Privacy Policy

Hollow is operated by Hollow by DXVIL ("we", "us"), based in Czechia, European Union. For any privacy question, request or complaint, contact us at dev@dxvil.com. We are the data controller for the personal data described in this policy.

Account data. Email address, username, display name, bio, avatar, and authentication identifiers. If you sign in with dxvil Account or Google, we receive the basic profile claims (name, email, avatar) those providers send us.

Content you create. Characters, stories, worlds, images, comments, likes and follows, together with the privacy setting you choose for each item (Private, Followers, or Public).

Billing data. If you subscribe to Premium, our payment processor Stripe collects and stores your payment details. We only receive and store your subscription status, plan, billing period dates and Stripe customer/subscription identifiers — never your card number.

Technical data. Server-side logs needed to keep the service secure and running (timestamps, request metadata, error reports). We do not run advertising trackers or sell data to anyone.

Metadata removal. Every image you upload is re-encoded in your browser before it leaves your device. This process strips EXIF metadata — including GPS location, camera model and capture timestamps — so the stored file contains none of it.

Storage. Images are stored in a private storage bucket under your account and kept until you delete them or delete your account. They are not temporary: your gallery is yours to keep. Files are served through short-lived signed links (valid for about one minute) so they cannot be hot-linked or endlessly re-shared.

No AI training. Your images, stories and other content are never used to train machine-learning or AI models, and are never sent to third-party AI APIs.

No biometric processing. We do not perform facial recognition, face detection, or any analysis that constructs biometric templates or identifies a person in an image. Nothing you upload is processed under GDPR Article 9 special-category rules.

Contract (Art. 6(1)(b)). Creating and securing your account, storing and serving your content, and providing the Premium subscription you purchase.

Legitimate interest (Art. 6(1)(f)). Security logging, abuse prevention, and keeping the service reliable. You may object to this processing at any time.

Legal obligation (Art. 6(1)(c)). Retaining billing records where tax and accounting law requires it.

Consent (Art. 6(1)(a)). Where we rely on consent — for example your acceptance of these terms at sign-up — you may withdraw it at any time by deleting your account.

We do not process special-category data under Art. 9.

Lovable Cloud — hosting, database, authentication and file storage (EU/US infrastructure, standard contractual clauses where data leaves the EEA).

Stripe — payment processing for Premium subscriptions. Stripe is PCI-DSS Level 1 certified; your card details go directly to Stripe and never touch our servers.

dxvil Account (account.dxvil.com) — optional single sign-on identity provider.

Google — optional sign-in provider.

We do not use analytics, advertising or AI sub-processors.

Under GDPR (and CCPA/CPRA where applicable) you have the right to access, correct, export and erase your personal data, to restrict or object to processing, and to data portability.

Self-service. You can edit or delete any character, story, world, image or comment directly in the app. Settings → Delete account erases your profile, content, images and subscription records in one step.

By request. Email dev@dxvil.com for an export of your data or any other request. We respond within 30 days.

You may also lodge a complaint with your local supervisory authority (in Czechia: Úřad pro ochranu osobních údajů).

Content is kept until you delete it or close your account. Billing records are retained for the period required by accounting law. Access to content is enforced at the database level according to the privacy setting you choose — Private, Followers or Public — not merely hidden in the interface. Passwords are handled by our authentication providers and are never stored in plain text.

Hollow is not directed at children under 16. If you believe a child has created an account, contact us and we will delete it.

If we change this policy materially, we will announce it in the app before it takes effect. The date at the top always shows the current version.