Data security

What is encrypted

The most personal texts are encrypted before they are written to our database, using the AES-256-GCM algorithm.

• What you write and what you say during simulations and lessons, as text.
• The reports of your sessions and where you are in your learning.
• The “Feel like talking?” conversations: the text, the closing line and the summary.
• The name and e-mail address of your trusted person, if you registered one.

Other information is not encrypted this way: your email address, your first name or nickname, your settings, your goals and the topic of your sheets. It stays protected by the access rules described below.

What we do not keep

• Your voice. Sociami does not record it: only the text of the conversation is kept.
• The original text of a situation from your own life that you tell us so you can replay it. Only a version from which we removed the names we recognise is kept.
• Your card number. Payments are made with Stripe.

Your connection and your account

• The exchanges between your browser and Sociami go through an HTTPS connection. The site asks browsers to use only HTTPS for two years.
• Your password is never kept as it is. We keep a fingerprint of it, calculated with bcrypt, that cannot be used to find it again, not even by us.
• To keep you signed in, your browser holds two sign-in cookies. No script on the page can read them, and they are only sent over an HTTPS connection.
• The first cookie is valid for 15 minutes, the second for 30 days. When the second one is used to renew your sign-in, it is replaced by a new one and the old one stops working.
• When you sign out, that sign-in is closed. When you reset your password, all your sign-ins are closed.
• The number of sign-in attempts is limited.
• The site has no access to your camera or your location. It only uses your microphone when you speak to the AI out loud.

Who can read what

• You: you find your sessions, your reports and your progress, and you can download a copy of your data in Settings → My data.
• The guardian of your household, only if you have joined a household and agreed to share with them. They then see your progress only: streak, practice calendar and tiers. Never your simulations or your session reports. The “Feel like talking?” conversations have their own rule, described further down. You can withdraw this agreement in your settings: access is cut straight away.
• The Sociami team, to run the service and answer your requests. In its admin tool, the team sees what an account did and on what date, not what was said or written. The only exception: the free conversation “Feel like talking?”, described further down.
• “Feel like talking?”: the guardian of your household can only read a conversation if you have agreed to share with them. The Sociami team can only read a conversation that has ended. Every reading, by your guardian or by the team, is recorded in a log.
• When the team opens an account's profile in its admin tool, the date and the account are noted in a log. This log contains no email address and no text.
• If you create a share link for a report, anyone who has this link can read that report, without the transcript, until the end date of the link or until you turn it off.
• Your trusted person, if you chose one, does not read anything you write or say in Sociami. They get an e-mail to let them know you chose them. After that they only get a message when you press “Let … know”: that message contains nothing of what you said or wrote. They can refuse to receive these messages.

What we do not do, and who we work with

We do not sell your data and we do not use it for advertising.

Sociami does not use any advertising cookie.

To work, Sociami relies on other companies. Each one only receives what it needs for its task.

• OpenRouter: produces the AI's written replies. It receives the text of the current conversation.
• Google (Gemini): produces the AI's spoken replies. It receives your voice and the text of the conversation during the session.
• Google, if you choose to sign in with Google: it confirms who you are.
• Stripe: takes payments. It receives your email address and your payment details.
• Brevo: sends Sociami's e-mails (password reset and messages to your trusted person). It receives the recipient's e-mail address and the text of the message.
• OVHcloud: hosts our servers and our database.
• Cloudflare: protects the site and makes it load faster. Your requests go through its network.

Before a conversation is sent to the AI, a filter removes the names and contact details it recognises. The filter does not recognise everything: avoid giving someone's full name, address or phone number.

The topic of a sheet you ask for is sent to the AI exactly as you wrote it.

Some of these companies are based in the United States. So some data may be processed outside the European Union.

How long we keep it, and how to delete it

• As long as your account exists, your data is kept so that you can find your sessions and your progress again.
• You can delete your account yourself, in Settings → My data.
• When you ask to delete your account, it is made anonymous straight away, then permanently deleted 30 days later.
• When your subscription ends, your data stays available for export for 30 days. After that, your account is permanently deleted, unless you subscribe again.
• “Feel like talking?”: the text of a conversation is erased after 30 days, its summary after 90 days.
• When you delete a sheet, its content is erased. Only its date remains.
• Your trusted person: their name and e-mail address are deleted straight away when you remove them, and when you ask for your account to be deleted.

Report a vulnerability

If you think you have found a security vulnerability in Sociami, write to us at the address below. Describe what you saw and how to reproduce it, without using other people's data.