The short version
- Who we are. Critto is made by Nexferra LTD, a company in England. We are responsible for your data. Contact: privacy@critto.app.
- What we keep. Your account (email, name, birth year), your crittos, every chat, and what your crittos remember about you. If you use the Den, we also keep your Den computer, with its files and the logins you save in it. We keep plan and payment status too, but not your card. Polar handles payments.
- Sensitive things. Crittos are little AIs that help you get things done. We don't aim to collect sensitive information about you (health, sex life, beliefs and so on), and please don't share it. What happens if you do.
- If you seem to be in crisis, we check your message for signs of suicide or self-harm, and your critto shows you where to get help. We count how often this happens, without saying who.
- Your AI. Your crittos talk through your own ChatGPT, Claude, Grok, Muse or Antigravity (Google) account. What you say to a critto goes to that company under your account and its privacy settings.
- We never sell your data, never show ads, and never use your chats to train AI models.
- Your rights. Download everything in Settings → Your data. Delete your account there too: it is gone 7 days later. Backups disappear within 60 days (how to delete your account). You can also ask us to correct things, or complain: see "Your rights" below.
- 18+ only.
Sensitive information: please don't share it
Crittos are little AIs that help you with tasks. They don't need to know about your health, sex life or sexual orientation, religion or beliefs, politics, ethnic origin or union membership. We don't aim to collect any of that, and we ask you not to tell crittos about it.
If you share some anyway:
- It's used only to answer you, in that chat.
- It isn't saved to your crittos' memory unless you ask a critto to remember it.
- You can delete it any time: the chat, the memory note, or your whole account (Settings → Your data).
- Like any message, it goes to the AI service you use (see §3).
One safety exception. If a message suggests thoughts of suicide or self-harm, your critto answers with care and shows you helplines. We check messages for this to protect people's lives. We keep only a count of how often it happens, with no names and no message content. Nothing else happens to your account.
1. Who is responsible
Nexferra LTD is the controller of your personal data.
| Company number | 16605957 (registered in England and Wales) |
| Registered office | 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom |
| privacy@critto.app | |
| EU representative (Art. 27 GDPR) | Being appointed; their details will be listed here. Until then, write to privacy@critto.app. |
| Data protection officer | N/A. For any privacy questions, write to privacy@critto.app. |
If you run Critto on your own computer ("self-hosted"), your data stays on your machine and this notice doesn't apply to it.
2. What we collect and why
| What | Examples | Why | Legal basis |
|---|---|---|---|
| Account | Email, name, sign-in id (from WorkOS, our sign-in provider), birth year and when you confirmed it | To make and run your account, and to keep Critto for adults | Contract. Legitimate interests for the age check (our AI providers are 18+). |
| Your crittos and chats | Crittos you create; every message, picture and file; memory notes (SOUL, MEMORY, USER, journal) and their earlier versions | That's the service: chatting, remembering, searching | Contract. We don't aim to collect sensitive information (see above). |
| Your AI sign-ins | The sign-in tokens for your ChatGPT, Claude, Grok, Muse or Antigravity account; keys you save; when you accepted the Antigravity warning | To use your own subscription for your crittos | Contract |
| The Den | The Den computer's files, the browser and the sites you sign in to there, saved logins and keys, what you ask crittos to do there | To let crittos do real computer work for you | Contract |
| Devices | Device names, when they last connected | To sign your apps in and keep them in sync | Contract, and legitimate interests (security) |
| Safety checks | Short excerpts of what a critto is about to do, saved memories, and web or mail text it reads, checked for tricks and risky actions; a 90-day log of what was blocked or asked | To protect your accounts and your Den | Legitimate interests (security) |
| Crisis support | Messages that might mean you're thinking of suicide or self-harm | To show you crisis lines. We keep counts only, for the reports the laws in California and New York require. | Protecting life (vital interests) and legitimate interests. Statistics with no names. |
| Plans and payments | Plan, subscription status, Den hours used, the country you connect from (to show prices in your currency) | To charge the right price and apply your plan | Contract |
| Emails | Your address, which emails we sent, and your email choices | Account emails (welcome, plan, payments, Den and deletion notices). Den-hours alerts, which you can turn off in Settings → Emails. Tips and news only if you ask for them. | Contract (account emails and alerts). Your consent for tips and news: tick the box at sign-up or switch them on in Settings → Emails. Turn them off there or with the link in any of them. |
| Sharing | Crittos you share publicly, the name you share as, who adopted them | To show your shared crittos and count adoptions | Contract |
| Your details and what crittos read | Before a critto sends, posts or types something, it's checked for your home or work address, phone, email, date of birth, location, your children's names with their school, and bank or ID numbers (we keep only which kinds were found and what you chose, never the text). A log of what each critto read of yours: which app, site or saved key, how many and when, never what was in them. How each critto may read each app. | To stop your details being shared without you saying so, and to show you what your crittos looked at | Contract, and legitimate interests (security) |
| Places nearby | When you ask a critto about places near you: roughly where you are (about 100 m), only if you allow it when your device asks, used for that one search and not stored; or a home or work address you save in Settings → Places (kept until you remove it). The places found (names, addresses, maps) are shown in the chat. | To find shops, cafes and the like near you, with opening hours and walking times | Contract. Your device's own location permission, which you can refuse or withdraw at any time. |
| Technical data | Internal ids, timings and errors from our server (never your messages or email); IP address at our network edge | To keep Critto working, fix bugs and stop abuse | Legitimate interests |
We don't use your data for advertising. We don't sell it. We don't use your chats to train AI models. We don't make decisions about you that have legal or similarly significant effects by automated means.
