doeshelikeme.xyz
Privacy Policy
Effective 16 October 2026. This document is written in English.
1. Who we are
doeshelikeme.xyz (the “site”) is operated by Songyue Wang, 204, No.69 Beijing West Rd., Donghu District, Nanchang, Jiangxi, China 330046. Email wsy.032026@gmail.com. Songyue Wang is the controller of the personal data described here.
No representative in the European Union or the United Kingdom is appointed. GDPR Article 27(2)(a) drops that duty only when three things are all true: the processing is occasional, it does not include large-scale processing of special-category data or criminal-offence data, and it is unlikely to risk people’s rights and freedoms. This site is offered as an ongoing service, not an occasional one, and a romance chat can include intimate information about another person. We do not rely on that exception.
This policy covers the free personality briefing and The Crush Case File. It is written for visitors in the United States and in the European Economic Area, the United Kingdom, and Switzerland. Words such as “personal data” include “personal information” under the California Consumer Privacy Act, as amended by the CPRA.
2. Free use
The free briefing asks for pronouns, an MBTI type, and a birthday for the other person and for you. The birthday is used in your browser to compute a western zodiac, a Chinese zodiac, and an age in years. The briefing text is produced in the browser from a fixed rules and scenario library. It is not sent to a language model.
What remains on the device:
- pronouns, MBTI types, and the two zodiac signs;
- the briefing text, which can mention those signs;
- if you continue into premium, the MBTI types and the age in years. The full birth date is not copied forward.
The birth date is cleared before anything is written into the tab’s storage. We do not receive the free-form answers on our server. Your browser’s own autofill, because the birthday fields are marked as a birthday, may remember the date under your browser settings. That copy is yours, not ours.
3. Premium use
The Crush Case File is a one-time purchase. To produce it we process the material you choose to submit. We do not ask you to create an account. This site does not ask for your phone number or payment card. Dodo Payments collects your name and billing address in checkout. The only email we ask for on this site is the reply address on the refund form, and only if you open that form.
You may submit:
- a chat export (plain text, including WhatsApp, LINE, Telegram, Messenger, or WeChat exports), up to about 80,000 characters, or up to 20 screenshots, each up to 8 MB;
- optional notes about each person: MBTI, age, cultural background, family background, and a free-text note;
- optional relationship answers: what the relationship is, how you met, how often you see each other, who starts conversations, reply worries, in-person impression sliders, whether commitment was discussed, life context, up to three questions you want examined, and anything you think the screenshots miss;
- an optional timeline of up to 50 events, with a type, a label, dates, and a note.
Screenshot files stay in the tab’s memory. The file name is not uploaded. The image pixels are sent to our server, then to the model provider, only so the text can be read. After the transcript comes back, the images are dropped from memory. A reload before that point drops them too.
The transcript, the optional answers, the timeline, and a count of screenshots are sent to our server and then to the model so the report can be written. The report can quote lines from the chat. When the report succeeds, the transcript and the answers are removed from the tab. The report itself stays in the tab until you start over, close the tab, or two hours pass.
Saving or sharing the report builds an image or a PDF on your device. We do not receive that file.
Checkout is open. Dodo Payments is the merchant of record for The Crush Case File and receives the name, billing address, and card details needed to charge you. We do not collect or store card numbers, billing addresses, or payment receipts, and this application does not open a customer account.
The same model that reads a screenshot or writes the report is instructed to stop when the upload is a copyrighted work you have no right to share, intimate images shared without agreement, or sexual content involving a minor. It then returns a refusal instead of a transcript or a report. We do not send that upload to a separate moderation company, and we do not keep it. A private adult conversation can still be read.
4. Technical data, for free and premium
Opening the site can involve:
- IP address, user agent, the page path, and the time of the request, as ordinary hosting logs at our host;
- country, from a country header supplied by the host (not GPS), used to choose the interface language and to decide whether premium is available;
- the Accept-Language header, used for the same language choice;
- a random per-tab identifier, stored in the tab and sent only to our premium AI routes, so we can rate-limit abuse. It is not sent to analytics or to the model provider;
- one anonymous visit count. The request body is empty. We store a single number, not the path and not an identifier;
- the “Not yet” button on the home page increments a single number. That number is not tied to you.
