Privacy Policy

Last updated: 2026-06-02

Overview

Firefly Friend is devoted to protecting your privacy and securing your personal information. This privacy statement applies when you use Firefly Friend or visit our website at https://fireflyfriend.com, wherever you are located, to inform you how your personal data is managed. It also covers your privacy rights and the legal protections available to you.

Firefly Friend is a personal AI companion. Because you talk to it about your day and your life, your conversations may include personal information you choose to share. Please read this notice carefully so you understand how that information is handled.

Objective of This Privacy Statement

Data protection laws require us to provide certain information about ourselves, how we handle personal data, the purposes for doing so, and your rights concerning your personal information. This Privacy Notice contains those details, which you should review in full.

Accounts and subscriptions are available only to people aged 18 or older (see "Children's Privacy").

Read this privacy notice together with any additional privacy or fair-processing notices we provide on specific occasions when we collect or handle your personal data. This notice supplements, but does not replace, those other notices.

Data Controller

Neontree, UAB (operating the Firefly Friend brand) acts as the controller responsible for the personal information collected through our website and application. For any questions about this privacy statement, including your legal rights, use the contact information below.

How to Reach Us

For any privacy request or question, email: [email protected].

Data subjects within the European Economic Area ("EEA") or the United Kingdom can lodge a complaint with their local data protection authority at any time (the UK's authority is the Information Commissioner's Office ("ICO") at www.ico.org.uk). We encourage you to contact us first so we can try to resolve your concern.

Policy and Responsibilities

This privacy statement is periodically reviewed. Last updated: 2026-10-06.

It is important that the personal data we hold about you is accurate and current. Please notify us if your information changes.

Information We Gather

Personal data means any information from which an individual can be identified. It does not include anonymized data.

We collect and process the following categories of personal data:

Identity Data — name, username, and date of birth.
Contact Data — email address and, where provided, phone number.
Financial / Transaction Data — subscription and payment records. Full card numbers are processed by our payment processor and are not stored by us.
Technical Data — IP address, device and browser type, identifiers, and similar data collected automatically (see "Cookies and Tracking Technologies").
Profile and Usage Data — your account settings, companion preferences, in-app activity, and how you use the Services.
Communications / Content Data — the text and voice messages you exchange with your AI companion, the AI-generated responses returned to you, and the details your companion remembers from them.
Marketing and Communications Data — your marketing preferences.
Waitlist Data — if you join our waitlist, your email address and the plan you selected, so we can contact you when a spot opens.
Special Categories of Personal Data — your conversations may reveal sensitive information you choose to share, such as information about your health or wellbeing. We treat this as a special category of personal data (see "Sensitive Information").

Aggregated or de-identified data (which does not directly identify you) may be used for statistical and analytical purposes. If we ever combine aggregated data with data that can identify you, we treat the combined data as personal data under this notice.

How We Use AI to Provide the Services

The core of the Services is conversation with your AI companion. To provide this:

Your messages are processed by automated systems and by third-party AI model providers that generate your companion's responses on our behalf, acting as our processors / service providers.
We store your conversations and the details your companion remembers, so it can keep context between sessions and provide your history and account features. You can ask us to delete them at any time.
We apply automated and, where necessary, human content-moderation review to your inputs and the generated outputs to enforce our Terms.
We do not use the content of your conversations to target advertising.

The legal basis for processing your Content Data, including any special-category data it reveals, is your explicit consent, which you provide when you agree to this notice and use the Services. You can withdraw consent at any time by contacting us or closing your account; withdrawal does not affect processing carried out before withdrawal and may prevent us from providing the Services.

Safety, Moderation, and Legal Reporting

To keep the Services safe and lawful, we monitor for, and act on, content that violates our Terms. Where we detect, or are required by law to report, serious illegal activity or a risk to someone's safety, we may preserve relevant records and report them to law enforcement, and may retain associated data for as long as necessary for these purposes. The legal basis for this processing is our legal obligations and our legitimate interests in operating a safe, lawful service.

Sensitive Information

Certain categories of personal data require greater protection. Because you can talk to your companion about anything, your conversations may reveal special-category data that you choose to share, most commonly data concerning your health or wellbeing.

Under the GDPR we must identify both a lawful basis under Article 6 and a condition under Article 9 to process special-category data. Our basis is your explicit consent. By agreeing to this notice and choosing to share such information in your conversations, you consent to our processing it as described here, only to provide the Services to you. You can avoid sharing such information, and you can ask us to delete your conversations at any time.

Collection Methods

We collect data through:

Direct interactions — account creation, forms, the waitlist, purchases, and your conversations with your companion.
Automated technologies — Technical and Usage Data collected via cookies, pixels, SDKs, and server-side tagging (see below).
Third parties — analytics providers, advertising platforms, and our payment processor.

Some of these third parties are located outside the EEA/UK, including in the United States (see "International Data Transfers").

Cookies and Tracking Technologies

We and our partners use cookies, pixels, software development kits (SDKs), local storage, and server-side tagging to operate the Services, remember your preferences, measure performance, and deliver and measure advertising. This includes:

Strictly necessary technologies required to run the Services and process payments.
Analytics technologies that help us understand product usage and improve the Services.
Advertising / measurement technologies, including advertising-platform pixels and server-side event forwarding, used to measure and optimize our advertising campaigns and to reach potential users.

