Effective date: 11 October 2026

Developer: Hooma Ltd., London, United Kingdom

Contact: [email protected]

This policy explains what Sotto ("the app", "we") does with data, in plain language. Sotto has no accounts, no ads, and does not sell or share data for advertising.

1. The short version

• Your village lives on your device. Your game state is stored locally.
• To make villagers think and act, the app sends your whispers and the current state of your village to our server, which forwards them to Anthropic's Claude API. This is the only part of the game that leaves your device.
• We never collect your name, email, contacts, photos, or your device's location, and the app does not ask for them. The app does not read Apple's advertising identifier or vendor identifier.
• We collect anonymous crash reports and anonymous usage statistics so the game keeps working. Each has its own switch in Settings → Privacy, and neither ever contains the text of a whisper.
• We do not track you across other apps or websites.

2. What data is processed and why

2.1 Whispers and village state (sent to an AI provider)

What: the text you type as a whisper, and the game's internal description of your village at that moment — villagers' names, traits, memories, relationships, and recent events. All of it is generated by the game; none of it is taken from your device.

Why: this is how villagers decide what they think, say, and do. Without it, the game cannot run.

Where it goes: to a server operated by Hooma Ltd. and hosted on Cloudflare, and from there to Anthropic, PBC's Claude API. Our server does not store whispers or village state after the request is answered. Anthropic processes this data under its commercial terms and privacy policy; under those terms, API inputs are not used to train Anthropic's models and are retained only for the limited period described in Anthropic's policy for abuse prevention.

What is not sent: anything about you. No account, no device location, no device fingerprint, and no advertising or vendor identifier.

What our server keeps: two short-lived counters that stop abuse of the service — the number of requests made today with your installation's token, and the number of new installations registered today from an IP address. The token is a random value issued by our server; it is not derived from your device, not linked to you, and not passed on to Anthropic. Both counters are deleted automatically within 48 hours.

Your control: the app asks for your explicit permission before the first request. If you decline, the village cannot run and the game will not start. You can review this choice in Settings → Privacy at any time.

A note on what you type: a whisper can contain anything you choose to write. Please do not put personal information — yours or anyone else's — into a whisper. The game does not need it, and once it has been sent we cannot remove it from a third party's systems.

2.2 Crash reports