ReppoChat Privacy Policy
Last updated: June 18, 2026
Effective date: June 18, 2026
kukuDev ("Operator") values the privacy of users of the ReppoChat mobile application ("App" or "Service") and the privacy of their conversations. This Privacy Policy explains what information is stored on the user's device and what information may be transmitted or processed for service operation or by third-party service providers.
1. Core Principles
- The Operator does not transmit conversation text, prompts, AI responses, detailed persona settings, or memory slot contents to the Operator's servers or to external AI APIs.
- After the model file is downloaded, AI response generation and recognition of photos attached to chats are performed on the user's device.
- Conversation history, personas, relationship state, long-term memory, and search indexes are stored in an encrypted local database on the user's device.
- Information transmitted to servers is limited to metadata necessary for service operation, such as model downloads, ads, purchase verification, error analysis, report processing, security, and abuse prevention.
- The Service currently does not require a separate membership sign-up or login account. Platform features such as Google Play purchases, AdMob ads, and Firebase App Check may be connected to each provider's account and device systems.
2. Information Processed and Purposes
2.1 Information Stored Only on the Device
The following information is generally stored on the user's device and is not transmitted to the Operator's servers or to external AI APIs.
| Category | Processed Items | Storage Location | Purpose | Retention |
|---|---|---|---|---|
| Policy consent information | Agreement to the Terms of Service, agreement to the Privacy Policy, confirmation that the user is 16 or older, accepted policy version | SharedPreferences | Confirm onboarding completion and determine whether re-consent is required | Until app data is deleted or policy re-consent is required |
| Persona information | Name, age, gender, occupation, appearance, personality tags, MBTI axis values, speech style, likes, dislikes, background narrative, avatar image path | SQLCipher local DB and app-specific file area | Create AI characters, assemble chat prompts, display the friends list | Until deleted by the user or app data is deleted |
| User relationship settings | User gender, user age range, persona's role toward the user, user's role toward the persona, initial intimacy | SQLCipher local DB | Maintain how the persona addresses and relates to the user | Until persona deletion, relationship reset, or app data deletion |
| Conversation information | User messages, AI responses, message creation time, chat room, FTS search index | SQLCipher local DB | Display conversations, assemble recent conversation context, enable local search | Until message, chat room, persona, or app data deletion |
| Chat attachment images | Image files created by re-encoding photos attached by the user as an original-aspect-ratio PNG (EXIF removed), and the image path associated with the message | App-specific file area and SQLCipher local DB | Show photos in chat and perform on-device vision recognition | Until message, chat room, persona, or app data deletion |
| Memory information | Long-term memory slots, important facts, preferences, key events, promises, emotional state, pinned state, salience score | SQLCipher local DB | Relationship progression, long-term-memory-based responses, memory management screen | Until memory deletion, relationship reset, persona deletion, or app data deletion |
| App lock information | PIN hash, biometric authentication setting, PIN failure count, retry cooldown time | Device secure storage | App lock, PIN verification, short retry delay after repeated failures (up to 30 seconds, not permanent lockout) | Until the user removes the app lock setting or app data is deleted |
| Local ad-removal state | Whether ad removal is active, copy of purchase token | Device secure storage | Maintain purchase state and hide ads on restart | Until purchase state or app data is deleted |
| Model files and runtime settings | Model file, model ID, SHA-256, file size verification marker, active model, per-model CPU/GPU settings | App-specific file area and SharedPreferences | Offline AI inference, model integrity verification, local runtime setting persistence | Until the user deletes model files or app data |
| Local report queue | Target message ID, target persona ID, report reason, status, report time | SQLCipher local DB | Offline report queue, retry, report rate limiting | Until transmission completion, expiry processing, or app data deletion |
| Backup files | Encrypted .reppo files containing personas, relationship states, chat sessions, messages, memory slots, avatar images, and chat attachment image data | Location selected by the user for sharing or storage | Data transfer, archiving, restoration | Until the user deletes the backup file |
2.2 Information That May Be Transmitted to Servers or Third-Party Services
The following information may be transmitted to the Operator's server-side functions or third-party services to the extent necessary to operate the Service.
