Privacy Policy

• Your account. Your name, email address, and password (stored only as a one-way hash), plus two-factor settings if you turn them on.
• Your wishes. What you write, your answers to the interview, each turn of a conversation, and the artifacts we hand back. Together these are your Bottle.
• Credits. A record of every credit you receive and spend. If you buy credits, Stripe takes the payment; we never see or store your card number.
• Messages. Whatever you send through the contact form.
• Technical details. Your IP address and browser, which our servers log and use for rate limits and security.

To grant your wishes and keep your Bottle, run your account and credits, send the emails the service needs (address confirmation, password resets, receipts), answer you when you write, keep the service safe from abuse, and fix what breaks. Nothing else.

Wishes are granted by AI models. To grant one we send what you wrote, and your interview answers, to our AI provider — currently OpenAI. Before a wish is granted, it also passes through OpenAI’s moderation service, a safety check.

Under OpenAI’s API terms, what we send isn’t used to train their models, and OpenAI may keep it for up to 30 days to watch for abuse. If we add another AI provider, we’ll name it here. Please don’t put passwords, card numbers, or anything you’d regret sharing into a wish.

• OpenAI grants wishes and runs the safety check, as above.
• Stripe processes payments.
• Resend delivers our email.
• Sentry receives error reports when something breaks: the page, your browser, and what went wrong, never your password.
• Google Analytics counts visits to our public pages, and the steps you take from signing up to buying credits — never what you wished for (see Cookies below).
• Amazon Web Services hosts the site and its database in the United States.

Each gets only what it needs to do its job, and none gets your information for its own marketing.

We use essential cookies to keep you signed in and to protect forms from cross-site request forgery. The site doesn’t work without them.

On our public pages — the homepage, the FAQ, and the like — we use Google Analytics 4, which sets its own cookies, to see which pages people visit and how they found us. Its script never runs on your account pages: not your wishes, your Bottle, your credits, or your settings. We don’t use advertising cookies, and we don’t track you across other websites.

Our server also tells Google Analytics only which steps you reached — signing up, confirming your email, uncorking a wish, finishing the interview, seeing a price, having a wish granted, sending a message in a chat — along with the kind of wish, how many credits it took, and what you bought and paid. It sends those under a scrambled id that stands in for your account, and the browser id Google Analytics gave you on our public pages if it has one. Never your name, your email, your wishes, what you typed, or the address of a page you were on.

Your wishes and artifacts stay in your Bottle for as long as you have an account — keeping them is the point. When you delete your account, I delete your wishes, your artifacts, your name, and your email, along with any messages you sent me (support email and the contact form), and I delete your newsletter sign-up. I keep a record of the credits you bought and spent, no longer tied to your name or your email, for seven years, because tax and accounting law requires it. If you share an artifact, the link shows it to anyone who has the link, and I do not list it anywhere. When you stop sharing, the link stops working; deleting your account does the same. Server logs and backups age out on their normal schedule. Payment records stay with Stripe as long as the law requires.

• Delete your account from Settings at any time. I remove your wishes, your artifacts, your name, and your email, plus messages you sent me and your newsletter sign-up. The record of credits you bought and spent stays, without your name or email, for seven years.
• Get a copy of your data from Settings: press “Send me my Bottle” and I email you a ZIP of your wishes, artifacts, credit history and account details. The link works for 24 hours. To correct something, email us.
• Opt out of Google Analytics with Google’s browser add-on or any tracker blocker. That stops the page counts. The step counts come from our server and carry only the ids above.

Everything travels over HTTPS, passwords are hashed, and only you can open your wishes. No system is perfectly secure, but we take care with yours.

The Bottled Genie isn’t for children under 13, and we don’t knowingly collect their information. If you think a child has made an account, email us and we’ll delete it.

If we change what we collect or who we share it with, we’ll update this page and the date at the top.

Questions about your privacy? Email us at support@thebottledgenie.com or use the contact page.