Sugarcoat — Privacy Policy

Effective date: September 22, 2026

This Privacy Policy explains how the operator of Sugarcoat ("Sugarcoat," "we," "us") collects, uses, shares, and protects personal information when you use the Sugarcoat application, the sugarcoated.app websites, and related services (together, the "Service"). For users in the European Economic Area and the United Kingdom, we are the controller of your personal information; our contact details are in Section 13.

Sugarcoat's core feature is that messages are transformed by automated systems before delivery. That means your message content is processed — this policy explains exactly how, and what control you have.

1. Information we collect

Account information. Your email address (your login identity), display name, date of birth, and, if you choose to add them, a profile photo and a short bio.

Content. Messages you send and receive — including the original text you typed, the transformed versions produced by the Service, and translations or restylings of incoming messages — plus photos and videos you share, and settings such as your chosen conversation styles and languages. This includes style and language choices you set for a specific person.

Safety choices you make. Your blocked-users list, per-conversation mute settings, and any reports you file. When you block someone who was a connection, we also keep a note of that so unblocking can restore the connection.

Usage and technical information. Service logs (such as requests to our servers, timestamps, and response outcomes), session information (such as when you connect and how long you stay connected), approximate technical metadata needed to deliver notifications (such as a push-subscription token for your browser or device), and records generated by our safety systems (such as whether a message or image was blocked and why). Safety records also include any temporary pause of AI features applied to your account — the reason category and when it ends — as described in the Terms (Section 6). Session information includes an identifier for the phone session currently signed in to your account, which is what lets a newer sign-in end an earlier one.

Sugar (AI companion) information. Your conversation with the Sugar companion (your messages to it and its replies), and safety records about it (a count of policy-violating requests and, where applicable, a record that access to Sugar was disabled).

Derived information. To make transformation and the companion work better, our systems automatically maintain small, size-capped summaries of each conversation ("conversation notes") — key topics, tone/formality, and brief non-sensitive descriptions of how participants write (our systems are instructed never to record sensitive categories such as health, religion, politics, or sexuality in these notes). We also derive your approximate, country-level location from your IP address at the time of certain requests, for aggregate usage statistics; only the two-letter country code is kept — the IP address itself is not stored with it.

What we do not collect. We do not collect your precise location, your device's contact list, or advertising identifiers. The Service shows no third-party advertising and uses no third-party advertising or tracking cookies. The cookies or similar storage we use are limited to what the Service needs to work: signing in and keeping your session, remembering your app preferences (such as language and appearance), and keeping a local copy of your recent conversations on your device so they open quickly and stay readable when you are offline. That local copy never leaves your device, is not used for advertising or tracking, and is erased when you log out.

2. How we use information

• To provide the Service — deliver messages; produce transformed, translated, and restyled versions of message content using automated systems, including artificial-intelligence systems operated by service providers on our behalf; store your conversations; display profiles; send verification codes to your email; deliver notifications.
• To provide the Sugar companion — generate Sugar's replies using automated systems, including artificial-intelligence systems operated by service providers on our behalf; when you ask Sugar about your conversations (or use "ask Sugar" on a message), show it the relevant portions and summaries of your own conversations so it can answer; enforce Sugar's content rules, including counting violations and disabling access after repeated violations.
• Safety and moderation — automatically screen message text and uploaded images/video stills; block abusive, sexual, or otherwise prohibited content; apply stricter protections to conversations that include users under 21; investigate abuse; process the blocks, mutes, and reports you file (a report includes the reported message as you saw it at report time); retain records of blocked or rejected content (including its original text) for review by authorized personnel.
• Age protection — use your date of birth to apply the correct safety settings and to prevent under-age signups.
• Operations and improvement — monitor performance, reliability, errors, and aggregate usage of the Service; debug problems; understand how features are used. We analyze usage in aggregate; we do not build advertising profiles.
• Legal — comply with legal obligations, respond to lawful requests, enforce our Terms, and protect the rights, safety, and property of our users and others.

3. How message transformation works with your data

When you send a message (or receive one that your settings restyle), the relevant text — together with limited context needed to produce a good result, such as recent messages in the conversation, the conversation notes described in Section 1, and the participants' style and language settings — is processed by automated systems. If you choose the optional "mirror" style, this same conversation context is also used as a style reference so your message can be rephrased in the way the other participants write; this uses only content from that conversation that you can already see. This includes processing by third-party artificial-intelligence service providers acting as our processors under contract. These providers are permitted to use your content only to provide the processing service to us; they are contractually restricted from using it to train their own models or for their own purposes. Images and video stills you upload are screened by automated content-moderation technology under the same restrictions.

The Sugar companion works the same way: your messages to Sugar, its conversation history with you, and — when relevant to your question — portions and summaries of your own conversations are processed by the same categories of artificial-intelligence service providers under the same contractual restrictions (no training on your content, no use for their own purposes).

We deliberately do not disclose the identity of specific technology vendors in this policy except where the law requires; the categories are listed in Section 5, and information about recipients required by applicable law is available on request via Section 13.

4. Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process personal information on these bases:

• Performance of a contract (Art. 6(1)(b)) — providing the Service you signed up for, including message transformation, storage, and delivery.
• Legitimate interests (Art. 6(1)(f)) — keeping the Service safe and abuse-free, protecting minors, securing and monitoring our systems, and improving reliability; balanced against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose information to comply with law.
• Consent (Art. 6(1)(a)) — where we ask for it (for example, optional notifications); you can withdraw consent at any time without affecting prior processing.

