Second Sun

Privacy policy

Last updated: July 21, 2026Version française

Mirra World, Inc. (“we,” “us,” “our”) operates Second Sun, an iOS app where you talk with AI characters. This policy explains what data we collect, how we use it, how long we keep it, and your rights. It covers the Second Sun app, our website, and the limited Telegram beta that preceded the app.

1. Information we collect

Information you provide:

  • Account: your Apple account identifier, from Sign in with Apple. We do not ask for your name, email address, or phone number to create an account.
  • Age band: the age range you select at signup (all options are 18+)
  • Timezone and city choice: the timezone you confirm at signup, used to place your character’s world clock. We never collect your precise location.
  • Messages: everything you send to a character
  • Photos: images you choose to send to a character. We do not use your photos for facial recognition, biometric identification, or emotion profiling.
  • Support and feedback: anything you submit through the in-app forms (problem reports, feedback, message reports, character pitches), including an email address if you provide one, and basic diagnostics with problem reports (app version, iOS version, device model)

Information we derive:

  • Character memory: facts and summaries extracted from your conversations (for example your name or interests, if you share them) so characters can remember what you’ve told them
  • Safety signals: automated systems and AI assessment screen conversations for signs of distress so crisis resources can be surfaced — see our Safety page
  • Personalization signals derived from your conversations to shape how characters respond to you

Information collected automatically:

  • Device push-notification tokens
  • App version, and daily usage counts
  • Subscription status: whether you have an active subscription, the plan, and the billing period. Payment is handled entirely by Apple — we never see or store your payment details.

What we don’t collect:

  • No advertising or tracking SDKs, and no ad identifiers
  • No precise location
  • No contacts, and no access to your photo library beyond photos you choose to send
  • Our website sets no cookies and runs no analytics

2. How we use your information

  • To operate Second Sun: your messages and photos are processed by AI models to generate character responses, and stored so conversations continue across sessions
  • To maintain character memory across your conversations
  • To keep you safe: screening for signs of distress and surfacing crisis resources
  • To manage subscriptions and apply fair-use limits
  • To deliver push notifications
  • To respond to support requests and reports

We do not use your conversations or photos to train AI models. We do not sell your personal information, share it for advertising, or use it for any form of cross-context behavioral advertising.

3. Sensitive information

Conversations with a companion are personal. What you write may reveal sensitive things — your emotional state, health, relationships, or beliefs. We treat all conversation content with the same elevated care: it is used only to operate the service and for safety, never for advertising, and never sold. Where the law of your region requires a specific legal basis for processing sensitive information, we rely on your consent, given when you create your account and start a conversation; you can withdraw it at any time by deleting your account.

4. AI providers and international transfers

Character responses are generated by third-party AI providers. Your messages and photos are transmitted to them for processing. We currently use, or may use, the following providers:

  • Moonshot AI — international service operated by its Singapore entity, Moonshot AI PTE. LTD., with data stored in Singapore; the company is headquartered in China
  • Anthropic — based in the United States
  • OpenAI — based in the United States
  • Black Forest Labs — based in Germany

This means your conversation content may be processed in the United States, Singapore, or Germany. Providers receive your content to generate responses. Anthropic’s and OpenAI’s API terms prohibit them from training their models on submitted content. Moonshot’s standard platform terms permit it to use submitted content to improve its services, which can include model training. Because Moonshot is headquartered in China and has China-based affiliates, access by Chinese authorities cannot be fully excluded — and data processed in any other country may likewise be accessible to that country’s authorities under its local law. Where your local law requires safeguards for these transfers (for example the UK, Australia, New Zealand, or Quebec), we rely on the contractual protections in our agreements with these providers and remain responsible for your data when it is processed on our behalf; contact us for more information about these safeguards.

5. Other service providers

  • Apple — sign-in, push notifications, and all billing
  • RevenueCat — subscription management; receives your account identifier and purchase state, never your conversations
  • Cloud hosting and storage providers in the United States, which store our database and media
  • An error-monitoring service that receives technical context when server errors occur — not message content

These providers process data solely to run Second Sun. We do not sell or share your personal information. Because we don’t sell, share, or track, there is nothing to opt out of — and we honor Global Privacy Control signals as a matter of course.

