Last updated 14 August 2026. This explains what Thalvix stores about you, why, and what you can ask us to do with it.
Your conversations never leave our own servers. Thalvix does not send anything you write to OpenAI, Anthropic, Google or any other AI company — the language model and the image generator both run on hardware we own, in the Netherlands. We ask for a username and a password. We do not ask for your email address, your real name or your phone number. Your messages are encrypted where they are stored.
Jeffrey Dittmar
3731 S. Glenstone Ave. #A7
Springfield, MO 65804
United States
is the controller for the personal data described in this notice. For any question about it, or to exercise any of the rights set out below, write to [email protected].
This service is operated from the Netherlands and processing is governed by Netherlands law and the GDPR. Where the Netherlands has an arrangement with another country that provides otherwise, that arrangement applies for people in that country.
Some rules — the minimum age to use a companion, and whether adult content is available at all — are set by the country you tell us you are in, not by Netherlands law. Those are applied per country.
| Data | Why | Lawful basis |
|---|---|---|
| Username and password hash | To create your account and log you in | Contract |
| Passkey credentials, if you use one | To let you sign in without a password | Contract |
| Your date of birth and country | To work out which country’s age rules apply to you, so we can offer you the service where your local law allows | Legal obligation |
| Your messages and your companions' replies | To provide the conversation and keep your history | Contract |
| Images generated for you | To show them in the conversation | Contract |
| Memory facts and summaries drawn from your conversations | So a companion remembers earlier conversations | Contract |
| An inferred emotional tone for the conversation | So replies match the mood of the conversation | Contract |
| Server access logs, including your IP address | Security, abuse prevention and diagnosing faults | Legitimate interests |
Your date of birth and country. We ask for these when you register, and we keep them. The minimum age for a service like this is not the same everywhere — it is set by the law of the country you are in, not by us. Your country tells us which rule applies, and your date of birth tells us whether you meet it. Together they let us offer you the service wherever your local law allows, instead of applying one blanket restriction to everyone.
We rely on legal obligation for this, because verifying age is something the law requires of us rather than something you can choose to opt out of. It follows that we cannot delete your date of birth while your account is open, and that we may refuse or limit access if the rules where you are require it. Your date of birth is not used to personalise companions, to target anything at you, or for any purpose other than the one described here. It is self-declared: we do not ask for identity documents, and we do not keep any.
Intimate and adult content. If you use a companion configured for romantic or intimate conversation, what you write may reveal things about your sex life or sexual orientation. Under the GDPR that is a special category of personal data, and we rely on your explicit consent, given when you choose to use such a companion. You can withdraw that consent at any time by stopping use of those companions and asking us to delete the conversations.
No AI provider. All model inference and image generation happens on our own hardware. Nothing you write is sent to a third-party AI service.
Cloudflare sits in front of this site as a proxy and security layer, so it processes connection data (including your IP address) on our behalf in order to deliver the site.
We never sell your data. Not to advertisers, not to data brokers, not to anyone. We do not rent it, trade it, or exchange it for services, and we do not use it for advertising or profiling. This is not a promise limited to the word “sell”: no one outside the parties named above receives your personal data at all, unless the law obliges us to hand it over.
And we collect only what is needed to run the service. If a piece of data is not required for something on this site to work, we do not ask for it and we do not keep it. That is why there is no email address, no real name and no phone number on the list above.
We do not retain data beyond what is necessary to provide the service. Your account and its conversations are kept while the account exists, because that is what makes a companion remember you. We keep no separate archive, and nothing is retained for analytics or for training models.
If you ask us to delete your account:
Destruction is irreversible. We hold no backup that would let us restore your data afterwards, so we cannot recover it for you at any price. Export anything you want to keep first.
The narrow exception is Article 17(3): where we must keep something specific to meet a legal obligation, or to establish or defend a legal claim. That never covers your conversations.
Server access logs, which contain IP addresses, are kept for a short operational period for security and fault-finding, then discarded.
Conversation content is encrypted where it is stored, with a separate key per conversation. The servers holding it use full-disk encryption. Access is limited to the operator.
One deliberate exception: finished chapters. In Creative Writing, a chapter you have accepted is stored as ordinary text rather than encrypted. It is the manuscript — the thing the feature exists to hand back to you, and it leaves as a plain PDF the moment you export it. Encrypting the copy on our side would not change what that file is. Everything else in those conversations, including the messages that produced the chapter, is encrypted as described above.
Under the GDPR you can ask us to: give you a copy of your data; correct it; delete it; limit how we use it; give it to you in a portable format; and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time — that does not affect what we did before you withdrew it.
You can download a copy of everything we hold, and ask for your account to be deleted, from your account page. For anything else, contact us at the address above. We will respond within one month.
If you are unhappy with how we handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Thalvix generates replies, images, memory notes and an emotional-tone estimate automatically. None of this produces a decision with a legal or similarly significant effect on you.