Privacy Policy

Last updated: October 22, 2026

Morse is built so we know as little about you as we can and still run the Service. This policy explains what we collect, what we don't, who else sees what, and your choices. It's part of our Terms of Service. "We" and "us" means Watermark Labs, Inc., the company that makes Morse.

The short version

Your chats are stored on your device, not on our servers. We don't keep your messages, your personas, or the characters you make, unless you share a character to Community.
We don't train AI on your content, sell your data, or show you ads. We don't use advertising trackers or third-party analytics.
If you came to us from one of our ads on X, we tell X whether you signed up or paid, naming you only by the ID X put on the ad's link. Never your email, name, IP address, or messages. See section 5.
Our servers don't log your messages. To answer you, a message passes through our server to the AI provider for the mode you chose, and nothing is written down.
Our servers keep what an account needs: your sign-in details, plan and payments, a usage ledger with no message content, and a few app records listed below.

1. What stays on your device

Your chat history, Studio images, personas, the characters you make, and your settings are stored in your browser (IndexedDB), encrypted. The key that unlocks them is kept on our server and given to your browser when you sign in, so a signed-out browser can't read them. This protects your data if someone gets hold of your device but not your account. It is not end-to-end encryption against us: we hold the key, but we never receive the data it unlocks.

Temporary chats are kept in memory only and never stored. Files you attach are sent with your message and never stored by us.

Because your data lives on your device, clearing your browser, losing your device, or deleting your account deletes it, and we can't recover it. To keep a copy, see the next section.

Backups

You can save a backup of your data to a file from Settings > Your data, and restore it on another device. Your device encrypts the file with a recovery key it makes and shows you once. We never receive the file or the recovery key, and the key we hold for your on-device data can't open it. So anyone with both the file and the recovery key can read it, and if you lose the recovery key, no one, including us, can open the file. Keep the key somewhere safe and apart from the file.

Moving to another device

You can also send your data straight from one signed-in device to another on the same network, with Send to another device in Settings > Your data. To find each other, the two devices exchange four short setup messages through our server. The parts that hold the devices' network addresses are encrypted so our server can't read them, and we delete the messages when the transfer ends, or within seconds of 3 minutes after the devices began pairing. Your data then goes directly from one device to the other, encrypted under a key only the two devices hold, and never passes through our server.

2. What we collect and keep

What	Why
Sign-in details: your email, and the name and picture your sign-in provider gives us (for example Google)	To make and secure your account
Account records: account ID, plan, credit balance, creation date, and when you agreed to the Terms and confirmed you're 18 or older	To run your account and keep a record of agreement
Usage ledger: for each request, the model, the amount of text used (tokens), the cost, the time, and which of your API keys made it, if one did. For end-to-end encrypted chats, which we can't read, we also record the size of the encrypted reply we relayed, to check the usage your app reports. Never the content.	Billing, plan limits, fraud prevention
API keys, if you make any: each key's name, its first few characters, a one-way hash of the key (never the key itself), and when it was created, last used, and revoked	To check the keys you send and list them for you in the app
Daily counters: how much of the free plan's allowance you've used today	Plan limits
Payment records: Stripe customer ID, purchases, and subscription status.	Billing, refunds, taxes
Characters records: which of our cast you've met, who introduced them, and when, plus referral codes and who referred whom	Unlocks, introductions, referral rewards
Community records: the characters you share and where each stands in our review (waiting, approved, or turned down, with any note our team leaves you), your handle, and which characters in Community you've liked or started a chat with. Never what was said.	To show what's shared and credit it to you, review it before others see it, count each person's chats and likes once, and list your likes
Human check result: whether your account passed a Cloudflare Turnstile check	Preventing automated abuse of the free plan
Security and abuse signals: refused requests and rate-limit events per account	Protecting the Service
Ad campaign: the campaign named in the link you arrived by, and if it was one of our ads on X, the click ID X put on that link	To count which campaigns bring signups and payments, and to tell X which ad clicks led to one (section 5). Deleted 30 days after you sign up
Aggregate statistics: totals by model, feature, character, or campaign (for example how many people chatted with a character this hour, or opened a campaign's link today), with no account attached	Running and improving the Service
Support messages you send us	Answering you

Like any web service, our hosting providers process your IP address and basic request information to deliver traffic. A few services also see your IP address because your browser contacts them directly: our sign-in provider (Neon), when you sign in and while you stay signed in; Google, if you sign in with Google; and Cloudflare, when it runs the human check. We don't store IP addresses with your account, and our proxy doesn't keep request logs.

