Privacy Policy

1. Scope and operator

This policy explains how LewdByte handles personal data when you use the LewdByte website, account service, and Windows application. For questions or privacy requests, contact support@lewdbyte.com.

2. Data handled by the website

When you create or use an account, we process:

• Your email address, display name, password hash, and account timestamps.
• The date you accepted the Terms and confirmed that you are at least 18.
• Session and security data, including IP address, user agent, device name, login timestamps, token status, and expiry timestamps.
• Password-reset records, delivery status, and the technical data needed to prevent abuse.

We do not store plaintext passwords. Authentication and reset tokens stored in the database are represented by cryptographic hashes.

3. Data that stays on your device

Your chats, prompts, generated replies, contacts, character settings, memories, voice references, imported files, and downloaded model weights are stored locally by the desktop application. LewdByte does not upload those items to your web account or use them to train models. They leave your device only when you choose to export, copy, or share them outside the app.

The Windows app encrypts its local conversation database with SQLCipher. Its random database key and sensitive application settings are protected for the current Windows user with Windows Data Protection API (DPAPI). Private session keeps new conversations in memory instead of saving them. Keep the encrypted database and its matching key file together when making a backup; losing the protected key makes the database unreadable.

4. App connections and third-party downloads

The desktop app connects to LewdByte services for account authentication, session validation, installer and runtime downloads, and release metadata. When you choose to download a third-party model, the file is fetched separately from the source identified in the app. That source may receive ordinary network data such as your IP address and user agent under its own privacy policy. LewdByte does not receive your model prompts or outputs as part of that download.

5. Why we process account data

• To create your account, authenticate you, and provide downloads and trusted-device access.
• To secure the service, rotate or revoke sessions, prevent abuse, and investigate technical incidents.
• To deliver password-reset messages and respond to support or privacy requests.
• To comply with legal obligations and protect users, the service, and third-party rights.

Where data-protection law requires a legal basis, these purposes rely on performance of our Terms, our legitimate interests in operating and securing the service, compliance with law, or consent where we expressly request it.

6. Cookies

We use strictly necessary HttpOnly authentication cookies to keep you signed in and protect account requests. They are not advertising or cross-site tracking cookies. Access and refresh credentials are encrypted before being placed in these cookies.

7. Service providers and disclosure

We may use infrastructure, database, security, and email-delivery providers to operate the account service. They receive only the data needed for their function and act under applicable contractual and confidentiality obligations. We do not sell personal data or share it for targeted advertising. We may disclose limited data when required by law or when reasonably necessary to protect users, the service, or legal rights.

8. Retention

Account data is kept while your account remains active. Authentication, reset, and security records are kept only as long as reasonably needed to operate the service, enforce token expiry and revocation, investigate abuse, and resolve legal claims. The criteria include the applicable token lifetime, session status, account status, security needs, and any mandatory legal retention period. After an eligible deletion request, we delete or anonymize account data unless retention is required by law or for a legitimate legal claim. Local desktop data remains under your control and can be removed from the app or device directly.

9. Security

We use password hashing, short-lived access credentials, rotating refresh sessions, encrypted HttpOnly cookies, origin checks, rate limits, and session revocation. No system is completely secure, so keep your device and password protected and notify us if you suspect unauthorized access.

Local encryption protects copied or stolen storage files from offline inspection. It cannot protect data from malware or another process already running with access to your unlocked Windows account while the app can decrypt that data.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data, and to withdraw consent where processing depends on consent. You may also have the right to complain to your local data-protection authority. Send requests to support@lewdbyte.com. We may need to verify that the account belongs to you before completing a request.

11. Adults only

LewdByte is intended only for people aged 18 or older. We do not knowingly offer the service to minors. If we learn that a minor created an account, we may disable and delete it.

12. Changes

We may update this policy when our data practices or legal obligations change. We will post the revised policy with a new effective date and provide additional notice when a change materially affects your rights.