Privacy Policy

Screenshots are uploaded directly to private object storage. The storage bucket is not publicly readable and the file path is generated by our server rather than by your browser, so one person's upload cannot be written into another person's space.

Images are read by our servers to send to the AI provider that performs the analysis, and to verify their type and size before anything is processed. They are not served to the public web, and they are never attached to a share card.

Only the session or account that created a case can open it. Ownership is checked on our servers on every single read. If you are signed out, ownership is tied to a signed cookie we issue; if you are signed in, it is tied to your account. When you create an account, cases from your signed-out session move across to it.

Knowing a case link does not grant access. A request for a case you do not own returns exactly the same response as a request for a case that does not exist, because confirming that a particular case exists would itself reveal something.

Our staff do not read cases as a matter of course. Access to the production database is limited to operating the service — investigating a fault, or responding to a legal obligation described below.

Analysing a conversation requires sending it to a third-party AI provider. There is no way around this and you should know it before you upload anything. Your screenshots and messages are transmitted to the provider that performs the analysis, and follow-up conversation is transmitted to the provider that handles chat.

We select providers on the basis that they do not train on data submitted through their API. We deliberately do not route this product's content through free or experimental model tiers where the data-handling terms cannot be pinned down.

We do not send your email address, account identifier or payment details to any AI provider. They receive the evidence and the context needed for the analysis, and nothing that identifies you.

Nothing is public unless you explicitly publish it. Sharing creates a new object with its own address, unrelated to your case's identifier.

A share card contains only:

• The score and its band.
• One line of text, with identifying details removed.

Before publishing, that line is scrubbed of phone numbers, email addresses, social handles, links, street addresses, long digit sequences, and the name you gave the other person — which is replaced with a role word such as “her boyfriend”. You are shown the exact text before it goes anywhere.

A share card never contains your screenshots, the messages, your follow-up conversation, your case identifier, or anything that links back to you. You can revoke a share at any time, which immediately stops the link resolving.

Expiry runs automatically on a schedule rather than waiting for you to ask, and it removes the stored images along with the case.

Deleting a case removes the case, its stored screenshots, the memories derived from it, and any share card, and cancels any queued processing. Deleted memories cannot be recalled by later conversations.

To delete everything, delete your cases and then email privacy@bitchplease.app from your account address asking for account deletion. We will remove your account, your cases, your stored evidence and your memories.

Records we must keep for legal and accounting reasons — such as the fact that a payment occurred — are retained as required by law. These contain no conversation content.

We give everyone the same rights regardless of where they live. You can ask us to show you the personal data we hold about you, correct it, delete it, or send you a portable copy, and you can object to processing. Email privacy@bitchplease.app and we will respond within 30 days.

We do it this way because gating rights by postcode is both unpleasant and pointless. Georgia, where this service is operated from, has no comprehensive consumer privacy statute — several attempts have failed in the legislature, most recently in 2026 — so a Georgia resident has no state-law right to demand access or deletion. Residents of California, Virginia, Colorado, Connecticut, Texas, Utah and a growing list of other states do. Rather than offer one set of rights to some users and nothing to their neighbours, we offer them to all of you.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We have never done so and there is no mechanism in the product for it.

If you are in California you may also designate an authorised agent to act for you, and we will not discriminate against you for exercising any of these rights — your account and pricing are unaffected.

If your personal data is exposed in a security breach, we will tell you. Georgia law requires notification to affected residents without unreasonable delay following discovery of a breach of unencrypted personal information, and other states impose their own deadlines. We will notify all affected users, not only those whose state requires it.

A notification will tell you what happened, what data was involved, when we discovered it, what we have done, and what you should do. If evidence you uploaded was involved, we will say so explicitly rather than describing it as “certain account information”.

This deserves saying plainly: the conversations you upload contain someone else, and they did not agree to any of this.

We handle that by keeping cases private by default, by never publishing evidence, and by removing names and identifiers from anything you choose to share. But the responsibility for what you upload is yours. Please do not upload conversations that are not yours to share, and think carefully before publishing anything about a real person.

Traffic is encrypted in transit. Evidence is stored in private storage. Sessions are authenticated with signed, HTTP-only cookies that cannot be read or forged by scripts in your browser. Database access is restricted to server-side code holding credentials that are never sent to your browser.

No system is perfectly secure. If you find a vulnerability, please report it to security@bitchplease.app rather than disclosing it publicly, and we will work with you on it.

Bitch Please is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has used the service, contact us and we will delete the account and its data.

If we change how data is handled in a way that materially affects you, we will update the date at the top of this page and notify account holders by email before the change takes effect.

Questions: privacy@bitchplease.app. See also the terms of service.

Bitch Please is operated from the State of Georgia, United States, and your data is processed in the United States. If you use the service from outside the US, you are sending your data to the US for processing here.