at two moments:

  1. when we render the conversation back to you, the authenticated owner;
  2. when we transmit your latest prompt to the upstream model provider you selected (see Section 4).

We do not use your prompts or responses to train models, fine-tune systems, or improve the Service in any way that would require reading individual conversations. We do not sell, rent, or share your conversations with advertisers or data brokers.

4. Third-party model providers

Fantasy is a routing layer in front of one or more large-language-model providers. The provider you select for a given prompt receives that prompt in plaintext — by necessity, since the model needs the text to generate a response. The current set of upstream providers includes (without limitation):

  • OpenAI (ChatGPT family)
  • Anthropic (Claude family)
  • Google (Gemini, Gemma)
  • xAI (Grok)
  • DeepSeek
  • OpenRouter (as an aggregator routing to the above and others)
  • Self-hosted models accessed via Ollama, vLLM, or OpenWebUI

Each of these providers has its own privacy policy. Where commercially available, we have configured upstream API keys with the “do not train on my data” option enabled. You can verify each provider's commitment by reading their respective privacy or API terms pages.

5. Cookies

We use a single first-party authentication cookie to keep you signed in. This cookie is strictly necessary for the Service to work and does not require consent under the ePrivacy Directive. We do not set advertising or cross-site tracking cookies.

6. Retention

Conversation content is retained for as long as your account exists, so that you can resume past sessions. You can delete individual conversations at any time from the chat sidebar; deletion is immediate and permanent (no soft-delete or recoverable archive). Account closure (Section 8) deletes all conversation content within 30 days.

Billing records are retained for the duration required by applicable accounting and tax law (typically 7 to 10 years in France).

7. Your rights

Under the EU General Data Protection Regulation (GDPR) and equivalent laws elsewhere, you have the right to:

  • access the personal data we hold about you;
  • rectify inaccurate data;
  • erase your data (“right to be forgotten”) — see Section 8;
  • restrict or object to processing in certain circumstances;
  • data portability (receive your data in a machine-readable format);
  • lodge a complaint with your national data-protection authority (in France: the CNIL).

To exercise any of these rights, contact [email protected].

8. Account deletion

You can permanently delete your account from the Account page. Deletion triggers a hard delete of your conversations, image generations, API keys, OAuth links, and notification preferences. Billing records are retained as required by tax law, in pseudonymised form (the user identifier is replaced by an opaque token, and the email is removed).

9. Security

All conversation content and titles are encrypted at rest with AES-256-GCM. All connections to the Service use HTTPS. We enforce HSTS, X-Frame-Options, Content-Type sniffing protection, and a restrictive Referrer-Policy. Passwords are stored as Argon2 / bcrypt hashes (never in plaintext). API keys you create in our Service are stored encrypted as well.

No system is 100% secure. If we discover a breach affecting your personal data, we will notify the relevant supervisory authority and affected users within 72 hours as required by GDPR.

10. International transfers

Some of our upstream model providers and infrastructure subprocessors (notably Vercel for hosting) are based in the United States. Where personal data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses or equivalent safeguards approved by the European Commission.

11. Children

The Service is not intended for children under 16. We do not knowingly collect data from anyone in that age range. If you believe a minor has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this policy. Material changes (new categories of data, new subprocessors, expanded retention) will be announced in-app or by email at least 14 days before they take effect.

13. Contact

For privacy questions, exercise of rights, or breach reports, contact [email protected].