Our own logs for a failed or completed AI request record the route, a status, and the interface language. They are written so they do not include the chat, the images, the questionnaire, or the report text. The host may still keep its own connection logs.
5. Purpose and lawful basis
| Processing | Purpose | GDPR lawful basis |
|---|---|---|
| Free briefing inputs, kept in the browser | Show you the personality sketch you asked for | The computation stays on your device. Where a derived age later travels with a premium request, the basis is contract: producing the report you asked for (Art. 6(1)(b)) |
| Chat, screenshots, questionnaire, timeline, and the report | Read the chat and write the one report you requested | Contract, Art. 6(1)(b) |
| IP address and the random tab id on AI routes | Limit how often vision and analysis can be called (30 vision calls and 8 analysis calls per 10 minutes) | Legitimate interests, Art. 6(1)(f): keeping the service available and resisting abuse. You can object, and the practical way to stop it is to stop using those routes |
| Country and language headers | Show a language the browser asks for, and block premium where we do not offer it | Legitimate interests, Art. 6(1)(f) |
| Visit count, “Not yet” count, cookieless page analytics | Know, in aggregate, that the site is being used | Legitimate interests, Art. 6(1)(f). These stores do not hold a profile of you |
| Payment details | Take the one-time payment for The Crush Case File and handle a refund | Contract, Art. 6(1)(b). The checkout provider may also keep records because tax law requires it, Art. 6(1)(c) |
| The three checkboxes before payment | Keep a 14-day record that you accepted the privacy policy, the terms, and the age confirmation | Contract, Art. 6(1)(b), and, for the withdrawal waiver, the need to show that you asked for immediate performance |
| Refund form: reply email and the note | Receive the request and reply | Contract, Art. 6(1)(b) |
| Emails you send us | Answer a privacy, refund, or support request | Contract, legitimate interests, or a legal obligation, depending on the request |
We do not use personal data for advertising, and we do not sell it.
A chat can incidentally include special-category data, such as health, sex life, religion, or politics, and it always includes information about the other person in the conversation. We do not ask for special-category data. We process whatever you include only to write the report, and we discard it on the schedule below. You need your own lawful basis to upload the other person’s messages. See the Terms.
The report is not a decision that produces legal effects or similarly significant effects about you. It is an entertainment reading. GDPR Article 22 does not apply to it. You are free to ignore it.
6. How long we keep it
| Data | Where it lives | Retention |
|---|---|---|
| Birthday | Browser memory while you fill the free form | Not written to tab storage. Dropped when you leave that form state. A derived age may continue if you start a premium report |
| Free briefing, pronouns, MBTI, zodiac | This tab’s session storage | Until you start over, close the tab, or 2 hours after the last time the tab saved them |
| Screenshots | This tab’s memory, then the AI request | Cleared when the text is extracted, when you leave or hide the tab, when you start over, or when you reload. We do not write the images to a database |
| Transcript, questionnaire, timeline | This tab, then the AI request | Removed from the tab when the report succeeds. Also removed on start over, tab close, or the 2-hour expiry. Not written to a database |
| The Crush Case File, which may quote the chat | This tab’s session storage | Until you start over, close the tab, or 2 hours after the report was saved. Refreshing the results page does not clear it |
| IP address and random tab id | Upstash Redis rate-limit keys | About 10 minutes, which is the rate-limit window, then the key expires. If Redis is not configured, a local development server may keep the same window in memory only |
| Purchase and consent record | Upstash Redis, under a legal:consent: key, separate from visit counts and rate limits | 14 days, then the key expires. The record is the time, a random id, and the fact that the privacy, terms, and age boxes were checked, plus the version date of those documents. It does not contain the chat, the questionnaire, or an email |
| Blocked refund email | Upstash Redis, under a legal:block: key | Until we remove the block. The key is the reply email only, kept so that address cannot send another refund request. It does not contain the chat |
| Refund request | Upstash Redis, under a report: key | 14 days, then the key expires. The record is the reply email, the note you typed, the time, and the consent id. It does not contain the chat |
| Visit total | One Redis counter | The number is kept so the count can grow. It contains no visitor identifier |
| “Not yet” total | One Redis counter | The number is kept so the count can grow. It contains no visitor identifier |
| AI request content at the model providers | OpenRouter and OpenAI, for the request | We do not keep a copy after the response is returned. Their abuse-monitoring retention is set by their terms. Confirm the current period with them before you rely on a number |
| Host connection logs and analytics | Vercel | Vercel’s own retention for logs and Web Analytics |
Because we do not keep a customer account, we usually cannot retrieve a chat or a report after the tab has discarded it.