| Category | Transmitted Items | Recipient | Purpose | Retention |
|---|---|---|---|---|
| Model download configuration | App version, Firebase Remote Config request information, model ID, model filename, model size, SHA-256, and other information needed to retrieve configuration values | Firebase Remote Config | Check currently available models, check whether downloads are enabled, determine forced updates | According to Firebase settings and log policies |
| Model URL request | Firebase App Check token, app install hash, requested model ID, request IP, and other HTTP metadata | Cloudflare Worker, Firebase App Check | Verify genuine app requests, issue presigned URLs, prevent download abuse, rate limit | For the period necessary for abuse prevention and log retention |
| Model file download | Presigned URL request, downloaded bytes, IP address, and other network metadata | Cloudflare R2 | Provide model files | According to Cloudflare log and security policies |
| Report information | Target message ID, target persona ID, report reason, creation time | Firebase Cloud Functions, Firestore | Receive reports of inappropriate responses, improve safety policy, prevent abuse | Operated under a policy of deletion after up to 90 days |
| Purchase verification | Google Play product ID, purchase token, order ID, purchase verification result, verification time | Firebase Cloud Functions, Google Play Developer API, Firestore | Verify ad-removal purchases, prevent duplicate token use, restore purchases | For the period necessary to maintain and restore purchase rights and comply with legal retention obligations |
| Advertising information | Advertising ID, device information, ad request, impression, click, and other ad interaction information | Google AdMob | Serve ads, prevent invalid traffic, measure ad performance | According to Google AdMob policies |
| Error and crash information | App version, OS version, device state, stack trace, error type, model download failure type, device integrity state | Firebase Crashlytics | Analyze errors, improve stability, understand abnormal device environments | According to Firebase Crashlytics settings and retention policies |
| App integrity information | Firebase App Check token, Play Integrity related verification information | Firebase App Check | Prevent abnormal app or automated requests, protect Cloud Functions and Worker endpoints | According to Firebase policies |
The Operator does not intentionally collect conversation text, prompts, AI responses, detailed persona settings, or memory slot contents during report processing, error analysis, model download, or purchase verification. Photos attached to chats are stored and recognized only on the device and are not transmitted to the Operator's servers or to third parties through any path, including reports.
3. Information Not Collected
In the current structure of the Service, the Operator does not directly collect the following information.
- Email addresses, passwords, phone numbers, or addresses for membership sign-up
- Real-name verification information, resident registration numbers, passport numbers, or driver's license numbers
- Raw payment instrument information such as credit card numbers or bank account numbers
- Server-side copies of conversation text, prompts, AI responses, detailed persona settings, or memory slot contents
- Contacts, address books, SMS, or call records
- GPS-based precise location information
- Raw biometric authentication data
- Server-side collection of photos or images. Avatar images use images selected from the gallery, and chat attachment photos use images either selected from the gallery or captured with the system camera app; in all cases they are re-encoded into app-specific storage, and chat attachment photo recognition is performed only on the device and is not transmitted to servers.
Information processed by third-party services such as Google Play, Google AdMob, Firebase, and Cloudflare under their own policies is also subject to the policies of those providers.
4. Local Data Processing
- The App uses a local database named
reppochat.db, and the database key is stored in device secure storage. - Conversations, personas, relationship states, memory slots, report queues, and search indexes are stored in a SQLCipher-based encrypted DB.
- Persona avatar images are stored in the app-specific file area. The App re-encodes images as JPEG so that EXIF and similar metadata are not retained. Photos attached to chats are also re-encoded as an original-aspect-ratio PNG in the same privacy-preserving manner, EXIF and similar metadata are removed, and photo recognition is performed only on the device.
- When the user deletes a message, the message is deleted from the local DB and any photo file attached to that message is also deleted.
- When the user deletes a chat room, the relevant chat session, messages, and attached photo files are deleted, and the relationship state and memory slots for the relevant persona are reset.
- When the user deletes a persona, the persona, relationship state, chat sessions, messages, memory slots, avatar file, and chat attachment photo files are deleted together.
- When the user resets a relationship, the relationship state and memory slots are reset and existing messages are excluded from later AI context.
- If the App is deleted, app data is deleted, the device is reset, the device is lost, or the backup password is lost, the Operator cannot recover local data.
5. Backup File Processing
- The App provides export and import features for backup files with the
.reppoextension. - Backup files may include personas, relationship states, chat sessions, messages, memory slots, avatar images, and chat attachment image data.
