Privacy Policy

Last updated September 28, 2026

This Privacy Policy applies to the information Pluh Inc., which operates Protag, as a data controller (“Protag,” “we,” “our,” or “us”) collects about you in the course of our business, including through the websites that link to this Privacy Policy; our mobile and desktop applications; and other related online or offline offerings operated by or on behalf of Protag. We refer to these products, services, applications and offerings collectively as the “Services.”

By using the Services, you agree to this Privacy Policy and that we may process, transfer, and store your information in the United States. You are also providing your consent to the collection, use, and disclosure of your information as set out in this policy. In some cases, your consent may be “implied,” i.e., your permission is assumed based on your action or inaction at the point of collection, use or disclosure of your personal information. IF YOU DO NOT AGREE TO THIS POLICY, PLEASE DO NOT USE THE SERVICES.

If you are a California resident, please see “Additional Privacy Information for California Residents” below.

This Privacy Policy contains the following sections: The Information We Collect; Advertising Measurement; How We Use Your Information; How We Disclose Your Information; Third-Party Applications, Services, and Links; Children’s Privacy; Security and Retention of Your Information; Your Rights and Choices; Additional Privacy Information for California Residents; Information for International Users; Changes to Our Privacy Policy; and Contact Us.

The Information We Collect

The information we collect about you depends on the Services you use, how you use them, and the information you provide to us. We collect information in three main ways: (1) information you provide directly to us; (2) information we collect automatically through technology when you use the Services; and (3) information we collect from other sources.

1. Information you provide directly to us

When you use our Services, you may provide certain information to us. For example, we collect information directly from you when you create or use a Protag account; play or create stories; purchase Credits; claim free Credits; post content through the Services; communicate and interact with us; or otherwise voluntarily submit information to us. The categories of information we may collect include:

• Contact and account information, such as your name, address, email address, phone number, and login credentials (including Apple or Google account information if you choose to log in through those methods). If you choose Apple’s “Hide My Email” option, we receive a private relay address instead of your email address.
• Demographic information: your age and gender, which you give when you first sign in. We use your age to confirm you are 13 or older. We do not show either on your profile, send them to AI providers, or share them with advertising partners.
• Conversation information, which includes your conversation and story content, story choices, notes and story memory you add or edit, uploaded text and images, and input data and outputs.
• Personas, such as the names, descriptions, and avatar settings of the characters you play as.
• Story memory, such as the summaries our AI writes of your earlier turns so the story remembers them, and any changes you make to them.
• Communications information, such as information you provide when you contact customer support, communicate with us by email, chat, social media, or telephone, respond to surveys, participate in promotions, or otherwise interact with us.
• Financial information, such as credit card information (which is collected and stored by Apple or other third-party payment processors on our behalf).
• Transaction information, such as your purchase and transaction history, your Credit balance, and your Credit history (Credits received, spent, refunded, and expired, and what they were spent on).
• Profile and user content, such as information you upload or submit through our Services, including profile photos, nickname, stories you create (including their text, settings, and images), information you choose to post in our bulletin boards or community areas, and other information you choose to provide about yourself.
• Photos. If you choose to add images to a story, the App asks for permission to access your photo library, and the images you pick are uploaded.
• Public forums. Certain features of our Services make it possible for you to post stories, questions, comments, photos, or other content publicly with other users. Any information that you submit through these features (including any information you have chosen to attach to this information) is not confidential, and Protag and other users may be able to see and use such content in their discretion. Accordingly, please take care when using these features. Moreover, if you share content via a link or story code, that content and associated data will be accessible by anybody who has access to the link or code.

In some cases, providing certain information may be necessary for us to provide requested products or services. If you choose not to provide certain information, some features or services may not function properly or may be unavailable.

