Mutuals, operated by Flarewave AI Limited
Room 12, 6/F, 111 Tung Chau Street, The Cloud, Kowloon, Hong Kong
Last updated: 15 October 2026 · Effective: 15 October 2026
The rest of this page is the detail. It is worth reading the sections on AI providers and on memory, because they are the parts people are usually surprised by.
Flarewave AI Limited is the data controller for Mutuals. We decide what is collected and why.
Mutuals is a service where you talk to AI characters we call companions. They are software. They are not real people, no human writes or reviews their replies, and everything they say is generated. This matters for privacy because it shapes what happens to what you type: your messages are sent to the AI providers listed in section 5 so a reply can be produced, and they are screened automatically for content our Terms forbid. A person on our side reads a conversation only when the screening flags it, when you report it, or when we have to investigate abuse or comply with the law (section 10).
Room 12, 6/F, 111 Tung Chau Street, The Cloud, Kowloon, Hong Kong privacy@mutuals.life
When you make an account: your name, email address, and whether the email is verified. If you sign in with Google or Apple, we receive your name and email from them, not your password.
Your answers to the two onboarding questions: how you describe yourself, and who you would like to meet. These order the roster; they do not filter anyone out.
Your conversations. Everything you write to a companion, and everything it writes back. This is the substance of the service and we store it so your threads persist.
Memory. As you talk, we extract and store things about you (facts you mention, events you describe, plans, preferences, people in your life) so a companion can refer to them later. We may also store mathematical representations of your messages ("embeddings") so relevant memories can be found. This is a profile of you, built from what you say. It is the feature that makes companions feel like they know you, and you should understand it as such.
Technical and usage data: device identifier, IP address, language, timezone, approximate region derived from your device settings, and app interactions. We use your IP address and device identifier to enforce free-tier limits, without them, anyone could reset their free messages by clearing cookies.
Payment records: what you bought, when, and the transaction reference. We never see or store your card number. Card details go to Apple or Google directly.
Reports you send us. If you report something a companion said, we store the message you reported, the reason you chose, any note you add, and, when you are signed in, which account sent it. We keep reports after the conversation is deleted, because a report that disappears with the evidence cannot be acted on.
Support correspondence when you write to us.
Conversations with a companion often become personal. People discuss their health, their relationships, their sex lives, their religion, their politics, their fears.
Under European law some of that is special category data, which has stronger protection. We do not ask for it and we do not seek it out, but the service cannot stop you sharing it, and once you do, we hold it.
Where you knowingly share such information in a conversation, we rely on your explicit consent to process it as part of providing the service. You can withdraw that consent by deleting the conversation or your account. Please think about what you put in a chat window, the same way you would with any online service.
For users in the EEA and UK, GDPR requires us to name a legal basis:
| What | Why | Legal basis |
|---|---|---|
| Account, authentication | To give you an account and keep it secure | Performance of a contract |
| Conversations, memory | To provide the service you signed up for | Performance of a contract |
| Sensitive information inside conversations | To provide the service | Explicit consent (Art. 9(2)(a)) |
| Payments, billing records | To take payment and meet accounting duties | Contract; legal obligation |
| Device ID, IP address | To enforce free limits and prevent abuse | Legitimate interests |
| Security, fraud and abuse prevention | To protect the service and its users | Legitimate interests |
| Product analytics, including which purchases are made | To understand what to improve and what sells | Legitimate interests |
| Marketing email, push notifications | To tell you about the service | Consent (withdraw any time) |
Where we rely on legitimate interests, we have weighed them against your rights, and you may object, see section 9.
We use other companies to run Mutuals. They receive only what they need.
AI providers: this is the important one. Your messages, the companion's persona, and relevant memories are sent to third-party AI companies so a reply can be generated, and your messages are also screened by one for content our Terms forbid. Today that is OpenRouter, which routes to model providers including OpenAI, Anthropic, Google and others. The exact model may change without notice.
We select providers that commit contractually not to train on customer data. We cannot audit them, and we do not control them. If this is unacceptable to you, do not put anything in a conversation you would not want a third party to process.