3. Privacy modes: who sees your messages

To answer you, your message has to reach an AI model. The mode you choose decides which providers run it and what they can see.

Anonymous. Leading models (for example from OpenAI, Anthropic, Google, or xAI). We send your message under our own account, so the provider sees the message but not who you are: no name, email, or account ID. Providers keep data under their own policies, which can include keeping it for a limited time to check for abuse.
Private. Models run by hosts that have agreed to keep none of your messages (for example Together AI or xAI's zero-retention service). Where a provider confirms zero retention on each reply, we check it and refuse any reply that doesn't. Otherwise we rely on the provider's commitment.
E2EE. Your browser checks the remote server's hardware attestation (a "trusted execution environment" run by Phala or NEAR AI), then encrypts your message so only that verified enclave can read it. Phala's enclave may pass it on, over a connection it checks, to a model server run by Chutes. Our servers relay it but can't read it. To run the check, your browser may fetch certificate data directly from an attestation service (for example Phala's), so depending on routing, that service may see your IP address, but not your messages or your account. This depends on the enclave hardware and attestation working as designed.

In every mode we pass your message through and don't store it. We choose providers whose commitments fit each mode, but we don't control their systems, and we aren't responsible for their practices. We describe each mode as accurately as we can, but no system is perfect (see section 8 of the Terms).

4. Other features

Images and video (Studio). Your prompt, and any image you attach, go to the image or video provider (for example fal, Runware, or xAI).
Web search and deep research. Your search queries, and the pages you ask to read, are sent to Parallel. A deep research run is kept by Parallel, not us. We keep only its ID and status so we can fetch it for you.
Agent lookup tools. Some tools look things up in public services: Wikipedia, Photon (komoot) for places, MET Norway for weather, Frankfurter for exchange rates, CoinGecko for crypto prices, and OpenAlex for research papers. Each lookup goes through our server, so those services see the query but not your IP address or your account. We don't keep the queries. Our server holds the services' public answers in memory for a short time, keyed by the query and not by who asked, so a repeated lookup is answered without asking again.
Characters. Our cast's prompts come from our server when you chat. Your chats with them stay on your device like any other chat. Characters you make are kept only on your device, unless you share them to Community, and their descriptions are sent to the model only when you chat with them.
Community. A character you share to Community is the exception. We keep a copy of it on our server: its picture, name, tagline, About, genres, first messages, and notes, who made it and where it came from (for a character you imported, its maker's name and its ID on that site), and the handle you share it under. Before anyone else sees it, our team reviews it, and we look again when you change it. For that, we email our team a copy of the character, with its picture, your handle, and your account ID, through our email provider. Our team may turn a character down, with a note only you see. Once it's approved, we show it to everyone who uses Community, with how many messages and likes it has, until you stop sharing it or delete your account, and then we delete it. Your handle is yours alone, and it opens a page of the characters you share. When you start a chat with a character in Community, or like one, we record that your account did, so each person is counted once and you can find your likes. When you send a message in a chat with a character from Community, your app tells our server which character it is, and we add one to that character's count of messages for the day, with no account attached. We never receive what anyone says to it: your chats with it stay on your device, and everyone else's on theirs.
Moving from Character.AI. Our exporter, as a bookmark or in our browser extension Move to Morse, runs in your browser on character.ai, with your own Character.AI session. It asks only Character.AI for your data, and saves it as a file on your device. The extension then hands that file to Morse's import in the same browser, keeping it in the extension's own storage on your device until Morse has it. One Morse hasn't taken within an hour isn't handed over, and is deleted the next time the extension runs. We never receive the file. What you import stays on your device, encrypted, like your other chats.
Safety. If a message you send in a character chat reads like you're thinking about suicide or self-harm, the app shows crisis lines. The check runs on your device. We're told only that the lines were shown, and we keep a count of that with no account or message attached. See Safety.
Long chats. When a chat gets too long, the app asks a model to summarize earlier messages. This uses the same mode and provider rules as above, and the summary is stored on your device.

