Prepared pursuant to the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong)
Last updated: 2026-05-08
Data user: Bilibala Shadowpaw Limited
1. Purpose of Collection
Bilibala Shadowpaw Limited ("we", "our", "us") collects your personal data for the following purposes:
| Purpose | Description |
|---|---|
| AI Companion Services | To enable Yuna to remember you and converse with you |
| Account Management | To authenticate your identity, verify age (18+), and maintain your account |
| Personalisation | To remember your preferences, interests, and language settings |
| Service Improvement | To understand how users interact with our services and improve the product |
2. Data Collected
Data we collect:
| Data Category | Reason | Storage |
|---|---|---|
| Google ID | To enable Google sign-in | Firebase Firestore (HK, asia-east2) |
| Email Address | Account communications and contact | Firebase Firestore (HK, asia-east2) |
| Date of Birth | To verify you are at least 18 years of age (legal requirement) | Firebase Firestore (HK, asia-east2) |
| Gender (optional) | Optional self-declaration (M / F / Prefer not to say) used solely to tune Yuna's conversational tone. You may skip this step. | Firebase Firestore (HK, asia-east2) |
| Chat History | To provide Yuna with context so she can remember past conversations | Firebase Firestore (HK, asia-east2). Note: chat content is also transmitted to MiniMax (Singapore / China) for AI processing — see Section 10. |
Data we do NOT collect:
- Location data
- Phone numbers
- Hong Kong Identity Card numbers
- Credit card or bank details (we do not handle or store payment data)
3. Use of Data
Your data is used for:
Memory Function (core purpose):
- Yuna is your best friend. She needs to remember your name
- To recall your preferences and interests
- To follow up on things you have mentioned in previous conversations
- To provide a more personalised and natural conversational experience
Service Operations:
- To verify you are 18 or above
- To maintain your account
- To send notifications you have requested
Aggregated Analytics:
- To compile anonymised data on overall user behaviour
- To improve service quality
- We will never use your personal data for any commercial marketing purposes
4. Data Retention
| Data Category | Retention Period | Notes |
|---|---|---|
| Account data (Google ID, email, DOB) | Until account deletion | Deleted within 14 business days of your request |
| Chat history | Until you request deletion | Deleted within 14 business days; cannot be recovered |
| Anonymised analytics data | Indefinitely | Fully anonymised; not linked to any individual; re-identification risk mitigated via k-anonymity techniques |
| Backup data | 90 days after deletion | Automatically purged; no longer linked to you |
Active account data is reviewed annually. If your account has been inactive for 24 months, we may delete your account data after providing 30 days' notice via email.
We do not retain your data indefinitely beyond the above. You may request deletion at any time; we will process such requests within 14 business days.
4a. Data Breach Notification
In the event of a data breach that affects your personal data:
- We will notify you within 72 hours of becoming aware of the breach
- Notification will be sent to the email address associated with your account
- Notification will include: nature of the breach, data affected, actions taken and being taken to address the breach
To report a suspected data breach or for any data security concerns: see Section 11 — Contact Us.
5. Data Security
How we protect your data:
- ✅ Database protected by access controls and passwords
- ✅ All data in transit encrypted via HTTPS
- ✅ Only authorised personnel may access personal data
- ✅ Data is never stored in any publicly accessible location
6. Disclosure to Third Parties
We will never:
- ❌ Sell your personal data to advertisers
- ❌ Share your personal data with any third party for commercial purposes
- ❌ Transfer your personal data to other parties
Only exception: If required by law (e.g., court order, regulatory investigation), we will disclose only the minimum data required.
7. Cookies
Our website uses cookies and similar technologies. A cookie is a small text file stored on your device when you visit our website.
Types of cookies we use
| Cookie Type | Purpose | Duration | Who Places It |
|---|---|---|---|
| Essential cookies | Required for core functionality (session management, security, Firebase Auth) | Session / 7 days | MyYuna (first-party) |
| Analytics cookies | Help us understand aggregate usage patterns via Firebase Analytics (anonymised) | 24 months | Firebase Analytics (Google, third-party) |
Firebase Analytics — We use Firebase Analytics with IP anonymisation enabled. This data is fully anonymised and aggregated. You may opt out via your browser settings.