- Report logs are not included in backup files.
- Backup files apply PBKDF2-HMAC-SHA256 key derivation and AES-256-GCM encryption based on the backup password entered by the user.
- The Operator does not store backup passwords and does not upload backup file contents to servers.
- If the user stores or transmits a backup file through an external app, cloud service, messenger, email, or file sharing feature, security and deletion at that location are the user's responsibility.
6. Report Processing
- Users may use the in-app report feature if they determine that an AI response is inappropriate.
- Information transmitted when reporting is limited to the target message ID, target persona ID, report reason, creation time, and platform information.
- The report feature does not transmit message text, prompts, raw AI responses, detailed persona settings, memory slots, or raw device identifiers.
- Report reasons are limited to selecting from categories defined in the App, such as inappropriate content, violence, sexual expression, self-harm, and other.
- If there is no network connection or server transmission fails, reports may be stored in a local queue and retried.
- To prevent report abuse, the App limits the number of reports per minute, hour, day, week, and month.
7. Purchase and Ad-Removal Processing
- The ad-removal product is provided through Google Play in-app billing.
- The Operator does not directly collect or store raw payment instrument information, card numbers, or bank account numbers. Google Play handles payment processing.
- To verify ad-removal purchases, the App transmits the product ID and Google Play purchase token to Firebase Cloud Functions.
- Cloud Functions verifies the validity of purchases through the Google Play Developer API and may record the purchase token, product ID, order ID, and verification time in Firestore to prevent duplicate token use.
- When purchase verification succeeds, the App may store the ad-removal state and a copy of the purchase token in device secure storage.
- Google Play purchase history and server verification information may be used to restore purchases on a new device or after reinstalling the App.
- Refunds, payment cancellations, payment failures, payment instrument errors, and receipt verification failures follow Google Play policies and applicable laws.
8. Advertising Processing
- Google AdMob ads may be displayed to free users.
- Google AdMob may process advertising ID, device information, IP address, app information, and ad interaction information to serve ads, prevent invalid traffic, control ad frequency, and measure ad performance.
- Users may manage ad personalization and advertising ID reset through device settings or Google ad settings.
- If the user purchases the ad-removal product, the App hides ad containers or stops ad requests.
- The App does not transmit conversation text, prompts, AI responses, detailed persona settings, or memory slot contents to the Operator's servers for ad targeting purposes.
9. Error Analysis and Security
- The App may use Firebase Crashlytics to improve stability.
- Crashlytics may record app version, OS version, device state, stack trace, error type, model download failure type, device integrity state, and similar information.
- The Operator designs the App so that Crashlytics does not record conversation text, prompts, AI responses, detailed persona settings, or memory slot contents.
- The App may detect abnormal device environments such as rooting or emulators. Under the current policy, detection results are used for stability and security analysis rather than blocking users.
- The App may use Firebase App Check and Cloudflare Worker rate limits to restrict abnormal apps, automated requests, and model download abuse.
10. Android Permissions
The App does not directly request sensitive runtime permissions such as contacts, microphone, precise location, or notifications for its core features. Avatar images are processed from files selected by the user through the gallery image selection feature (system photo picker), and chat attachment photos are processed from files the user selects through the system photo picker or captures through the system camera app. Camera capture is delegated to an external camera app, so the App does not declare the camera permission directly, and photo selection likewise does not require separate storage access permission.
Certain standard permissions for network communication, advertising, and biometric authentication may be declared by third-party SDKs (such as Firebase, Google AdMob, and biometric modules) to support model downloads, advertising, and app lock features. In such cases, they are subject to the third-party processing scope described in Article 11 of this Policy.
11. Third-Party Provision and Processing
The following third-party services are used in providing the Service.
| Provider | Services Used | Purpose | Main Processed Information |
|---|---|---|---|
| Google/Firebase | App Check, Remote Config, Cloud Functions, Firestore, Crashlytics | App integrity verification, model configuration, report receipt, purchase verification functions, error analysis | App Check tokens, report metadata, purchase tokens, error information |
| Google Play | In-app billing, purchase restoration, purchase verification API | Ad-removal payment processing and restoration | Purchase tokens, product IDs, order information |
| Google AdMob | Mobile advertising | Ad serving, invalid traffic prevention, ad performance measurement | Advertising ID, device and ad interaction information |
| Cloudflare | Workers, R2 | Model file presigned URL issuance, model file download, rate limiting | App Check verification result, install hash, model ID, IP and other network metadata |
| Operating system and device manufacturers | Secure storage, biometric authentication, local files, sharing features | PIN storage, biometric authentication invocation, backup sharing, local file processing | Device-internal secure storage values, biometric authentication result, file paths |
The Operator does not provide conversation text, prompts, AI responses, detailed persona settings, or memory slot contents to these third-party services.