Automatic checks. These are explained here so nothing surprises you:
- Safety checks can stop a critto's action in the Den or ask you first. You always decide.
- Your details. If a critto is about to send your address, phone or similar and you didn't ask it to, you're asked first: send, remove it, or edit. You always decide.
- Crisis checks show a card with helplines. Nothing else happens to your account.
- The age question. If you tell us you are under 18, we delete the new account straight away.
3. Who we share it with
Your AI provider, which you choose and sign in to yourself:
- OpenAI (ChatGPT/Codex)
- Anthropic (Claude)
- xAI (Grok)
- Meta (Muse)
- Google (Antigravity)
What you say to a critto, plus what it remembers, goes to that company under your account. That company is responsible for it under its own privacy policy. Its settings apply, including whether it trains on your chats: check them. Deleting your Critto account doesn't delete what they already have; use their own tools for that.
Critto Smarts. If your crittos use Critto Smarts, the AI included with your plan, instead of your own account, what you say to a critto goes through our account at OpenRouter. OpenRouter passes it to AI model companies that have agreed not to keep or use it. We don't store it either: we only count how much was used. One exception: when one of Anthropic's models is picked for Critto Smarts, the request goes to Anthropic directly, and data may be retained by Anthropic for 30 days. Nothing goes to Anthropic otherwise.
Your own AI service (Custom AI, Advanced). If you connect an AI service yourself with your own key, your chats go to that service under your agreement with it.
Companies that help us run Critto (processors). They may only use your data to provide their service to us:
| Who | What for | Where |
|---|---|---|
| Hetzner | Our server | Germany |
| Boat (Dedale AI, Corp.) | Den computers | EU (Germany, Finland, France); US company |
| Cloudflare | Network, security, routine task execution, saved chat context, browser sessions and backups | Global; saved routine conversations and image storage in the EU |
| WorkOS | Sign-in | US |
| Resend | Sending email | EU sending, US company |
| OpenRouter, and the AI model, safety-model and speech companies it uses | Critto Smarts chats, safety and crisis checks, and voice; none of them keep it | US / various |
| Anthropic | Critto Smarts chats and Den work, only when one of their models is picked; data may be retained by Anthropic for 30 days | US |
| Maple | Server error and performance monitoring (no message content) | US |
| TinyFish | Web search and reading web pages for your crittos (what they look up; never who you are) | US |
| Geoapify | Places near you: maps, opening hours, walking times (what you look for and roughly where; never who you are) | Germany |
| Google (Google Maps Platform) | Places near you on the Pro plan (the same; never who you are) | US |
| MET Norway (Norwegian Meteorological Institute) | The weather in your morning brief (roughly where your saved home is, about 10 km; never who you are) | Norway |
| Google (Google News) | Local news in your morning brief (your town's name; never who you are) | US |
| Proton | Our privacy mailbox (privacy@critto.app), if you write to us | Switzerland |
Polar sells you Critto plans as the "merchant of record". It handles your card, billing address, receipts and tax, as its own controller, under Polar's privacy policy. We give Polar your email, name, our id for you, and your IP address and country, so it can charge the right tax.
Other people.
- Crittos you share publicly can be seen by anyone with the link, or in the gallery if you list them. They show the name you chose. Your memories, chats and keys are never shared.
- If someone adopts a critto you shared, their copy stays with them.
Authorities, only when the law requires it.
The current list is at critto.app/subprocessors.
4. Outside the UK and EU
Some of these companies are in the US. When your data goes there, we use the legal protections the UK and EU require:
- the EU-US Data Privacy Framework and its UK Extension where the company is certified;
- otherwise, the European Commission's standard contractual clauses with the UK Addendum, or the UK's International Data Transfer Agreement.
Ask us for a copy. Your provider-chosen AI company may also be in the US.