2. Information we collect automatically

When you use our Services, we automatically collect certain information, including:

• Device information, such as device type, device model, operating system, firmware and software versions, browser type, language settings, mobile carrier, hardware identifiers, serial numbers, IP address, Bluetooth identifiers, network connection information, and other unique device identifiers.
• Usage information, such as pages and screens viewed, features used, buttons clicked, search queries, referring and exit pages, dates and times of access, session duration, navigation paths, application launches, interactions with content or services, crash reports, performance data, and diagnostic information.
• AI usage metrics, such as the models used, the amount of text and number of images each story turn or picture uses, response times, and the resulting cost.
• Log and analytics information, such as log files, error reports, system activity, troubleshooting data, and analytics information regarding how users access and use our products and services.
• Product and device performance information, such as device status, operational logs, battery status, connectivity information, hardware performance metrics, and information related to software updates, maintenance, troubleshooting, and support.
• Location and network information, such as approximate location information derived from your IP address, network connection status, Bluetooth connection status, nearby device information, and other technical information related to connectivity and service functionality.

3. Information we collect from other sources

We may receive information about you from other sources, such as affiliates; authentication providers (for example, Apple when you use Sign in with Apple, which may provide your name, email address or private relay address, and an account identifier, and Google when you use Sign in with Google, which provides your name, email address, profile photo, and an account identifier); business partners; marketers; researchers; analysts; third-party integrations and platforms; retailers, resellers and distributors; and other parties.

Google user data. If you use Sign in with Google, we receive your name, email address, profile photo, and Google account identifier. We use them only to create and sign you in to your Protag account and to show your name and photo on your profile, which you can change. We do not request access to other Google data, do not use Google user data for advertising, and do not sell it or share it except with the vendors that help us run the Services, as described in this Privacy Policy. You can remove Protag's access at any time from your Google Account's security settings, and deleting your Protag account deletes this data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect to a third-party network (such as a social network), platform, or other type of service through the Services, you are authorizing us to collect, store, and use in accordance with this Privacy Policy any and all information (such as name, email address and location) that you agreed the network or other third-party platform could provide to us based on your settings on that network or platform. If you would like to limit the information shared in this way, please change your settings on the third-party network.

De-identified information

We may de-identify information we collect so the information cannot reasonably identify you or your device, or we may collect information that is already in de-identified form. Our use and disclosure of de-identified information is not subject to any restrictions under this Privacy Policy, and we may use and disclose it to others for any purpose, without limitation.

Advertising Measurement

We advertise Protag on other services, such as TikTok. To learn which ads bring new players, the iOS app asks for your permission to track, using Apple’s App Tracking Transparency prompt, after you sign in.

• If you allow tracking, the app uses TikTok’s software development kit (SDK) to send TikTok your device’s advertising identifier, basic device information, app events such as installing and opening the app and in-app purchases (the product and its price), and your Protag account identifier. TikTok uses this to measure and improve our ad campaigns, and may combine it with information it holds about you under its own privacy policy.
• If you choose “Ask App Not to Track,” we do not start TikTok’s SDK and send TikTok nothing.

You can change your choice at any time in your iPhone’s Settings → Privacy & Security → Tracking. We do not show ads in Protag.

Analytics. The iOS app uses Superwall’s software development kit to run purchases and paywalls. Superwall receives your Protag account identifier, device information, and app events such as app opens, sessions, paywall views, and purchases, and gives us analytics about them. This does not depend on your tracking choice.

How We Use Your Information

We may use the information we collect in the following ways:

• To provide the Services you have requested, such as running your stories, generating story text and images, saving your progress, story memory, and collected images and endings, completing a purchase, or offering customer support.
• To communicate with you, for example, keeping you posted on purchases, product and software updates, and changes to our terms, conditions, and policies.
• For marketing and advertising purposes, such as telling you about Protag updates and, only if you allow tracking, measuring which of our ads bring new players (see “Advertising Measurement”).
• To personalize your experience and customize the Services, such as delivering relevant content, recommending stories and features through our Services, and remembering your preferences.
• To improve our Services, including bug detection and error reporting, analyzing, improving, and training our algorithms and AI models, understanding how users interact with our Services and advertisements, improving usability and effectiveness of our products, performing research and analytics, and testing and creating new products, features, and services.
• For safety and moderation, such as reviewing stories submitted for publishing against our content rules.
• For our business operations, including maintaining your account, and for security, fraud prevention, and legal compliance, such as enforcing our legal terms, detecting security incidents, and protecting against malicious, deceptive, fraudulent, or illegal activity.
• Other purposes for which we seek your consent. We may also use your information for a specific purpose that we communicate to you. We will ask for your consent to process your information for such purpose in accordance with applicable legal requirements.

