Privacy Policy
Effective: 2026-09-18 · Version 1.2
Sticky Rice (“we”) operates Hain, an AI companion app for adults. This policy explains what we collect, why, and the choices you have.
Hain is for adults only. Companion chatbots may not be suitable for some minors. You are talking to an AI, not a human being. Our companions are software. They cannot feel human emotion and cannot replace people. There is no account. We do not collect your email address, name, phone number, or date of birth.
1. Personal information we collect
Under the California Consumer Privacy Act, personal information falls into statutory categories. Here is what we collect, by category.
| CCPA category | What we actually collect |
|---|---|
| Identifiers | A random installation identifier (UUID) generated when you install the app. An anonymous RevenueCat customer identifier if you subscribe. |
| Commercial information | Subscription status, product purchased, renewal and expiration dates. |
| Internet or network activity | Reports you submit, consent records, records of when the AI disclosure was shown to you. |
| User content | The messages you write, photos you attach, the live audio of your voice during calls, and automatic transcripts of your completed speech. |
| Device integrity data | Apple App Attest key identifier, public key, receipt, and risk indicator. |
| Push notification data | Your device’s APNs notification token, its time zone and language setting, and your notification preferences (on/off, quiet hours) — only if you allow notifications. |
Categories we do NOT collect: your name, email address, postal address, phone number, date of birth, precise geolocation, contacts, biometric identifiers, browsing history on other sites, or education/employment records.
We do not store raw audio. During a voice call, the live audio and any interim transcription are never written to storage. Only the transcript of a completed utterance is encrypted and kept in your conversation history.
Not storing it is not the same as not sending it. During a call your device streams the audio directly to OpenAI in the United States. Section 4 says what OpenAI does with it and for how long.
2. Why we collect it
- To generate companion responses and maintain conversation context
- To provide real-time voice calls and meter call time
- To keep you safe — detecting expressions of suicide or self-harm and surfacing crisis resources, blocking prohibited content, and handling reports
- To meet legal disclosure duties, including the periodic notice that you are talking to an AI
- To prevent abuse through device integrity checks and usage limits
- To process subscriptions
We do not use your information for advertising, profiling for advertising, or automated decisions that produce legal effects about you.
3. We do not sell or share your personal information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not serve ads. We disclose conversation content only to the providers listed in Section 4, and only so that they can run the service for us — none of them may use it for their own purposes.
4. Service providers and international transfer
We are based in South Korea. Your information is processed in the United States and South Korea.
OpenAI
| Who | OpenAI, L.L.C. (United States) — privacy@openai.com |
| What we send | Conversation context (up to the most recent 100 turns), the companion’s persona instructions, photos you attach, the live audio of your voice during calls, text submitted for safety classification, and a hashed identifier |
| What we do NOT send | Your raw installation identifier. The identifier we send is irreversibly hashed. |
| Why | Generating responses, real-time voice, automatic transcription, and safety classification |
| Training | OpenAI does not use data sent through its API to train its models. |
| Retention | Up to 30 days for abuse monitoring, then deleted |
RevenueCat
| Who | RevenueCat, Inc. (United States) |
| What we send | Anonymous customer identifier, product identifier, subscription status and dates, and your device’s vendor identifier (IDFV — not an advertising identifier) |
| Why | Confirming your subscription and unlocking access |
| Retention | As long as needed to manage your subscription, under RevenueCat’s own retention policy |
Supabase
Database storage and server functions. Conversation content is encrypted before it is stored.
4.3 Apple (push notifications)
| Who | Apple Inc. (United States) |
| What we send | Your device’s notification token and the notification text, which is only a diamond balance indicator (💎(5/10) or 💎(10/10)) |
| Why | To deliver the notification through the Apple Push Notification service |
| When | When your free diamonds reach 5 or 10 |
| Retention | Apple holds it briefly for delivery. We do not store the notification text |
| Opting out | Turn off “Push notifications” in the app’s settings or deny notifications in iPhone Settings. You lose only the notification; nothing else changes |
Notifications never contain conversation content or a companion’s name.
5. How long we keep it
| Data | Retention |
|---|---|
| Conversations and voice transcripts | Until you delete them or request device data deletion |
| Long-term memories | Capped at 100 entries. The oldest are deleted automatically beyond that. |
| Consent records | Until deletion, to evidence that consent was given |
| AI disclosure records | Until deletion, to evidence the statutory notice was shown |
| Reports | Until you delete them or request device data deletion |
| De-identified audit records | Retained without any identifier tying them to you |
Deleting conversations does not delete AI disclosure records. Those records exist to prove we met the notice schedule required by law. If they were erased, the timer would reset and you would stop receiving a notice you are entitled to.
6. Your rights
Depending on where you live, you may have the right to:
- Know and access the personal information we hold about you
- Delete it
- Correct inaccurate information
- Opt out of sale or sharing — we do neither, so there is nothing to opt out of
- Not be discriminated against for exercising any of these rights
How to exercise them. You can read and delete your data directly in the app: Settings → Delete conversation content, or Settings → Request device data deletion. For anything else, contact us at /en/support/ or contact@stickyrice.kr.
Authorized agents may submit requests on your behalf with proof of authorization.
7. Deleting your data
Delete conversation content — takes effect immediately. Removes your messages, attached photos, and long-term memories.
Request device data deletion — all data for that installation is destroyed 30 days after the request. The delay exists so an accidental request can be reversed.
Cancelling your subscription is a separate step. Deleting your data does not cancel your App Store subscription. Cancel it in iOS Settings → your Apple Account → Subscriptions.
8. Age
Hain is for adults only. We do not knowingly permit anyone under 18 to use the service, and we do not knowingly collect personal information from children under 13. If we learn that a minor has used the service, we will delete the associated data.
Companion chatbots may not be suitable for some minors.
9. Voice calls and transcripts
We do not store raw audio, though your device does stream it to OpenAI during the call (Section 4). Only the transcript of a completed utterance is encrypted and kept in your conversation history. Automatic transcription can be inaccurate, and you should take care that other people’s voices are not captured. We show you this notice before your first call and store transcripts only if you agree.
10. AI disclosure and safety
You are talking to an AI. We tell you this when a conversation begins and at least every three hours of continued use, as required by New York General Business Law §1701.
If you express thoughts of suicide or self-harm, we do not cut off the conversation. We replace the companion’s reply with crisis guidance that includes emergency numbers (911 and 988 in the United States) and states plainly that the companion is an AI and cannot send help. Our full safety protocol is published at /en/safety, as required by California Business & Professions Code §22602(b)(2).
You can report any companion response from within the app. Safety reviewers see only the reported response and its immediate context.
11. Security
Conversations, voice transcripts, long-term memories, and report contents are encrypted with AES-GCM before storage. Database row-level security prevents access across users. Apple App Attest verifies that requests come from a genuine copy of our app. We do not write conversation content, transcripts, or credentials to server logs.
12. Changes to this policy
If we change this policy we will post the new version here and notify you in the app at least 7 days before it takes effect. Changes that materially affect your rights require your consent again. We record which version you agreed to.
- v1.2 (2026-09-18) — added push notification data (§1) and the Apple Push Notification service transfer (§4.3)
- v1.1 (2026-09-14) — named the live call audio and the RevenueCat device identifier in the transfer lists
- v1.0 (2026-09-08) — initial version
13. Contact
Sticky Rice — Korean business registration 456-40-01436 — contact@stickyrice.kr — /en/support/