We do not intentionally collect special-category data. Message content is treated as confidential regardless of what it may reveal, and is processed only as described here.

5. Who we share information with

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only with:

• Service providers (processors) acting under contract on our behalf: a cloud infrastructure provider that hosts our servers and data; third-party artificial-intelligence service providers that perform message transformation; automated content-moderation technology providers for images; and email-delivery infrastructure for verification codes. Each is bound to use your information only to provide its service to us.
• Other users — the content you direct to them: your messages (in transformed and/or original form as the Service is designed to show), your profile information, and your connection status. Messages you sent remain visible to recipients even after you delete your account.
• Authorities and other parties when legally required — if we believe disclosure is required by law or necessary to prevent serious harm, including reports of child sexual abuse material to relevant authorities.
• A successor entity — if we undergo a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy and with notice to you.

6. International transfers

Our servers and primary data storage are located in the Republic of Korea. Message content is transmitted to service providers that may process it in other countries, including the United States. Where information about EEA/UK users is transferred internationally, we rely on appropriate safeguards recognized by applicable law, such as the European Commission's Standard Contractual Clauses, adequacy decisions (the EU has recognized the Republic of Korea as providing adequate protection), or our processors' certifications under recognized frameworks.

7. Retention

• Account information — kept while your account exists; erased or irreversibly de-identified when you delete your account (Settings → delete account). Account deletion erases your profile record and frees your email address.
• Messages and media — kept while the conversation exists so participants can see their history. Messages you delete are removed and replaced with a deletion notice. After account deletion, messages you already sent may remain visible to their recipients.
• Safety records — records of blocked or rejected content, including original text, are retained for safety, quality, and abuse-prevention purposes.
• Sugar history — your conversation with Sugar is kept so it can remember your chats; it is erased when you delete your account. Records of policy violations (counts and any resulting loss of access) are retained for safety.
• Operational logs — service and reliability logs are retained for monitoring and analytics; they are records of activity (such as request counts, timings, session durations, and country-level usage statistics), not message content.

8. Security

We use technical and organizational measures appropriate to the risk, including encrypted connections (TLS) for all traffic, one-time email codes instead of passwords, access controls on production systems, signed time-limited links for media, and automated safety systems. No service can guarantee perfect security; please keep control of your email inbox, since it is your key to the account.

9. Children

The Service is not for children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a child under 13 has created an account, we will delete it. If you believe a child under 13 is using the Service, contact us (Section 13). Conversations that include users under 21 receive stricter automated protections against abusive and sexual content.

10. Your rights (EEA/UK)

If you are in the EEA or the UK, you have the right to: access the personal information we hold about you; have it rectified or erased; restrict or object to processing based on legitimate interests; receive a copy in a portable format (data portability); and withdraw consent at any time where processing is based on consent. Many of these are available directly in the app — you can view and edit your profile in Settings, and delete your account entirely in Settings → delete account. For anything else, contact us via Section 13; we will respond within the time required by law (generally one month). You also have the right to lodge a complaint with your local supervisory authority.

11. Your rights (California)

This section supplements the rest of this policy for California residents, under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

Categories of personal information we collect (and have collected in the preceding 12 months), by statutory category: identifiers (email address, display name, account ID); customer records / characteristics (date of birth); audio/visual information (photos and videos you upload, profile photo); internet or similar network activity (service logs, session information, feature usage); and the content of your communications (messages, including original and transformed text). Sources: you, your device, and our systems' observation of Service use. Purposes: as described in Section 2. Categories of recipients: as described in Section 5.

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done either in the preceding 12 months. We do not use or disclose sensitive personal information for purposes requiring a right to limit under the CPRA. We do not knowingly sell or share the personal information of consumers under 16.

Your rights: to know/access the personal information we collect and how it is used and shared; to delete it (subject to legal exceptions); to correct inaccurate information; to opt out of sale or sharing (not applicable — we do neither); to limit use of sensitive personal information (not applicable as described above); and to non-discrimination for exercising any of these rights.

How to exercise them: use the in-app tools (Settings → Profile to access and correct; Settings → delete account to delete) or contact contact@sugarcoated.app. We verify requests by confirming control of the account's email address. You may use an authorized agent; we will require proof of authorization and verification of your identity. Because we do not sell or share personal information, we do not respond differently to browser "Do Not Track" or Global Privacy Control signals, which target sale/sharing opt-outs.

12. Other regions

Depending on where you live, you may have additional rights under local law (for example, under the Personal Information Protection Act of the Republic of Korea). We honor applicable local rights; contact us via Section 13 to exercise them.

13. Contact

For privacy questions or to exercise any right: contact@sugarcoated.app. If you are in the EEA/UK and are not satisfied with our response, you may contact your local data-protection authority.

Operator: Sugarcoat (Republic of Korea)

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we will provide notice through the Service or by email before the changes take effect. The "Effective date" above always shows when this policy was last revised.

15. Translations

This policy is published in multiple languages for convenience. If there is any inconsistency between the English version and a translation, the English version controls to the extent permitted by applicable law.