7. International transfers
The site is hosted on Vercel. Anonymous counters, rate limits, and the 14-day consent and refund records use Upstash Redis, set up for a US East (iad1) primary region. The legal records use a different key prefix in that same database. Premium text and images go to OpenRouter (openrouter.ai). This deployment accepts only model ids that start with openai/, turns fallbacks off, and sorts the chosen OpenAI route by throughput. It does not set OpenRouter’s zero-data-retention flag, so the request can land on an OpenAI endpoint that keeps an abuse-monitoring log. Country does not switch the model to a provider in mainland China. This deployment refuses China-hosted model credentials at startup.
OpenRouter’s published position is that it does not keep prompts unless prompt logging is turned on. Its data-processing agreement, which is what GDPR Article 28 expects between a controller and a processor, is described by OpenRouter as applying to enterprise accounts once both sides sign it. A self-serve API key does not, by itself, produce that signed agreement. OpenAI’s data-processing addendum says API customer content is kept for up to 30 days for the service, including abuse monitoring, and is then deleted unless the law requires longer. Zero retention on the OpenAI side is a separate approval, and it is not turned on in this deployment. Those addenda are not signed for this site yet.
Those providers are in the United States. If you are in the EEA, the UK, or Switzerland, your data leaves your region when you open the hosted site, and premium content leaves again when a report is generated. The transfer is made to host the site, to limit abuse, and to perform the report. Safeguards are supposed to be the providers’ contractual clauses and, where a provider is actually certified, the EU-US Data Privacy Framework. This site does not yet have those clauses signed. Email us if you want the current document name from a provider.
The free briefing does not need that second transfer. It runs in the browser. Loading the page still contacts the host.
8. Third parties
We share data with these processors, for the reasons above:
- Vercel, Inc. — hosting, country header, connection logs, and cookieless Web Analytics. Analytics receives the page URL with the query string and hash removed. API paths are dropped. Chat content is not sent to analytics.
- Upstash, Inc. — the visit counter, short-lived rate-limit keys that contain an IP address and, when the tab sends it, the random tab id, and the 14-day consent and refund records.
- OpenRouter, Inc. and OpenAI — the premium transcript or screenshot, the optional answers, and the timeline, plus the site URL and site name as the application identity. They are not given the refund email.
- Dodo Payments — merchant of record for The Crush Case File. Dodo receives the payment details needed to charge you and to handle a refund or a dispute. Its privacy policy is at https://dodopayments.com/legal/privacy-policy. This application does not store the card number.
We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not allow third parties to market to you from our data. A Global Privacy Control signal does not change a disclosure we do not make.
We may disclose information if the law requires it, or to respond to a valid legal process. We would not have a stored chat to hand over after it has been discarded.
9. Cookies and similar storage
The site does not set a cookie for an account, for advertising, or for analytics. Vercel Web Analytics, as we use it, does not use a cookie. There is no advertising cookie and no third-party tracking cookie.
