Privacy Policy

1. Data we collect

We collect only what the service needs to work:

• Account: name, email and photo (from your Google account or one you upload), language, time zone and the name/headline you provide. If you sign in with a password we store only its hash, never the password;
• Content: the accounts of what you did that you write or dictate, generated and edited posts, generated images and schedules;
• Connected accounts: your account identifier on each network and the access tokens you authorized, stored encrypted;
• Your own AI key: if you provide one, it is stored encrypted and used only for your generations;
• Usage and technical: generation logs (network, language, intensity, model, duration, token counts), plan-usage events, and IP address and technical data in server logs;
• Payment: your subscription status and payment-provider identifiers. We do not store card data;
• Waitlist: the email you enter on the home page.

2. What we use it for

We use data to: provide the service (generate, edit, schedule and publish posts); authenticate you; enforce plan limits and bill the subscription; prevent fraud and abuse; keep the service secure and stable; improve the product using aggregate usage metrics; and send service notices and, if you asked, news.

Legal bases: performance of a contract, consent (such as the waitlist and connecting accounts), legitimate interests (security and product improvement) and legal obligation.

3. Who we share it with

We share data only with providers needed to operate the service, acting as processors or independent controllers as applicable:

• AI providers (for example Google, Groq and OpenAI): receive the text of your account and the instructions to generate content; the actual list depends on service configuration and the key you use;
• Payment provider (Stripe): processes the subscription;
• Hosting and database: store the service and the data;
• Google: sign-in authentication (optional);
• Usage analytics (PostHog): measures visits on the public pages and usage actions on your account, without cookies and without the content of your texts;
• Email provider (Resend): sends account confirmation and password reset emails;
• Social networks you connect: receive the content you choose to publish.

4. International transfers

Some providers are outside Brazil (for example in the United States). Transfers rely on LGPD Article 33 and, where applicable, standard contractual clauses and safeguards offered by those providers.

5. Cookies and local storage

We only use what is necessary: a login session cookie, a language cookie, temporary cookies while connecting social networks (authorization state) and, in your browser, a sound preference. We do not use advertising cookies. We measure use of the site with PostHog in cookieless mode: nothing is stored in your browser, we do not record what you type, and we strip any URL parameters (such as an email). With your account we record only actions (for example, generated a set, scheduled, published, connected a network), always under an anonymous code and never with the content of your texts.

6. How long we keep it

We keep data while your account exists. You can delete your account and download your data at any time on the Profile page. When you close it, your content, tokens and keys are deleted, except what we must keep for legal obligations or to exercise rights (for example payment tax records). Technical security logs are kept for limited periods. Waitlist emails are kept until you ask to be removed.

7. Security

Social network tokens and AI keys are encrypted (AES-256-GCM) before storage, traffic uses HTTPS and access to data is restricted. No system is completely secure; in case of a significant incident we will notify you and the competent authority as required by law.

8. Your rights

Under LGPD Article 18 (and the GDPR where it applies) you may at any time: confirm that processing exists; access your data; correct incomplete or outdated data; request anonymization, blocking or deletion of unnecessary data or data processed unlawfully; request portability; obtain information about sharing; and withdraw consent. You can export and delete your data on the Profile page or write to ycaro.oleg.job@gmail.com; we respond within a reasonable time, normally within 15 days.

You may also lodge a complaint with the Brazilian data protection authority (ANPD) or your local authority.

9. Minors

Larper is intended for people 18 and older. We do not knowingly collect data from minors; if we find any, we will delete it.

10. Changes to this policy

We may update this policy. Material changes will be communicated in the service or by email and the update date above will change.

11. Contact

Controller: Ycaro Olegário. Privacy contact: ycaro.oleg.job@gmail.com.