Combined information. We may combine the information that we collect through the Services with information that we receive from other sources, both online and offline, and use such combined information in accordance with this Privacy Policy.

Model training. We use your content to train and improve our own AI models. This includes the stories you play and create, your messages and choices, personas, story memory, and the text and images the AI makes for you. We do not sell your personal data for AI training, and our AI vendors do not train their models on it (see “AI vendor disclosure” below).

How We Disclose Your Information

We may disclose your information in the following ways:

• Affiliated entities. We may disclose information within Protag’s family of companies, if any, to deliver the Services, operate our business, and enhance our Services and your customer experience.
• Vendors. We use select third-party vendors to help us provide our Services and operate our business, and we may provide access to or disclose your information to these vendors. They provide a variety of services to us, including customer service, authentication (for example, Apple and Google), payment processing, in-app purchase management, and analytics (for example, Apple and Superwall), generative AI and image providers (for example, OpenAI, xAI, and Black Forest Labs), telecommunications and account verification, marketing, product design and development, data hosting, databases and storage (for example, Supabase), security, fraud prevention, research, and legal and auditing services. These vendors are permitted to access and use your information for purposes of performing services for Protag or to comply with applicable legal requirements.
• Advertising partners. Only if you allow tracking, we disclose the information described in “Advertising Measurement” to TikTok to measure our ad campaigns.
• Protection of Protag and others. We may disclose the information we collect about you if required to do so by law or in a good faith belief that such disclosure is reasonably necessary to: (a) comply with legal process (for example, a subpoena or court order); (b) enforce our Terms of Service, this Privacy Policy, or other contracts with you, including investigation of potential violations; (c) respond to claims that any content violates the rights of third parties; or (d) protect the rights, property, or personal safety of Protag or others.
• Public. Your username and profile picture (if you choose to add one) will be visible to the general public. Depending on how you interact with the Services and your settings, the following additional information may be visible to the public: published stories (including their text, images, and creator name), and replies and comments on our bulletin boards.
• Business transfers. As we continue to develop our business, we may buy, merge, or partner with other companies. In such transactions, including in contemplation of such transactions, your information may be among the transferred assets. If a portion or all of Protag’s assets are transferred to a third party in these circumstances, we may disclose your information as part of the transaction.
• Your feedback. If you submit a user testimonial, we may publish your testimonial on the Services. Our processing and disclosure of feedback and other submitted content will be in accordance with our Terms of Service and any additional terms provided to you at the point of submission.
• With your consent. If you provide your consent to a specific disclosure, we will disclose your information consistent with that consent.
• AI vendor disclosure. We use a variety of AI model providers to power our Services, including to process information such as user-entered text and attachments, and AI outputs. To write each story turn, we send the story so far, your move, the name you play as, and story memory to a text model from OpenAI, xAI, or a lab reached through OpenRouter (such as Anthropic or Google). To paint story pictures, we send the scene and your move to xAI or Black Forest Labs. We do not send your email address, age, or gender. Guests agree to this before their first move, and everyone agrees when they sign in. Before engaging these vendors, we review their data protection and security practices, and require them to only process information on our behalf, pursuant to contractual restrictions. These entities are not permitted to train their models on user data, and they are all subject to appropriate data retention and deletion requirements.

Third-Party Applications, Services, and Links

The Services may also include links to third-party websites or plug-ins, such as Apple’s sign-in and payment screens. Clicking on those links or interacting with such content may allow your data to be shared with the relevant third party. We do not control these third-party websites and are not responsible for the content or practices of these sites or of their privacy statements; we therefore recommend that you read the privacy notice of every website you visit.

Children’s Privacy

Our Services are intended for general audiences and are not directed at children under the age of thirteen (13). If we become aware that we have collected data without legally valid parental consent from children under an age where such consent is required, we will take reasonable steps to delete it as soon as possible. To report such a situation, please contact us at i@endtail.com.

Security and Retention of Your Information

Security of your information

We are committed to protecting your information. We use a variety of technical, physical, and organizational security measures designed to protect against unauthorized access, alteration, disclosure, or destruction of information. However, no security measures are perfect or impenetrable. As such, we cannot guarantee the security of your information.

