Draft for legal review. This notice describes how Velvet Rope works today, but a lawyer hasn't checked it yet, so the wording may change.
Privacy notice
Last updated 28 October 2026
Velvet Rope is a chat app with fictional AI characters, for adults. This notice explains what we collect, why, who helps us run the service, how long we keep things, and what you can ask us to do.
The short version
- Saved chats are encrypted in your browser with a key that only your password unlocks. We store copies we can't read.
- Your messages are used to reply to you, and for nothing else. They pass through our server to an AI model to write each reply. We don't keep them in readable form, and we don't use them to train AI.
- No ads, no tracking cookies, no selling data. We use one cookie, to keep you logged in.
- You can delete everything yourself: one chat, all chats, or your whole account, from inside the app.
- Velvet Rope is for adults only. You must be 18 or over to use it.
1. Who we are
Velvet Rope is run by Mint Condition Holdings, a company being registered in England and Wales. We are the controller of the personal data described here. Our company number and registered address will be added to this page once registration is complete.
For anything about your data, email privacy@velvetrope.love. For anything else, email support@velvetrope.love.
2. What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Your email address and password. We store the password only as a salted, scrambled hash that can't be turned back into the password. | To create your account, log you in, and send password reset links. | Contract: we need them to provide your account. |
| The date you joined, when you last logged in, your confirmation that you're 18 or over, and which version of our terms you agreed to. | To run your account and the 14-day trial, and to show you confirmed you're an adult and agreed to the terms. | Contract, and our legitimate interest in keeping Velvet Rope adults-only. |
| Where you came from, if you arrived through a tagged link: the referral code, campaign tags, discount code, or ad click ID in that link. | To see which links bring people in, and to apply any discount the link carried. | Legitimate interests: understanding what works without tracking you across other sites. |
| How much you've used: messages per day, photos and videos per character, your trial start date, and which photos belong to you. | To apply the free allowances and fair-use limits, and to control costs. | Contract, and legitimate interests in fair use and preventing abuse. |
| If you're not logged in, a usage counter tied to a scrambled form of your IP address. It holds a count, not your messages. | To limit guests to six free messages. | Legitimate interests: preventing abuse of the free messages. |
| Photos the characters send you. They're generated for you and stored under your account. | So you can see them again. They're only ever shown to you. | Contract. |
| Security records: scrambled forms of your IP address and email address in short-lived rate-limit counters, your log-in sessions, and password reset links. | To keep you logged in, and to block password guessing and mass sign-ups. | Legitimate interests in keeping accounts secure. |
| After Dark only: the result of your age check (passed or not) and when it happened. | After Dark is only open to members who have passed an age check. | Legal obligation to make sure only adults can see adult content, and contract. |
| Purchases: what you bought, the price, the date, and the payment provider's reference. | To give you what you paid for, and to keep accounts and tax records. | Contract, and legal obligation (tax and accounting law). |
| Technical logs: errors and basic details of requests to our server. | To keep the service working and investigate problems. | Legitimate interests in running a reliable, secure service. |
We don't ask for your name, phone number, address or date of birth. Signing up and the free trial need no card and no ID.
3. Your chats
When you send a message
Your message, the recent conversation, the character's short list of memories about you, and any date scene you picked go to our server. From there they go to an AI model, which writes the character's reply. We don't keep your messages on our server in readable form.
Memories
Each character keeps a short list of facts you've told them, such as the name you go by or your hobbies, so the chat feels continuous. An AI model writes the list from your recent messages. It is told never to record sensitive things such as health, sexuality, religion, money, addresses or contact details, and we filter out email addresses and long numbers as a second check. The list lives in your browser and, if you save chats, inside your encrypted saved chats. You can wipe it at any time with "Forget what … remembers".
Photos
When a character sends a photo, an AI model writes a short scene description from your recent messages, and an image model draws the character in that scene. The photo is stored under your account and shown only to you. Deleting the chat or your account deletes its photos.
Saved chats
If you're not logged in, or you turn saving off, your chats stay only in your browser. If you're a member with saving on, each chat is compressed and encrypted in your browser before it's uploaded. The key is protected by your password, so we hold copies we can't read. That's also why a password reset by email can't recover saved chats without your old password.
You choose how long saved chats last: delete one chat or all of them on every device, set them to delete themselves after 1, 7, 30 or 90 days without new messages, or stop saving altogether.
Training
We don't use your chats, memories or photos to train AI models, and we only use AI providers on terms that don't allow them to train on what we send.