5. Who we share data with

We share personal data only as needed to run the Service, with:

service providers who process it for us: sign-in (Neon), payments (Stripe), bot checks (Cloudflare), email (Resend), hosting, database, and storage providers, and the AI, search, and media providers above;
authorities, when the law requires it, or to protect people from serious harm. We're required to report child sexual abuse material to the National Center for Missing & Exploited Children. Because we don't store your chats, we usually have very little to give;
X (formerly Twitter), if you arrived by clicking one of our ads on X: that you signed up, and each payment you make in the 30 days after, with its amount. We name you only by the click ID X put on the ad's link, which X already holds. We never send X your email, name, IP address, browser details, or anything you wrote. X uses this to measure our ads and decide who sees them. We don't load any X code on our site;
a buyer or successor, if we're involved in a merger, acquisition, or sale of assets. This policy, or one at least as protective, would continue to apply to your data.

We don't sell or rent personal data. Apart from telling X about its ad clicks as described above, we don't share it for advertising. To opt out of that, turn on Global Privacy Control in your browser, and we won't keep an ad's click ID or tell X anything about you. You can also email hello@trymorse.ai.

6. How long we keep it

Account data: while your account is open.
When you delete your account in Settings, we close it at once and delete your sign-in details (email, name, and picture), the key to your on-device data, the characters you shared to Community, your handle, your likes, the record of which characters in Community you chatted with, your Characters records, and your usage counters and abuse signals. Your subscription is cancelled. What's left is a closed account number with its billing ledger and Terms agreement, which no longer carry your name or email. We keep those, and payment records at Stripe, for legal, tax, accounting, and fraud-prevention reasons, generally for up to seven years.
Security and abuse signals are deleted on a rolling schedule even while your account is open.
The copies of a shared character emailed to our team for review: deleted from our team's mailbox within 90 days, whether or not you still share the character.
The campaign and ad click ID you arrived with: deleted 30 days after you sign up. Our record of a signup or payment we reported to X: deleted within 60 days.
The setup messages of a transfer between your devices: deleted when the transfer ends, or within seconds of 3 minutes after the devices began pairing.
Aggregate statistics with no account attached aren't personal data, and we may keep them.
Backups age out on their normal schedule.

7. Your rights and choices

Depending on where you live (for example the EU, the UK, or California and other US states), you may have the right to access, correct, delete, or receive a copy of your personal data, or to object to or restrict how we process it. You can delete your account and data yourself in Settings, and your chats are already in your hands on your device. For anything else, email hello@trymorse.ai. We'll verify the request comes from the account holder, and we won't treat you differently for using your rights. You can also complain to your local data protection authority.

Legal bases (EU/UK). We process data to perform our contract with you (running your account and the Service), for our legitimate interests (security, fraud and abuse prevention, improving the Service with aggregate data), to meet legal obligations (tax, law-enforcement requests), and with your consent where we ask for it.

8. Cookies and local storage

We use only what the Service needs: a sign-in session, and your browser's storage for your encrypted data and settings. If you arrive by a campaign's link, your browser also keeps the campaign's name and any ad click ID in the link for up to 7 days, until you sign up. There are no advertising or analytics cookies. Cloudflare Turnstile may set what it needs to tell people from bots.

9. Security

We use best efforts to protect your data: encryption in transit, encryption at rest on your device, attested enclaves for E2EE, and access controls on our systems. But no way of sending or storing data is completely secure, so we can't guarantee the security or privacy of your data. Your protection also depends on things we don't control, including the providers in sections 3 and 4 and the security of your device, browser, and sign-in account, so keep them secure. If you find a vulnerability, please tell us at hello@trymorse.ai.

10. Adults only

The Service is for people 18 and older. We don't knowingly collect data from anyone under 18, and we close any account we learn belongs to a minor.

11. International transfers

We're based in the United States, and our providers may process data in the US and other countries. Where the law requires, we use safeguards such as the European Commission's Standard Contractual Clauses.

12. Changes

If we change this policy in a material way, we'll update the date above and tell you in the app before the change applies to you.

13. Contact

Watermark Labs, Inc., 2261 Market Street STE 65497, San Francisco, CA 94114. Email: hello@trymorse.ai.