If you create a Protag account, it’s important that you keep your sign-in method secure and do not share access with others. Alert us immediately if you have any concerns about unauthorized use of your account. If you have any concerns about the security of your account, please contact us using the contact information below.

Retention of your information

We retain information for only as long as necessary to fulfil the purposes in this Privacy Policy, unless a longer retention period is required or permitted by law. This includes the purposes of satisfying legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the information. We also weigh the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we obtained the information and whether we can meet those purposes through other means, as well as applicable legal requirements.

Your Rights and Choices

Account information. You may make certain changes to your information, such as revising your billing information, by logging into your account. You can also ask us to delete your account at any time by using the account deletion option in the App, where available, or by emailing us at i@endtail.com from the email address linked to your account.

Marketing communications. You can opt out of receiving marketing emails from us by following the instructions at the bottom of such emails. Please note that your request will take some time to process, in accordance with applicable law. After you opt out, you will still receive transactional communications from us regarding your account or important legal information.

Tracking. You can allow or stop tracking at any time in your iPhone’s Settings → Privacy & Security → Tracking. See “Advertising Measurement” above.

Data rights. Depending on your jurisdiction of residence (including the EU, UK, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia and other U.S. states with similar privacy laws), you may have the right, in accordance with applicable data protection laws, to make requests related to your “personal information” or “personal data” (as such terms are defined under applicable law, and collectively referred to in this section as “personal information”). These rights differ by jurisdiction and by your relationship with us. Specifically, you may have the right to ask us to:

• Provide you with access to and/or a copy of personal information we hold about you in a readily usable format (where technically feasible and legally required).
• Confirm that we are processing your information.
• Correct or update personal information we hold about you.
• Delete personal information we have about you.
• Restrict (or you can object to) certain processing of your information.
• Withdraw your consent to our use of your information for certain processing purposes, where the processing purpose was based on your consent.

You also have the right not to be discriminated against for exercising your rights. Minnesota, Connecticut, and Oregon residents can request a list of the specific “third parties” (as that term is defined under applicable law) to which we have disclosed personal information, and Delaware and Maryland residents can request a list of the categories of such “third parties.”

We may ask you to provide us with information necessary to reasonably verify your identity before responding to your request (e.g., your name, email, and last purchase). We will consider all requests and provide our response within the time period required by applicable law. Please note, however, that certain information may be exempt from such requests. If we deny your request in whole or in part, you may have the right to appeal the decision. In such circumstances, we will provide you with information regarding the appeals process.

To make a request, please contact us at i@endtail.com.

We do not use your information to make decisions that produce legal or similar effects based solely on the automated processing of your information.

Sale and targeted advertising opt-out rights. We do not sell your personal information. If you allowed tracking, you can stop sharing for advertising at any time by turning tracking off in your iPhone’s Settings → Privacy & Security → Tracking, or by contacting us at i@endtail.com.

Please note that we will also honor browser-based opt-out signals (such as the Global Privacy Control) in accordance with our legal obligations.

Additional Privacy Information for California Residents

If you are a California resident, the California Consumer Privacy Act (“CCPA”) requires us to provide you with the following additional information about: the purpose for which we use each category of “personal information” (as defined in the CCPA) we collect; and the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) “share” personal information for “cross-context behavioral advertising,” and/or (c) “sell” such personal information.

Under the CCPA, “sharing” is defined as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across distinct online services, and “selling” is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. We may “share” information with our advertising partners to provide more relevant and tailored advertising to you regarding our Services. Moreover, our use of third-party analytics services and online advertising services may result in the sharing of online identifiers (e.g., cookie data, IP addresses, device identifiers, and usage information) in a way that may be considered a “sale” under the CCPA.

The following provides an overview of these practices. “Standard recipients” means affiliated entities; service providers; entities for legal purposes and the protection of Protag and others; and entities for business transactions.

