Shibubu Privacy Policy
Version: 2026-04-05

1. What We Collect

  a) Account Data
     - Email address (for authentication and verification)
     - Password (stored as a cryptographic hash, never in plaintext)

  b) Pet Interaction Data
     - Care actions (feed, play, clean, etc.) and timestamps
     - Pet state (stage, stats, appearance) — game data only

  c) AI-Derived Psychological Parameters
     - 9 numeric parameters (0-100) representing pet personality traits
     - Signal metadata: parameter letter, direction, strength
     - Signal reasoning: up to 200 characters of AI-generated summary
       (e.g., "User showed creative problem-solving")
     - Observation context: up to 100 characters of metadata summary

  d) Audit Logs
     - Tool invocations and decisions (reasoning fields are redacted)

2. What We Do NOT Collect

  - Conversation history or chat messages
  - Raw text of user inputs to AI models
  - IP addresses or geolocation
  - Device fingerprints or tracking cookies
  - Personal information beyond email and the above metadata

3. How AI Agents Interact With Your Data

  Shibubu works with AI agents (Claude, ChatGPT, etc.) via MCP.
  The AI agent may observe your interaction patterns and send structured
  signals to Shibubu. These signals contain ONLY:
    - A parameter letter (a-i)
    - A direction (positive/negative/neutral)
    - A strength value (0-1)
    - A short reasoning text (max 200 chars, AI-generated summary)

  The AI agent's full conversation with you is NOT sent to or stored
  by Shibubu. Only the structured signal metadata described above is
  transmitted.

  Cross-Session Observations:
  The AI agent may use its own memory (stored on the AI provider's side,
  not by Shibubu) to send periodic personality observations across
  sessions. These observations are converted into the same structured
  numeric signals described above before being sent to Shibubu.

  What Shibubu receives: encrypted numeric values only
  (parameter ID + delta + short label).
  What Shibubu does NOT receive: your conversation text, chat history,
  prompts, or any raw content from your AI interactions.
  The AI agent processes your conversations locally and transmits only
  the resulting numerical personality signals.

4. Data Retention

  - Account data: retained while your account is active
  - Pet data: retained while the pet exists
  - Signals: consumed in daily batch processing, retained for analytics
  - Audit logs: retained for 90 days, then purged
  - Observation context summaries: retained for 90 days

5. Data Security

  - Passwords are hashed with Argon2
  - JWT tokens expire in 15 minutes
  - Refresh tokens expire in 30 days and can be revoked
  - All connections use HTTPS (TLS)
  - Sensitive reasoning fields are redacted from audit logs

6. Your Rights

  - You may request deletion of your account and all associated data
  - You may export your pet data via the API
  - Contact us at: contact@shibubu.ai

7. Third Parties

  - Fly.io (hosting)
  - Resend (transactional email)
  - No data is sold to or shared with advertisers

8. Changes

  We may update this policy. The version date at the top indicates
  the latest revision. Continued use constitutes acceptance.