6. Data retention

  • Messages, photos, and character memory are retained while your account exists, and deleted when you delete your account
  • Starting over with a character archives that conversation — it disappears from the app, but it is retained on our servers until your account is deleted
  • AI model call logs are retained for 30 days, then deleted
  • Push-notification tokens are deleted after roughly 60 days of device inactivity
  • Safety event records are retained while your account exists and deleted with it, unless the law requires us to keep them longer
  • Support requests and feedback are retained as long as needed to handle them

7. Account deletion

You can delete your account any time in Settings → Delete account, or by emailing us. Deletion is immediate: your conversations, photos, character memory, and account records are erased from our live systems right away, and residual copies in encrypted backups expire within 30 days. We also ask Apple to revoke the sign-in connection.

One narrow exception: we keep a minimal anti-abuse record — your Apple account identifier and the date you first talked with each character — so that free-tier limits cannot be reset by deleting and re-creating an account. This record contains no conversation content.

8. Your data, your controls

  • Export: request a copy of your data in Settings → Export my data; we’ll deliver it within 28 days
  • Correction: email us to correct anything we hold about you, including facts a character has remembered wrongly
  • Deletion: in-app, immediate (section 7)

9. Your rights by region

United States: depending on your state, you may have rights to know, access, correct, and delete personal information, to opt out of sale, sharing, or targeted advertising (we do none of these), and to limit use of sensitive personal information (we already limit it to operating the service). We will never discriminate against you for exercising privacy rights, and you may appeal a decision by replying to our response.

Canada: you may access and correct your personal information (PIPEDA and, in Quebec, Law 25). Your conversation data may be processed outside Canada, including in the United States and Singapore, as described in section 4. This policy is also available en français. You may complain to the Office of the Privacy Commissioner of Canada or your provincial regulator.

United Kingdom: under UK GDPR you have rights of access, rectification, erasure, restriction, portability, and objection. We process your data to perform our contract with you (operating the service), for our legitimate interests (service integrity and safety), and on your consent for sensitive content (section 3). We respond within one month. You may complain to the ICO (ico.org.uk).

Australia: you may access and correct your personal information under the Australian Privacy Principles. Section 4 describes overseas disclosures. Complaints can go to us first, then to the OAIC (oaic.gov.au).

New Zealand: you may access and correct your personal information under the Privacy Act 2020; we respond within 20 working days. Section 4 describes overseas disclosures and the safeguards we rely on. Complaints can go to the Office of the Privacy Commissioner (privacy.org.nz).

10. Automated processing

Second Sun personalizes character behavior and screens conversations for safety using automated processing, as described above. We do not make solely automated decisions about you that have legal or similarly significant effects. If an automated safety or fair-use system affects your account and you believe it got things wrong, you can contact us and a human will review it.

11. Security

  • Data is encrypted in transit (TLS) and at rest
  • Media and logs live in private storage, and every request to our servers is authenticated and checked against the account that owns the data
  • Messages are not end-to-end encrypted — our servers must read them for the AI to respond

If a breach ever puts your data at risk, we will notify you and the relevant regulators as required by the law of your region.

12. Children’s privacy

Second Sun is not intended for anyone under 18, and is not directed to children. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it and close the account promptly.

13. Telegram beta

Before the iOS app, Second Sun’s first character ran as a limited Telegram beta. If you used it, Telegram (as a messaging platform) processed your messages under its own privacy policy, and we stored your Telegram user ID and display name. Email us to delete your beta data.

14. Changes to this policy

We may update this policy from time to time. We will notify you of material changes through the app, and always update the date at the top of this page.

15. Contact

Mirra World, Inc. is the data controller for Second Sun. For any privacy question or request, email contact@secondsun.ai — we verify requests against your account and respond within the timelines above.