How to manage or disable cookies
You may block or delete cookies at any time via your browser settings:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Safari: Preferences → Privacy → Cookies and website data
- Firefox: Options → Privacy & Security → Cookies and Site Data
Blocking essential cookies may impair core functionality of the MyYuna website.
Cookie consent banner
On your first visit, you will be shown a cookie consent banner requesting your agreement to non-essential cookies before they are placed.
7a. Third-Party Service Providers
Our website uses the following third-party services:
| Service | Purpose | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Google Firebase | Authentication, database, storage, analytics, push notifications | Google ID, email, chat data, push subscription | Hong Kong (asia-east2) | https://policies.google.com/privacy |
| MiniMax | AI inference for Yuna's replies | Chat message content (only what is sent in the active conversation window) | Singapore / China | https://www.minimaxi.com/protocol/privacy-policy |
| We do not control the privacy practices of third-party services. We encourage you to review their privacy policies. Where third-party processing occurs outside Hong Kong, see Section 10 for cross-border transfer terms. |
8. Your Rights
Under the Personal Data (Privacy) Ordinance, you have the following rights:
Right of Access (Subject Access Request)
You may request a copy of the personal data we hold about you.
Contact us stating you wish to "exercise your right of access".
Right of Correction
If you believe any data we hold about you is inaccurate, you may request correction.
Contact us and we will correct the data as soon as reasonably practicable.
Right of Deletion ⛔
You may request deletion of all your personal data at any time, including all chat history.
Contact us stating you wish to delete your account and all associated data — see Section 11 for contact details. We will process your request within a reasonable number of business days.
Right to Opt-Out
You may opt out of receiving promotional communications from us.
9. Users Under 18
We do not accept users under the age of 18.
During registration, you must provide your date of birth. If we have reason to believe you are under 18, your registration will be refused.
If you are a parent or guardian and believe a minor has registered without your consent, please contact us immediately to request deletion of their data.
10. Cross-Border Data Transfer
Storage: Your account data and chat history are stored on Firebase servers located in Hong Kong (asia-east2 region).
Processing — important disclosure: To generate Yuna's replies, the content of your active conversation window is transmitted to MiniMax's servers (Singapore / China) for AI inference. These transmissions occur over encrypted (HTTPS) connections.
By using MyYuna you consent to this cross-border processing. We have selected third-party processors that publish industry-standard data protection commitments (see Section 7a for links to their privacy policies).
Should we in the future transfer your data to additional jurisdictions, we will ensure the receiving party provides a comparable standard of data protection and update this statement accordingly.
11. Contact Us / Complaints
If you have any questions about this Personal Information Collection Statement, or wish to exercise any of your rights:
Data user: Bilibala Shadowpaw Limited
Email: info@bilishadowpaw.com
Website: myyuna.bilishadowpaw.com
Making a Complaint
If you believe we have handled your personal data improperly, you have the right to complain to the Office of the Privacy Commissioner for Personal Data (PCPD):
- Website: www.pcpd.org.hk
- Address: 12/F, 248 Queen's Road East, Wan Chai, Hong Kong
- Phone: +852 2827 2827
Before making a formal complaint, we encourage you to contact us first so we have the opportunity to address your concern directly. We aim to respond to all data-related queries within 14 business days.
12. Statement Updates
We may update this statement from time to time.
Material changes — We will notify you via a prominent notice on our website or by email.
Your continued use of MyYuna constitutes acceptance of any updated statement.
Summary (Plain Language)
- We collect: Google ID, email, date of birth, chat history
- Purpose: To provide you with an AI companion service
- We do not sell data to advertisers
- You may request deletion of all your data at any time
- We do not accept users under 18
© 2026 Bilibala Shadowpaw Limited. All rights reserved.
This statement is prepared in compliance with the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong). In case of discrepancy, the English version shall prevail.
Version: v1.0 | Last updated: 2026-05-08