LLYVerse Privacy Policy
Comprehensive legal disclosures detailing data processing, AI conversation logging, transparent third-party disclosures, user rights, and liability protections across the LLYVerse ecosystem.
First-Party Privacy & Third-Party Technical Disclosures
LLYVerse operates without Google Analytics, Meta Pixels, commercial ad tracking beacons, or data broker sales. We run a strictly first-party operational telemetry script (/js/analytics.js) to monitor page health and protect platform integrity, and we serve stylesheets and icon libraries (/css/tailwind.min.css, /js/lucide.min.js) directly from our origin server. To deliver secure edge and payment services, we utilize two external infrastructure providers: Cloudflare (bot protection via Turnstile challenges, DDoS mitigation, Workers AI edge inference, and edge proxying) and Stripe (PCI-compliant payment checkout processing for store items and subscriptions).
01 Overview & Scope of Data Controller
This Privacy Policy applies to all services, websites, web applications, command interfaces, and APIs operated under the LLYVerse Network (collectively, "LLYVerse", "Platform", "We", "Us", or "Our"). This policy governs all user interactions across our primary domain (llyverse.org) and all constituent subdomains, portals, and service endpoints including NovaAI Studio (/novaai), Haven (/haven), LLY Term (/term), Academy (/academy), Store (/store), AuraStream (/aurastream), Community Blog (/blog), QuikDocs AI (/quikdocs), Webmail (/mail), and the Pantheon Council (/pantheon).
02 Information We Collect & Categories of Data
A. User Account & Identity Credentials
When registering or updating a citizen profile, we collect your requested username, email address or phone number (you need an email address or a phone number, and we verify it), salted bcrypt password hashes, display name, avatar configuration, and Monero (XMR) payout wallet addresses.
B. AI Employee Chat, Memory & Action Audit Notice
EXPLICIT NOTICE OF CONVERSATION LOGGING & REVIEW: All conversation threads, user prompts, queries, code snippets, and text submissions conducted with Nova, Astra, and Astaria across all platform entrypoints (including NovaAI Studio, Haven, LLY Term CLI, floating Nova app windows, and guest visitor sessions) are automatically processed and saved to the node's SQLite database (user_chats, nova_memories, nova_routines, and nova_actions tables).
Improving Nova: we may use your Nova conversations only to improve Nova (for example to fix wrong answers, tune prompts and train or evaluate Nova's models). You can turn this off at any time with the "Use my chats to improve Nova" toggle under the chat box or in Profile → Privacy; when it's off, none of your chats, past or future, go into any dataset we build. We never sell your data, and we never share it with third parties for their own use. Service providers that run parts of LLYVerse for us (such as Cloudflare Workers AI) process it only to provide that service.
C. First-Party Telemetry & Network Security Logs
To defend against web scrapers, automated exploit scanners, and denial-of-service attacks, our middleware and first-party /js/analytics.js script record anonymized IP hashes, browser User-Agent strings, request timestamps, response codes, Cloudflare Ray IDs, and Cloudflare Zero Trust authentication headers (Cf-Access-Jwt-Assertion, Cf-Access-Authenticated-User-Email).
D. Financial & Economic Transactions
Transactions involving Sparks ($SPK) and Flame ($FLM) balances, node compute proofs, and Stripe payment checkouts are recorded in local shop order records and notarized on the immutable Flame Ledger hash chain. Payment card numbers are processed directly by Stripe under PCI DSS Level 1 compliance and are never stored on LLYVerse servers.
03 Legal Bases for Processing (GDPR & CCPA Compliance)
We process personal data under the following recognized legal frameworks:
- Contractual Necessity: Processing required to fulfill user-initiated requests, deliver purchased store items, dispatch emails, and execute AI chat responses.
- Legitimate Business & Security Interests: Infrastructure threat isolation, bot detection, AI safety auditing, system performance optimization, and fraud prevention.
- Legal Compliance: Retaining mandatory accounting logs, audit trails, and responding to lawful process.
- User Consent: Provided explicitly during voluntary profile setup, community blog publishing, or media uploads.
