Privacy Policy
Last updated: October 2, 2026
Youniversal AI operates the Youniversal website, creative tools and companion app. This policy explains how information is used when you create and explore worlds or connect another application. Contact adam@youniversal.ai with privacy questions or requests.
Information we process
- Account and profile: email, password hash when you use a password, sign-in provider identity, and profile information you choose to provide. We do not store your password in readable form.
- Creative work: universes, characters, creatures, places, items, stories, conversations, prompts, uploaded files, generated images, audio, video, games, world progress and configuration. Other people's information may appear in content you submit; only submit information you have the right to use.
- Purchases: pass status, Sparks grants and usage, transaction identifiers, refunds and billing status. Stripe or Apple processes payment information; we do not receive your full payment card number.
- Service and device information: requests, errors, security events, IP and browser/device information, session identifiers and usage needed to operate and support the service. With permission, the companion app registers notification and Live Activity tokens with Apple.
- Connected applications: OAuth grants and scopes you approve, app identifiers, and the data exchanged through those grants. You can revoke a connected application's future access in account settings.
We use this information to operate requested features, deliver generation results, authenticate you, manage purchases, prevent abuse, recover accounts, investigate failures, and meet applicable legal obligations. Where required, our bases include performing our contract, your consent, legitimate interests in operating and securing the service, and legal obligations. Consent can be withdrawn for future optional processing.
Service providers and sharing
The providers used depend on the features you choose and the generation configuration. They may process the content, account information or technical information needed for their role:
| Provider | Role | Privacy information |
|---|---|---|
| Vercel | Website hosting, server functions, Sandbox execution, Blob media storage, AI Gateway routing, Web Analytics and Speed Insights | Vercel privacy notice |
| Neon / Databricks | Application database | Neon privacy information |
| Replicate | Image, audio, video and model generation | Replicate privacy policy |
| AI model providers, including OpenAI, Anthropic, Google and xAI | Processing prompts, relevant context and media for selected AI features, directly or through AI Gateway | OpenAI, Anthropic, Google, xAI enterprise information |
| TypeSafe AI (Jev) | Processing submitted prompts and selected world context to interpret requests and rank or select relevant suggestions and configurations, directly or through AI Gateway | TypeSafe AI privacy policy |
| Mureka | Music and vocal generation from your prompts, lyrics and optional audio references | Mureka API privacy policy |
| Stripe | Web payments, passes, Sparks, refunds and fraud prevention | Stripe privacy policy |
| Apple | App Store purchases, optional Apple sign-in, push notifications and Live Activities | Apple privacy policy |
| Optional Google sign-in | Google privacy policy | |
| Resend | Account verification, recovery, invitations and service emails | Resend privacy policy |
Models available through our generation hosts also include ByteDance models, such as Seedance, and xAI models. A model author is not necessarily the service receiving data directly: for hosted models, requests go through the configured service, such as Replicate or AI Gateway, under its provider arrangements.
A generation request can include relevant world context, uploaded references and prompts; it is not limited to the last sentence you typed. Models and providers can vary with the requested feature and style. Connected third-party apps receive the data authorized by their granted scopes and have their own policies. Do not submit secrets or sensitive personal information that is unnecessary for your creation.
OpenAI inputs and outputs sharing
As disclosed in our previous policy, our OpenAI organization has enabled sharing of inputs and outputs for service and model improvement. Content processed through that organization may therefore be used by OpenAI for those purposes. Contact adam@youniversal.ai about available choices before submitting information you do not want processed under this setting. A future setting change does not recall data already processed by a provider. This disclosure does not assert that other providers have the same configuration.
Content you publish, shared worlds and media accessible by a public link can be viewed by others. Removing your account cannot retrieve copies others previously downloaded or data they independently control. We may disclose information when legally required, to protect rights and security, or in connection with a business transfer subject to applicable protections.
Security, retention and deletion
Access controls protect account data, authentication proofs and administrative actions. Password recovery links expire after 30 minutes and are single-use. Export archives are stored privately, require the requesting account to sign in, and expire after seven days. No system can guarantee absolute security.
Our scheduled application cleanup uses the following limits. Processing is batched; provider outages or a pending deletion review can delay physical removal:
| Data | Retention in the application |
|---|---|
| Password reset proofs and security rate-limit buckets | Removed after their expiry; reset links stop working after 30 minutes |
| Expired email-verification proofs and MCP web sessions | Eligible for removal one day after expiry |
| Native sign-in handoff proofs | Eligible for removal one hour after expiry |
| Raw IP address and browser user-agent fields on MCP web sessions | Cleared after 30 days, without ending an otherwise valid session |
| Compose suggestion cache and its hashed IP | Removed one day after cache expiry, after its processing lease ends |
| Duplicate generation debug traces | Cleared 30 days after a terminal job's last update; saved prompts, results, costs and retry identity remain with the account |
| Completed account export/deletion job metadata | Removed after 90 days; private archive cleanup pointers are retained until object cleanup finishes |
| Empty guest accounts | Eligible after 30 days if unchanged and no content, billing, access or other referenced records exist |
| Private export archives | Seven days from creation; sign-in and ownership checks also apply |
| Recovery media copies | Removed after a source is absent from the inventory for 30 days, or through account deletion; active sources continue to have a recovery copy |
We keep saved account content while needed to provide the service. In Studio → Settings → Account, you can request an export or delete your account. Deletion disables sign-in, cancels web subscriptions, removes the profile, revokes connected access and queues owned worlds and related data for removal. Background tasks retry failures in database, media and payment-provider cleanup. Shared media and older assets without reliable ownership records may need a support review; we do not silently delete another person's copy. We send confirmation when processing is complete. Apple subscriptions must also be cancelled in Apple subscription settings. We revoke stored Sign in with Apple tokens as part of deletion. Older app versions did not supply revocable tokens; if yours is unavailable, remove Youniversal under your Apple Account’s Sign in with Apple settings. Missing historical tokens do not prevent deleting your Youniversal account.
We retain limited transaction, usage and security records where needed for accounting, fraud prevention, dispute resolution and legal obligations. Payment providers can independently retain records for their legal obligations. Deletion processing temporarily keeps contact and ownership details needed to finish or investigate the request. Database recovery branches expire after their configured recovery window (the pre-migration backup gate requires a seven-day branch). Hosting, email and generation-provider logs follow their own configured or contractual schedules; they are not a promise of immediate erasure from every backup. If recovery from a backup is required, outstanding deletion requests must be reapplied before restored data is put back into service.
Your choices and rights
Account settings let you correct profile details, change or recover your password, revoke connected apps, request a data archive and request deletion. Exports include account-owned records, conversations, generation inputs and results, media references and billing/Sparks records. They exclude authentication secrets and other people's private accounts. Large or unusual exports may require support handling.
Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, or receive portable information. Email adam@youniversal.ai for those requests, problems with self-service tools, information about providers or retention, or to appeal a response. We verify identity before releasing or changing private account data. You may also contact your relevant data protection authority. Exercising privacy rights does not itself reduce your access to the service.
Authentication cookies and local storage keep you signed in and preserve choices or world progress. Browser controls can clear local storage or cookies; doing so may sign you out or remove progress kept only on that device. Optional permissions, including notifications, can be changed in device settings.
International processing, children and changes
Our providers may process data in countries different from where you live. Applicable contractual and legal safeguards govern those transfers. Contact us for information relevant to your account.
The service is not intended for children under 13. If you believe a child has provided personal information, contact us so we can investigate and remove it where appropriate.
We update this policy when our practices change and identify the latest update date above. Material changes will be communicated as required. Contact: adam@youniversal.ai.