• Contact information (e.g., name, email). Disclosed for a business purpose to: standard recipients. We do not sell or share.
• Demographic information (age, gender). Disclosed for a business purpose to: standard recipients. We do not sell or share.
• Account information (log-in information). Disclosed for a business purpose to: standard recipients. We do not sell or share.
• Conversation information (your conversation content and prompts). Disclosed for a business purpose to: standard recipients. We do not sell or share.
• Communications information (e.g., customer service communications with us). Disclosed for a business purpose to: standard recipients. We do not sell or share.
• Financial information (e.g., payment account information). N/A – this information is collected by our third-party payment processors on our behalf. We do not sell or share.
• Transaction information (e.g., purchase history). Disclosed for a business purpose to: standard recipients. Shared, only if you allow tracking, with: TikTok, for advertising measurement. We do not sell.
• User content information (e.g., profile information, stories you create). Disclosed for a business purpose to: standard recipients. We do not sell or share.
• Network usage and device information (e.g., Services usage information, IP address, device identifiers). Disclosed for a business purpose to: standard recipients. Shared, only if you allow tracking, with: TikTok, for advertising measurement. We do not sell.
• For more information about each category, purpose of use, and the third parties to which we disclose information, please see “The Information We Collect,” “How We Use Your Information,” and “How We Disclose Your Information” above.

Your choices regarding “sharing” and “selling.” We do not sell personal information. We share it for advertising only as described in “Advertising Measurement,” and only if you allow tracking. To opt out, choose “Ask App Not to Track” or turn tracking off in your iPhone’s Settings → Privacy & Security → Tracking. You can also email us at i@endtail.com.

Other CCPA rights

Financial incentives. We give free Credits when you sign up and for daily check-ins. These do not require you to share additional personal information, and we do not offer other financial incentives in exchange for your personal information.

The specific discounts or incentives offered, if any, are made available to you when you provide the information requested. The monetary value of the reward or incentive is a reasonable approximation of the monetary value of the information you provide us. We have arrived at this estimate based on consideration of multiple factors, including the following: (1) revenue generated by Protag in developing insights on our customers; and (2) expenses incurred by Protag in operating these financial incentive programs.

Right to limit. The CCPA allows you to limit the use or disclosure of your “sensitive personal information” (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA.

Personal information rights. Please see “Your Rights and Choices” above for information about the additional rights you have with respect to your personal information under California law and how to exercise them.

Retention of your personal information. Please see “Security and Retention of Your Information” above.

Do Not Track. Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We do not currently recognize or respond to browser-initiated Do Not Track signals. Please note that “Do Not Track” is a distinct privacy mechanism from the browser-based opt-out signals referenced above.

California “Shine the Light” disclosure. The California “Shine the Light” law gives residents of California the right under certain circumstances to opt out of the disclosure of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such disclosure. We do not currently disclose your personal information to third parties for their own direct marketing purposes. To opt out of disclosures that would be considered the “sale” or “sharing” of personal information under California law, please follow the instructions in “Your choices regarding ‘sharing’ and ‘selling’” above.

Information for International Users

We operate globally and may transfer, store, and/or process your information to or with other entities within Protag’s family of companies, if any, or other third parties such as vendors and partners in locations around the world (including the United States) for the purposes described in this Privacy Policy. Wherever your information is transferred, stored or processed by us, we take reasonable steps to protect your information in accordance with this Privacy Policy and applicable laws. These measures may include implementing appropriate transfer mechanisms, or other means recognized by applicable laws. By providing us with your information, you acknowledge any such transfer, storage, or processing.

If you have any concerns or complaints about our data processing activities, we urge you to first try to resolve such issues directly with us. However, if applicable, you may make a complaint to the data protection supervisory authority in the country where you are based or seek a remedy through local courts if you believe your rights have been breached.

Changes to Our Privacy Policy

We may change or update this Privacy Policy from time to time. If we do so, we will post an updated version of this Privacy Policy and will provide you with additional notice of any material changes as required by law. By continuing to use the Services, you are confirming that you have read and understood the latest version of this Privacy Policy.

Contact Us

If you wish to contact us or have any questions about or complaints in relation to this Privacy Policy, please contact us at i@endtail.com or write to Pluh Inc., 239 Shipley St, San Francisco, CA 94107, United States.

We designate a privacy officer to take overall responsibility for tasks relating to information processing, and to handle rights requests and complaints in connection with information processing. Our privacy officer can be reached at i@endtail.com.