Privacy Policy

Last updated November 5, 2026

Smirk is an iPhone app where every match is an AI character. It is operated by Grayfalls LLC ("we", "us"). This policy explains what we collect, why, who helps us run the service, and the choices you have. Smirk is for adults 18 and over.

The short version. We collect what you give the app (your answers, photos and messages) to run your conversations. Your messages are processed by AI providers to write the characters' replies. We don't sell your data. Your conversations and photos are never shared with advertisers. If you allow tracking, we share install and purchase events with ad platforms to measure our ads. You can delete your account and data at any time in the app.

What we collect

What you give us

Profile answers: your first name, age range, who you want to chat with, what you're looking for, and anything optional you add (interests, a job line, a prompt answer).
Photos you upload to your profile. They are stored privately and checked automatically for nudity and for anyone who could be under 18; photos that fail are deleted. Characters never see your profile photos, only a short text description of them.
Photos you send in a chat. They are checked the same way. The AI model sees a photo once, on the turn you send it, so the character can react to it; after that it only reads a short text description.
Your conversations: messages you send, replies, reactions (tapbacks), games you play, and the characters' messages and photos to you.
Voice notes you send in a chat. The recording stays on your phone. Apple's speech recognition turns it into text (on your device when it supports your language, otherwise through Apple), and only that text is sent to us and to the character.
Likes and passes on characters, comments you leave on a like, and reports you file.

What we collect automatically

An account identifier we create when you first open the app (you don't need an email or password to start).
If you save your account: your email address (for a one-time sign-in code), or an identifier from Sign in with Apple. If you use Hide My Email, we only see Apple's relay address.
Your device's time zone, so characters know what time it is for you.
A push notification token, if you allow notifications.
Usage events, such as when the app is opened, which onboarding screens you reach, when a subscription screen is shown, and how many messages you send (not what they say).
Crash and performance reports: what the app was doing when it crashed or froze, your device model and iOS version. They don't include your messages.
Purchase records from Apple (what you bought and when). We never receive your payment card details.

How we use it

To run Smirk: to generate character replies that fit your conversation and remember what you've told them, to send selfies and notifications, and to match you with characters.
To keep people safe: to screen photos, to stop characters from engaging with anyone who says they're under 18, and to show crisis resources if a message suggests you may be at risk of harm.
To provide subscriptions and Sparks you buy, and to apply free-tier limits.
To show you Rizz IQ: the same AI call that writes a reply also scores the message you typed (wit, confidence, flirt, curiosity, warmth). The scores are shown only to you, and characters never see them.
To improve Smirk: for example, which characters and photos people like, using aggregate statistics.
To respond to support requests and reports, and to enforce our Terms.

AI and who processes your data

Every character is an AI. To write their replies, your recent messages, what you've shared in your profile, a summary of your conversation, and any photo you just sent in the chat are sent to the AI models we use. We share data only with service providers that help us run Smirk, under contracts that limit their use of it to providing their service to us:

Supabase: database, storage and server functions.
Anthropic (Claude): writes character replies and checks photos. It doesn't use your data to train its models.
OpenAI: a content moderation check on messages, to catch anything unsafe our own checks miss. It doesn't receive your name or account, and it doesn't use your data to train its models.
Helicone: monitors our AI requests (cost, speed and errors). It doesn't record message text.
Vercel: hosting and the AI gateway that routes requests to AI models, including image models that create the characters' photos. Image requests describe the character and the moment; they don't include your photos.
Apple: App Store purchases, Sign in with Apple and push notifications.
RevenueCat: keeps track of your subscription and purchases with Apple.
PostHog: product analytics (the usage events above). Message text and anything you type are masked and never recorded.
Sentry: crash and performance reports.
Resend: sends the sign-in code email if you save your account with email.

We do not sell or share your personal information for advertising, and we do not track you across other companies' apps or websites. We never send your conversations or photos to advertisers, and Smirk shows no ads. Apple may tell us, without identifying you, which ad campaign led to an install (AdAttributionKit / SKAdNetwork).

How long we keep it

We keep your data while your account exists, including your chat history, so characters can remember your conversations. When you delete your account, we delete your profile, matches, messages, uploaded and received photos, purchase records and wallet right away. Copies in our database backups expire within 30 days. Our AI model provider and OpenAI may keep the requests we send them for up to 30 days to monitor for abuse, then delete them. Some technical logs (for example, the cost and success of an AI request, or a safety event with no message text) may be kept without your identity attached. Apple keeps its own records of App Store purchases.

Refund requests

If you ask Apple for a refund of a purchase, Apple may ask us about it. We may tell Apple how much of the purchase you used (for example, whether Sparks were spent), whether it was delivered, how long you've had your account, and how much you have bought and been refunded before. We never tell Apple what you wrote or who you chatted with.

Your choices and rights

Delete your account: in the app, go to Profile → Settings → Delete account. This deletes your data as described above. If you have a subscription, cancel it in your Apple ID settings; deleting your account doesn't cancel it.
Edit your profile at any time in Profile → Your profile.
Notifications: turn them off in your iPhone's Settings.
Depending on where you live (for example California or the EU/UK), you may have rights to access, correct, delete or port your data, or to object to some processing. Email us and we'll respond within the time the law requires. We won't treat you differently for exercising these rights.

If you're outside the United States

Smirk is run from the United States. Wherever you use it, Grayfalls LLC is responsible for your data (the "controller"), and your data is stored and processed in the United States and by the service providers listed above. Where the law of your country requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum to them) or a provider's certification under the EU-U.S. Data Privacy Framework.

If laws like the EU or UK GDPR apply to you, these are our legal reasons for using your data:

To provide Smirk to you (our contract with you): your profile, conversations, matches, photos you send, purchases and notifications.
Our legitimate interests: keeping people safe (screening photos and messages, the under-18 rules, crisis resources), preventing fraud and abuse, fixing crashes and improving Smirk with usage statistics. We weigh these against your rights, and you can object to them.
Legal obligations: for example, keeping purchase records and answering lawful requests.

What you tell characters about yourself may include sensitive details (for example about your health or love life). You choose what to share; we use it only to write the characters' replies and to keep you safe, never for advertising.

You can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent, by emailing support@smirkapp.com. We answer within one month. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office; in the EU, the authority in your country).

Age

Smirk is only for adults 18 and over. We don't knowingly collect data from anyone under 18. If we learn that someone under 18 is using Smirk, we delete their account.

Security

Data is encrypted in transit, access is limited to people and systems that need it, and photos and conversations are stored privately. No system is perfectly secure, but we work to protect your information.

Changes

If we change this policy in a meaningful way, we'll update the date above and tell you in the app.

Contact

Grayfalls LLC · support@smirkapp.com