5. How long we keep it
| What | How long |
|---|---|
| Account, crittos, chats, memories, media | Until you delete them or your account |
| Earlier versions of memory notes | Until the note or your account is deleted |
| The Den after a paid plan ends | 90 days (we email you at day 0, 30 and 60), then deleted |
| Safety check log | 90 days |
| What your crittos looked at, and the details check log | 90 days |
| Crisis counts | 3 years, without your name |
| Records of emails we sent | Details cleared after 30 days |
| Sign-in devices you removed | 90 days after last use |
| Download-my-data files | About an hour |
| Server logs | 30 days |
| Monitoring data at Maple | 30 days |
| Copies at Resend | 30 days |
| Backups | Up to 60 days. A deleted account in a backup is never used, and is deleted again if a backup is ever restored. |
| Saved keys and passwords (the vault) | Until you delete them or your account. When your account is deleted, the key that unlocks them is destroyed at once, so they can't be read again. The encrypted backup of that key is gone within 30 days. |
| Deleted account | Deleted 7 days after you ask (you can change your mind until then). Polar keeps its own payment records as tax law requires. |
6. Your rights
You can:
- Get a copy of your data. Settings → Your data → Download my data gives you everything as files, or email us.
- Take it elsewhere (portability). The download is in common formats: Markdown and JSON.
- Correct it. Edit your crittos' memories yourself, or email us about your account details.
- Delete it. Settings → Your data → Delete my account, or email us.
- Object to what we do on the basis of legitimate interests, for example technical monitoring. Email us.
- Restrict our use while a complaint is checked.
- Turn off tips and news any time: Settings → Emails, or "Turn off" in any of them.
We answer within one month. If it is complicated, we may take up to two more months, and we tell you why. We may ask you to confirm it's really you.
Complaints. Tell us first at privacy@critto.app. We confirm within 30 days and tell you what we did. You can also complain to a regulator:
- UK: the Information Commissioner's Office, https://ico.org.uk/make-a-complaint/
- EU: the data protection authority where you live
7. Keeping it safe
What we do:
- Your apps connect over encrypted connections.
- Device tokens are stored scrambled (hashed).
- Each person's AI sign-ins run in their own locked-down space on our server.
- Den computers are separate per person.
- Backups are encrypted before they leave our server.
- Keys and passwords you save in the vault are encrypted with a key that is never stored with your data or in its backups. Your crittos never see them: Critto uses them for you, only on the sites you allow.
- Our monitoring never receives your messages.
If something goes wrong, we tell the regulator within 72 hours, and we tell you when it puts you at high risk.
7a. On your phone
- The app keeps your sign-in in the phone's secure storage (Keychain, Keystore), plus a cache of pictures from your chats.
- The home-screen widget shows your critto's name and a short status, never your messages.
- Talking instead of typing (only while you hold the mic button):
- Your recording goes to our server. It turns it into text using speech-to-text companies through OpenRouter, which don't keep it, or through your own Grok account if you connected one.
- We don't store the recording. The text comes back to you, and it becomes a message only if you send it.
- Reading replies aloud (off unless you turn it on) works the same way.
- If that isn't available, your phone's or browser's own speech service is used. It may send audio to Google (Android, Chrome) or Apple (iPhone) unless it can work offline.
- Android pairing: scanning the pairing QR code uses Google Play services, which may send Google anonymous diagnostics.
- No advertising or analytics code is in our apps.
8. Children
Critto is for adults (18+). We ask for your birth year once. We don't keep a full date of birth. If you tell us you're under 18, we delete the account at once.
9. People mentioned in chats
If someone tells a critto about you, that's stored as part of their chats. We can't practically tell everyone who is mentioned. If you think we hold data about you, email us and we'll help.
9a. Messaging your crittos
You can let people message a critto — by giving it its own email address, a "message my critto" link, or by connecting it to Telegram or Discord. This is off until you turn it on, and you choose who may: named contacts, anyone with the link, or nobody. A stranger's first message waits for you to allow or block them.
When you connect one of these, the messages to and from your critto, and the sender's name/handle, pass through that service: your email provider and Resend (email), Telegram or Discord. We process the sender's identifier and message on your behalf so your critto can reply and take messages for you. Your crittos treat people outside your circle as outsiders and don't share your private information with them unless you've allowed it. The sub-processors list at critto.app/subprocessors names Telegram and Discord.
10. Cookies and device storage
The Critto apps store a sign-in token on your device so you stay signed in. That's needed for the service to work, so we don't ask first. Our web pages use no advertising or analytics cookies. See the cookie notice.
11. Changes
We'll tell you in the app and by email before any important change takes effect. Last updated: 2026-10-01.