Everyone else:
| Provider | What they get | What for |
|---|---|---|
| Google Cloud | Server infrastructure and the database, including conversations | Running the API and hosting our data |
| Cloudflare | Web traffic, images and video | Serving the site and media |
| Apple / Google | Purchase and subscription events | In-app payments |
| OneSignal | A device push token | Push notifications |
| Amplitude | Your account ID, a device identifier, which features you used, and what you bought (the product, its price and currency, and whether it was a renewal or a refund). Never message content | Product analytics |
| Sentry | Crash and error reports, with no message content or account identifiers | Diagnosing faults |
We do not sell your personal data, and we do not share it with advertisers or data brokers.
We may disclose data where the law requires it, to enforce our Terms, or to protect someone's safety. Authorities. If a chat shows a crime, or a real risk of harm to someone, we may report it to the police or other authorities and give them what they need, such as the conversation, your account details, and device and purchase identifiers.
Flarewave AI Limited is in Hong Kong, and the European Commission has not decided that Hong Kong offers adequate data protection. Our infrastructure and our AI providers are also outside the EEA, including in the United States.
This means your data leaves the EEA and is processed in countries whose privacy laws differ from, and may offer less protection than, European law, including broader government access to data.
Where we transfer personal data out of the EEA or the UK we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with supplementary measures such as encryption in transit and at rest and access controls. You may request a copy of the relevant clauses from privacy@mutuals.life.
We are telling you this plainly rather than burying it, because for some people it is a reason not to use the service.
| Data | Retention |
|---|---|
| Account details | While your account is open |
| Conversations | While your account is open (see below) |
| Memory (facts, episodes, embeddings) | While your account is open |
| Free-tier counters (device, IP) | 30 days |
| Guest sessions | 30 days from last use |
| Payment records | 7 years, as tax and accounting law requires |
| Support correspondence | 2 years |
| Flagged messages (see section 10) | Until reviewed, then as long as we need them to enforce our Terms or meet a legal duty, including after the account is deleted |
About deleting conversations. When you delete a conversation in the app it stops being shown to you and stops being sent to the AI. It is marked deleted rather than erased immediately, so that an accidental deletion can be undone and so the companion's memory stays coherent.
When you delete your account, it all goes: conversations, memory, embeddings, account. Payment records are kept only where accounting law requires, and only the transaction facts, not your conversations. Messages our safety screening flagged are kept as the table above says.
Encryption in transit and at rest, hashed passwords, access controls, and infrastructure from established providers.
We do not claim your conversations are private from us. We can technically access stored data where we need to, to investigate abuse, to comply with the law, or to fix a fault. We restrict that access and do not read conversations casually. If you need genuinely private communication, an entertainment chat service is the wrong tool.
No online service is perfectly secure.
If you are in the EEA or UK, you have the right to: access your data; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent at any time; and complain to your national data protection authority. You may complain to a supervisory authority without contacting us first, though we would rather you gave us the chance.
If you are in Hong Kong, the Personal Data (Privacy) Ordinance gives you the right to request access to and correction of your personal data. You may complain to the Privacy Commissioner for Personal Data.
If you are in California, you may request disclosure or deletion of your personal information and opt out of "sharing" as defined by the CCPA. We do not sell personal information.
To exercise any of these, email privacy@mutuals.life. We respond within 30 days. We may need to verify your identity first: we will not hand over an account's conversations to whoever asks.
Account deletion is also available directly in the app.
Companion replies are generated automatically by AI, and memory is extracted automatically from your messages. No automated decision is made about you that produces legal effects or similarly significantly affects you: we do not use AI to decide about credit, employment or insurance. Safety screening, below, can lead to automated decisions about your account.
Free-tier limits are enforced automatically. If a limit affects you wrongly, contact us and a person will look at it.
Safety screening. All chats are reviewed automatically by AI, through the providers in section 5, for content section 5 of our Terms forbids. A flagged message is stored with the part of the conversation around it, and a person on our team may read it. Depending on what is found, we may stop a reply or suspend or close an account. If you think a decision about your account was wrong, write to privacy@mutuals.life.
Mutuals is for adults only, 18 and over. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it and close the account. If you believe a minor is using Mutuals, tell us at privacy@mutuals.life.
We will update this policy as the service changes. For material changes we give notice in the app or by email before they take effect. The date at the top always shows the current version.
Flarewave AI Limited Room 12, 6/F, 111 Tung Chau Street, The Cloud, Kowloon, Hong Kong
Privacy: privacy@mutuals.life General: support@mutuals.life