The tab uses session storage, which is not a cookie and is not sent with ordinary page requests. It holds the free briefing, the premium draft, the report, a two-hour expiry time, a “visit already counted” flag, the random rate-limit id, and, after you pass the checkboxes, a consent id. Screenshots are held in memory, not in storage. This storage is there so the form and the report can function. It is not used to recognize you on a later visit. Closing the tab clears it.
Because we do not use non-essential cookies, we do not show a cookie consent banner. If that changes, this section will change first.
10. Your rights
If the GDPR, UK GDPR, or Swiss law applies, you can ask to access, correct, erase, or restrict your data, to receive a portable copy, and to object to processing based on legitimate interests. You can withdraw a consent we rely on, where we rely on one. Withdrawal does not undo processing that already happened. You can complain to your local supervisory authority. For the EU, the list is kept by the European Data Protection Board. We would like the chance to answer you first.
If you are a California resident, you can ask to know, to delete, and to correct personal information, and you can opt out of sale or sharing. We do not sell or share as those words are used in the CPRA, and we will not discriminate against you for exercising a right. You may use an authorized agent. We will tell you what we need to be reasonably sure the request is yours or the agent’s. We aim to respond within 45 days, and we will tell you if we need more time. If we deny a request, you can appeal by replying to the same email.
Other US state privacy laws give similar rights where they apply. We will honor a request that the applicable law requires.
Send requests to wsy.032026@gmail.com. We aim to answer GDPR requests within one month. We do not keep an account, so we often have nothing left to show or delete. If that is the case, we will say so. Closing the tab, choosing Start over, or waiting out the two-hour window deletes the copy that was on the device.
Categories we collect, in CPRA terms: identifiers (IP address, the random tab id); internet activity (page path, language and country headers); approximate location (country only); commercial information only once a payment exists; customer content (chats, screenshots, questionnaire, timeline); inferences (the report). Sensitive information can appear inside a chat you upload, including the contents of private messages. We use that content only to write the report. Sources: you, and your device or the host for technical data. We do not collect it to train a public model of our own.
11. Children
The site is for adults. You must be 18 or older. We do not knowingly collect personal information from a child. The free form does ask for birthdays in the browser so it can compute zodiac signs. Do not enter a child’s birthday, and do not upload a chat with a minor. If you believe we have received a child’s information, email us and describe the page and the time. We will delete whatever copy we still have.
12. Security
Premium AI requests are sent without cookies and without a referrer. Uploads are size-limited. Premium routes refuse a mainland China visitor before the body is read. There is no database of chats. The only stored personal records are the 14-day consent record and, if you send one, the 14-day refund request. No method of transmission or storage is perfectly secure. Do not upload a chat if you cannot accept the processors named above seeing it for the time it takes to answer.
13. Mainland China
A visitor whose country header is CN, and any visitor when that block is forced on, can use the free briefing only. Hong Kong, Macau, and Taiwan are not treated as mainland China.
What is unavailable:
- premium pages, which respond as not found;
- screenshot reading, report generation, the premium region check, and checkout initiation, which are refused before an upload body is read;
- the premium questionnaire, timeline, and downloadable report.
On the public hosted site, premium is also refused when the host cannot see a country at all. That can affect a privacy tool or a network that strips the header. It is not limited to mainland China.
How data is handled for a mainland visitor who can still open the site:
- pronouns, MBTI, and birthday stay in the browser. The birthday is not stored. The briefing is not sent to a model;
- the page still loads from the host. The host can see the connection, including the country code used to apply this block and to choose the language;
- the anonymous visit counter, the “Not yet” counter, and cookieless page analytics can still record that a page was opened. They do not receive a chat, because premium upload is refused;
- we do not route that visitor to a mainland-hosted model. This deployment does not use one.
14. Changes
If we change what we collect or who we share it with, we will update this page and its effective date. Where the law requires a fresher notice before a new use, we will give that notice before the use starts.
15. Contact
Privacy requests, questions, and appeals: wsy.032026@gmail.com.
The commercial terms are in the Terms & Conditions.