Where required by law (including in the EEA and UK), we request your consent before placing non-essential cookies and similar technologies, and you can manage your choices through our cookie banner or your browser settings. In the United States, you can exercise choices over advertising-related tracking as described in "US State Privacy Rights," including via Global Privacy Control (GPC) signals where applicable.

Utilizing Your Information

We use your personal data only where the law allows, relying on the following bases:

Performance of a contract — to provide the Services, your account, and subscriptions.
Explicit consent — for processing special-category data you choose to share in conversations, and for certain marketing and non-essential tracking.
Legitimate interests — to secure, improve, and analyze the Services, and to prevent fraud and abuse, where not overridden by your rights.
Legal obligation — including safety reporting and record-keeping described above.

Marketing

We may use your Identity, Contact, and Usage Data to send you marketing communications about our products and offers. Where required, we rely on your consent; otherwise we rely on legitimate interests. You can opt out at any time using the unsubscribe mechanism in any message or by contacting us at [email protected]. We will not share your personal data with third parties for their own direct marketing without your consent.

Information Sharing

We may share your personal data with:

Service providers / processors acting on our instructions — including hosting, AI model providers, analytics, customer support, email/lifecycle providers, and our payment processor.
Advertising and measurement partners, to the extent described in "Cookies and Tracking Technologies" and "US State Privacy Rights."
Authorities and third parties where necessary to comply with law, enforce our Terms, respond to legal requests, prevent fraud or harm, or in connection with a corporate transaction (such as a merger, acquisition, or sale of assets).

We require processors to protect your data and to process it only as instructed.

International Data Transfers

We transfer personal data to recipients located outside the EEA and the UK, including in the United States, where some of our service providers (such as hosting, analytics, AI model, and payment providers) operate. Where we make such transfers, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism. You can contact us for more information about the safeguards in place.

Information Security

We apply technical and organizational measures to protect against unauthorized loss, misuse, or access to personal data, and restrict access to those with a legitimate business need. We maintain procedures for suspected data breaches and will notify you and applicable regulators where legally required.

Retention of Data

We retain personal data only as long as necessary for the purposes for which it was collected, including providing the Services and meeting legal, tax, accounting, and safety obligations. Content and account data are retained for the life of your account and for a reasonable period afterward, unless a longer period is required or permitted by law. Records related to safety or legal reporting may be retained as long as necessary for those purposes. You may request deletion as described below; anonymized data may be retained indefinitely.

Children's Privacy

Accounts and subscriptions are available only to people aged 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we will delete the account and associated data promptly. In the United States, consistent with the Children's Online Privacy Protection Act ("COPPA"), we do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us at [email protected].

Your Rights

Depending on where you live, you may have rights to: access your data; correct inaccurate data; request erasure; object to or restrict processing; data portability; and withdraw consent. To exercise these rights, contact us at [email protected] or use in-app features. We may need to verify your identity. We generally respond within one month (EEA/UK) or 45 days (US state laws), with extensions where permitted and with notice to you.

Access requests are generally free, though we may charge a reasonable fee for unfounded, repetitive, or excessive requests.

CAN-SPAM Compliance

All marketing and promotional emails comply with the CAN-SPAM Act. Each includes identification of the message as an advertisement where applicable, our valid contact address, and a clear opt-out mechanism. We honor opt-out requests promptly.

US State Privacy Rights

California Residents — CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the rights below.

Categories of personal information we collect:

Identifiers — name, email address, IP address, username, date of birth.
Commercial information — products/services purchased and transaction history.
Internet or network activity — interactions with the Services, device type, browser type.
Geolocation data — general location inferred from IP address.
Sensitive personal information — information about your health or wellbeing that you choose to share in conversations.

Sale / Sharing. We do not sell your personal information for money. However, our use of advertising and analytics technologies (such as advertising-platform pixels) may constitute "sharing" for cross-context behavioral advertising, and potentially a "sale," under the CPRA. You have the right to opt out of this sale/sharing. You can opt out by contacting us at [email protected], using available in-app or cookie-banner controls, or by enabling a Global Privacy Control (GPC) signal in a supported browser, which we will honor as a valid opt-out request.

Your rights: Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of Sale/Sharing, Right to Limit Use of Sensitive Personal Information, and Right to Non-Discrimination. To exercise any right, contact us at [email protected]. We will verify your identity and respond within 45 days.

Other US States

If you reside in a state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Texas, Utah, or Oregon), you may have similar rights to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, sale, and certain profiling. Contact us at [email protected] to exercise these rights.

Nevada Residents

Nevada law (NRS 603A) allows Nevada consumers to opt out of the sale of certain personally identifiable information. To make a request, contact us at [email protected].

External Connections

Our site and App may contain links to third-party websites, plug-ins, and applications. We do not control those third parties and are not responsible for their privacy practices. Review each third party's privacy notice before providing data.

Changes to This Notice

If the purpose for which we process your data changes, we will ensure the new purpose is compatible or notify you and, where required, obtain your consent. We will post material changes via the Services and update the "Last updated" date.