12. International Transfers
Third-party services such as Firebase, Google Play, Google AdMob, and Cloudflare may process information on servers and infrastructure outside the Republic of Korea. Accordingly, model download metadata, report metadata, purchase verification information, advertising information, and error information may be processed on servers operated by Google or Cloudflare in other countries. Each provider's privacy policy and service terms apply to international transfers, security, and retention by that provider.
13. Retention and Deletion
- Local data is stored on the device until the user deletes it or deletes app data.
- Personas, messages, chat rooms, memory slots, and relationship states may be deleted or reset through in-app deletion or reset features.
.reppobackup files remain at the location where the user saved them. Deleting data inside the App does not delete backup files located in external storage locations.- Report metadata is operated under a policy of retention for up to 90 days for policy improvement and response, followed by deletion.
- Purchase verification information may be retained for the period necessary to maintain ad-removal rights, restore purchases, prevent duplicate token use, respond to payment disputes, and comply with legal obligations.
- Crashlytics error information, AdMob advertising information, Firebase App Check and Remote Config information, and Cloudflare logs are retained according to each third-party service's retention policies and the Operator's settings.
- Information that must be retained under applicable law is retained for the period required by that law and then deleted.
14. User Rights and How to Exercise Them
- Users can directly manage personas, messages, chat rooms, memory slots, model files, app lock settings, and backup files through in-app features.
- Users can delete local data by deleting the App or using the OS app data deletion feature.
- Users can manage advertising ID reset, ad personalization restrictions, notification permissions, and app permissions in device settings.
- Requests to access, correct, or delete report metadata, purchase verification information, or error information transmitted to servers may be submitted by email. The Operator will process requests after verifying identity and whether legal retention is required.
- Purchase entitlement confirmation or refunds are handled according to Google Play account and payment policies.
- If the user loses the backup password, the Operator cannot decrypt or recover the backup file.
15. Children's Personal Information
- The Service is not directed to children under the age of 16.
- Users under the age of 16 may not use the Service, and guardians should manage the device and app installation state so that children do not use the App.
- If the Operator confirms that server-transmitted metadata of a child under 16 has been processed, the Operator will take deletion measures within a reasonable scope, except where retention is required by law.
16. Guidance for Safe Use
- Setting an app PIN and device lock can reduce the risk of others viewing the App on the device.
- The
.reppobackup password should be different from passwords used for other services and should be managed so it is not lost. - If a backup file is shared through cloud services or messengers, the user should check the security settings of that service.
- Users should not enter another person's personal information, sensitive information, payment information, address, contact information, or account information in conversations.
- AI responses do not replace professional counseling or emergency support. For risks involving self-harm or suicide, violence, medical issues, legal issues, financial issues, or similar matters, users should seek help from appropriate authorities or qualified professionals.
17. Changes to This Privacy Policy
- The Operator may revise this Privacy Policy due to changes in applicable laws, service features, third-party SDKs, model download infrastructure, advertising, or payment methods.
- If there are material changes, the Operator will provide notice through in-app notices, webpages, update notes, or other reasonable methods.
- Users who do not agree to the changed policy may stop using the Service and delete the App and local data.
18. Contact and Privacy Officer
Questions about personal information processing, report data, purchase verification data, error data, or this Policy may be submitted to the following contact.
- Operator: kukuDev
- Privacy Officer: O Jaeseok
- Business registration number: 390-68-00863
- Mail-order business report number: 2026-Incheon Yeonsu-gu-1196
- Address: 6F, Room 6649, 111 Yongdam-ro, Yeonsu-gu, Incheon, Republic of Korea
- Email: support@kukudev.com
If reporting or counseling is needed regarding personal information infringement, the following organizations may be used.
- KISA Privacy Infringement Report Center: privacy.kisa.or.kr / 118 without area code in Korea
- Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972