04 Data Security & Local-First Hybrid Architecture
LLYVerse operates under a strict Local-First Hybrid Security Model:
Core database services (SQLite WAL mode), AES-256-GCM encrypted user secrets (nova_secrets), authentication sessions, local Ollama model instances, and telemetry run on dedicated origin servers.
Cloudflare Workers AI edge GPU clusters process high-throughput model requests under strict zero-retention enterprise processing standards.
05 Data Retention, Encrypted Backups, Erasure & Citizen Rights
Citizens maintain the following data rights under applicable privacy laws:
Right to Access & Export: You may download a complete JSON/Markdown export of your Nova chats, saved memories, routines, and action audit log directly via GET /api/nova/export or from the NovaAI Data & Privacy drawer.
Right to Erasure & Account Deletion: Citizens may delete their Nova data (POST /api/nova/delete-all-my-data) or delete their entire account via Profile Settings. Deletion immediately purges active database records, sessions, memories, routines, and webmail allocations. Nightly encrypted disaster-recovery snapshots (AES-256-GCM) are retained for up to 14 days before automatic rotation and permanent erasure.
Statutory Retention Exceptions: Account deletion does not erase anonymized security audit logs, threat prevention records, or cryptographic Flame Ledger block hashes, which remain permanently notarized to maintain financial and chain integrity.
06 Disclaimers & Limitation of Liability
"AS-IS" AI Output Disclaimer: All outputs, code snippets, strategic recommendations, and responses generated by Nova, Astra, or Astaria are provided on an "AS-IS" and "AS-AVAILABLE" basis without warranties of completeness, accuracy, or fitness for a particular purpose.
User Content Responsibility: Users are solely responsible for content submitted to public forums or AI chats. Users must not transmit sensitive unencrypted personally identifiable information (PII) or confidential corporate keys into public channels.
Hold Harmless Provision: To the maximum extent permitted by law, LLYVerse, its founder, officers, agents, and AI personas shall not be held liable for any direct, indirect, incidental, or consequential damages resulting from platform use, network downtime, or AI output implementation.
07 Cookies & Browser Storage Disclosures
LLYVerse uses essential HTTP cookies (lly_session) solely for user session authentication and CSRF defense. We utilize browser LocalStorage (lly_term_history, lly_term_nova_thread, lly_term_theme) to preserve terminal state, window positioning, and local chat themes across page refreshes. No third-party tracking cookies or advertising cookies are deployed.
08 Privacy Inquiries & Data Protection Contact
For privacy inquiries, data access requests, or legal notices, contact the LLYVerse Team at:
Privacy & Data Protection: privacy@llyverse.org
Official Contact Email: privacy@llyverse.org (or support@llyverse.org)
Ecosystem Webmail: https://llyverse.org/mail
06 Data Retention Schedule & Nightly Purge Invariants
In accordance with sovereign data minimization principles, we strictly limit the retention periods of all logged data and enforce automated nightly purging:
| Data Category | Retention Period | Purge Invariant |
|---|---|---|
| NovaAI Chat History | User-Controlled / 365 Days | Immediate deletion upon user request or opt-out; purged upon account deletion |
| QuikDocs Inputs | Ephemeral (0 Days) | Purged immediately after document generation; never stored for training |
| Store Order Records | 7 Years | Retained for tax, accounting compliance, and purchaser re-download access |
| Security & Bot Audit Logs | 90 Days | Automated nightly purge of IP hashes and telemetry older than 90 days |
| Webmail Transmissions | Subscription Duration | Deleted 30 days after mailbox expiration or cancellation |
| Haven Sanctuary Transmissions | Ephemeral | Real-time memory cache only; zero persistent audio logging |
| Court Mediation Dockets | 180 Days | Private mediation cases archived and purged 180 days after resolution |
First-Party Cookie & Client Storage Disclosure
| Cookie / Key | Type | Purpose |
|---|---|---|
| sid | HTTP-only Cookie | Session authentication token (secure, SameSite=Lax) |
| improve_nova | First-Party Cookie | Stores guest preference for NovaAI chat improvement opt-out |
| _cfuvid, cf_clearance | Cloudflare Cookie | Bot management and Turnstile challenge validation |