4. Sensitive subjects
Some chats touch on private things, including your sex life or how you're feeling. The law treats that as special category data. We process it only to reply to you in the chat you started, and we rely on your explicit consent to do so, which you give by choosing to chat about it. You can withdraw that consent at any time by stopping and deleting the chat. We never use it for advertising or profiling, and we don't make decisions about you based on it.
If you're going through a hard time, please talk to a person. Samaritans are free to call on 116 123, any time of day. If you're in danger, call 999.
5. Who processes your data
We don't sell your data or share it with advertisers. These companies process it for us, only on our instructions:
- Cloudflare hosts the site and stores our database, your photos and your encrypted saved chats. Its AI models write the characters' replies, memories and photos, and it sends our password reset emails.
- Other AI providers. We may move chat to Anthropic (Claude) or photos to Google (Gemini). We'll update this page before we do, and we'll only use terms that stop them training on your data. After Dark chat will use a separate provider, which we'll name here before After Dark chat opens.
- Age checks. When the After Dark age check opens, a specialist age-verification provider will run it. It checks your age and tells us only whether you passed; we don't receive your ID or face scan. We'll name the provider here before it goes live.
- Payments. When paid plans open, payment providers will take your payment. We never see your full card details or crypto wallet keys.
- Google Fonts. Our pages load their typefaces from Google's servers, so Google receives your IP address and browser details when you visit.
- Google (Gmail). Emails you send to support@ or privacy@velvetrope.love, including replies to our emails, are forwarded by Cloudflare to our Gmail inbox, so Google stores them.
We may also share data if the law requires it, for example with the police under a valid legal request, or to protect someone from serious harm.
6. Data outside the UK
Some of these providers, or their staff, are in the United States or elsewhere outside the UK. Where they are, we rely on UK adequacy regulations (including the UK–US data bridge) or the UK's International Data Transfer Agreement or Addendum, so your data keeps an equivalent level of protection.
7. Cookies and browser storage
We set one cookie: a log-in cookie that keeps you signed in for up to 30 days. It's strictly necessary, so we don't ask for consent for it. We use no analytics, advertising or tracking cookies.
We also keep some things in your browser's own storage, on your device:
- your chats and the characters' memories, if you're a guest or not saving chats;
- your encrypted saved-chats key, stored so the page can use it but not read it out;
- your settings, the "I'm 18 or over" confirmation, and where you came from (the tagged link), until you sign up.
Logging out clears your saved chats from the browser once they're safely uploaded. Clearing your browser's site data removes everything stored on your device.
8. How long we keep things
| What | How long |
|---|---|
| Your account, usage record, photos and age-check result | Until you delete your account. Deleting it removes them straight away. |
| Saved chats | Until you delete them, they reach your auto-delete age, or you delete your account. A small marker with no chat content stays for up to 180 days so your other devices know to delete their copies. |
| Log-in sessions | Up to 30 days, or until you log out. |
| Password reset links | 1 hour, and they work only once. |
| Rate-limit counters | Deleted after 2 days. |
| Guest usage counters | As long as needed to enforce the free-message limit. They hold a count, not messages. |
| Purchase records | 6 years after the end of the financial year they belong to, as tax law requires. If you delete your account, they're kept against an anonymous ID, not your email. |
| Technical logs | A few days. |
9. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct anything that's wrong;
- delete your data;
- restrict how we use it, or object to our using it on the basis of legitimate interests;
- give you your data in a portable format;
- stop using data we hold with your consent, by withdrawing it.
You can delete chats and your whole account yourself in the app (your account card, then "Delete my account"). For anything else, email privacy@velvetrope.love from the address on your account. We'll reply within one month. We can't read your saved chats, so a copy we send you will include them only in their encrypted form. Your chats themselves are always readable in the app while you're logged in.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Security
The site only works over an encrypted connection. Passwords are stored as salted hashes, log-in sessions are stored as hashes, and saved chats are encrypted in your browser before they reach us. Photos are only served to the account they belong to, and access to our systems is protected with two-factor sign-in. No system is perfectly secure: if a breach puts you at risk, we'll tell you and the regulator as the law requires.
11. Adults only
Velvet Rope is only for people aged 18 or over. If we learn that someone under 18 has an account, we'll delete it and its data. If you think a child is using Velvet Rope, please email support@velvetrope.love.
12. Changes and contact
We'll update this notice when how we handle data changes, and change the date at the top. If a change matters for you, we'll tell you in the app or by email before it takes effect.
Questions or requests: privacy@velvetrope.love. See also our terms of use.