Privacy Policy

Lilia is a chat app with long-term memory. It is operated by an individual, not a company.

Contact: liuyuchuan816@gmail.com

When you create an account and use Lilia, we store:

• Account data: username, nickname, a hash of your password (not the password itself), language preference, and timezone
• Optional LLM settings you enter (API base URL, model name, and API key). The key is stored encrypted
• Your chat messages, including one-to-one and group chats
• Memories extracted from those chats (short facts and events), and a profile we generate for you with each AI character
• Vector embeddings of those memories, used to recall them in later chats
• A login cookie so you stay signed in

We also process, for a limited time:

• Your IP address, to limit abusive sign-up and login attempts (short-lived rate-limit counters in Redis)
• Job records in Redis that identify which chat should be processed for memory extraction (user id and session id, not the full message text)
• Operational logs such as errors. We do not currently log full chat transcripts on purpose. An error log may still include a username, a request path, or a short snippet of a failed request

On sign-up we use Cloudflare Turnstile to tell humans from bots. Cloudflare receives the verification token and whatever data their widget collects. See Cloudflare’s own privacy policy for that part.

We do not use advertising SDKs or third-party analytics products.

• To run the product: sign you in, store chats, and show your contacts and groups
• To give each AI character memory of you: we send recent chat text to a language model to extract memories, embed them, periodically maintain them, and build a profile
• To keep the service stable: rate limits, error logs, and abuse prevention

Our servers. The app database (MySQL), the vector store (Chroma), Redis, and application logs run on a Vultr virtual machine in the western United States. If we move the server, we will update this page.

Default language model and embeddings. Chat replies (unless you set your own API), memory extraction, memory maintenance, profile generation, and embeddings are sent to SiliconFlow (硅基流动), a company based in China. We currently use a DeepSeek model they host. SiliconFlow receives the text we send them. We do not control how long they keep it, whom they share it with, or where they process it.

Your own LLM API. If you save your own OpenAI-compatible base URL, API key, and model, chat completions go to that endpoint instead of our default. Memory extraction, embeddings, and related background jobs still use SiliconFlow.

We do not sell your information. We do not show ads.

Because this is a memory product, the sensitive part is not only that we store your chats, but that we derive lasting notes and a profile from them, and that copies of that text go to SiliconFlow.

We keep your account, chats, memories, embeddings, and profiles until you delete your account.

Login cookies last for a limited number of days set on the server (on the order of weeks).

Rate-limit keys in Redis expire on a short schedule (minutes to about a day, depending on the limit). Memory job records in Redis are removed after they complete or fail, aside from a small recent history.

• Change nickname, password, language, and LLM API settings while signed in
• Delete your account in Settings. That permanently deletes your user row in our database (chats, memories, profiles, and login sessions go with it) and deletes your vectors in Chroma
• Email us if something did not delete and we can still reach it on our servers

We cannot delete copies that SiliconFlow (or your own LLM provider) may already have processed.

There is no in-app export of all your data yet. If you need a copy, email us and we will do what we reasonably can.

We set one first-party cookie: an HTTP-only session cookie used to keep you logged in. It is marked Secure in production and SameSite=Lax.

Cloudflare Turnstile may set its own cookies during registration.

Lilia is not directed at children under 13. Do not create an account if you are under 13.

If you use Lilia from outside the United States, your information is transferred to the United States (our Vultr server) and to China (SiliconFlow). We do not offer a regional storage option.

We will change this page when the product changes (for example a different default model provider or server region). The date at the top is the last update.