Privacy Policy

Last updated: 2026-10-11

1. Who is responsible

HowWorks is developed and operated by NEPENTHE DAYDREAM LLC. This Policy covers HowWorks and its shared company-account functions. NEPENTHE DAYDREAM LLC is responsible for the personal information described here where it acts as controller or business under applicable law. For privacy questions or requests, contact support@howworks.ai and identify the relevant brand.

HowWorks provides AI-assisted research, creation and digital tools. Our registered office is 30 N Gould St Ste N, Sheridan, WY 82801, United States.

2. Information we handle

Depending on the features you use, we process:

• Account and sign-in information, including your email, account and OAuth identifiers, nickname, avatar and basic profile received from your chosen login provider.
• Prompts, research requests, links, reference materials, uploaded files or images, conversations, generated outputs, saved work and task history.
• Content you choose to create, publish or share, and comments, reports or community activity where those features are available.
• Device, IP/network, browser, language, usage, security and diagnostic information, and consent choices.
• Credits, purchase, usage, refund and dispute records.
• Messages and attachments you send for support, feedback, rights requests or business enquiries.

Information comes from you, your use of the service, sign-in providers and necessary service or payment providers. Content you choose to publish or share is accessible to the audience you select and may be copied by others. Only submit information you are authorized to use, and avoid unnecessary sensitive information in dialogue, prompts or uploads.

3. Purposes and legal bases

We use information to provide requested research, creation and digital tools, and preserve your work and task history; authenticate and protect the shared account; charge and reconcile Credits and orders; respond to support and rights requests; prevent abuse and diagnose faults; measure product use and campaigns under the choices described below; and comply with legal obligations.

Where data-protection law requires a legal basis, we rely on contract for requested services; legitimate interests for proportionate security, fraud prevention, troubleshooting and support, subject to your rights; consent where required for optional tracking; and legal obligations for required records or disclosures. Merely using the service is not consent to every form of processing or international transfer.

4. Shared account and payments

HowWorks and Nepenthe Play share an account identity, authentication and Credits balance under the same company. Necessary profile, security, payment and support information is processed at that shared layer; each domain establishes its own browser session. Product content is used for the function requested, not automatically made public or reused across brands simply because the account is shared.

Nepenthe Play purchases may take you to HowWorks and then a hosted checkout. The checkout and receipt identify the seller of your order. Creem acts as Merchant of Record for current Credits purchases and independently processes payment and billing information. We receive the order, status and entitlement information needed to deliver Credits, support your purchase and reconcile payments, but not full card credentials from the hosted checkout.

5. AI services and other recipients

We use providers for hosting and execution, authentication, AI inference and model routing, media generation, search and retrieval, security, analytics and payment services. These include Cloudflare for infrastructure, Google or GitHub for sign-in, and AI providers such as Google Gemini, DeepSeek and OpenRouter. Media functions can use providers such as fal. An AI request may pass through a routing provider and an upstream model provider; both may receive the content needed for their role. PostHog, Google Analytics/Ads and Reddit provide measurement as described below. The providers used depend on the feature; not every provider receives every request.

For our image generation and editing functions, Creem also receives the submitted text prompt and a request reference for content screening before generation. This screening is separate from payment processing.

Providers receive the content and metadata needed for their role, which may include prompts, selected conversation context, uploads, generated output and diagnostic information. We do not use customer content to train our own models. Third-party retention, safety review and use of content, including any model training, depend on the applicable service, terms, contracts and settings.

We may disclose information to professional advisers, authorities where lawfully required, or a successor in a lawful transaction. Providers may act as processors for us or as independent controllers for their own authentication, payment, security or other disclosed purposes.

6. Cookies and measurement choices

Necessary cookies support sign-in, security and preferences. Each domain stores its own first-party session and consent choices; your choice does not automatically carry across the two domains. The consent preference is stored for 180 days.

Where measurement tools are enabled, you can accept or reject optional analytics and advertising storage using the Cookie Banner or the Cookie preferences controls below. You can return to these controls to change or withdraw your choice. Withdrawal applies going forward and does not undo earlier lawful processing.

Google's consent state begins with analytics and advertising storage denied. Its Advanced Consent Mode may still send limited cookieless measurement signals before a choice or after rejection. PostHog capture is disabled before consent, although its software may be loaded; Reddit measurement loads after acceptance. Accepting enables the configured measurement storage. Rejecting does not disable necessary service functions. Browser controls can also remove or block cookies, though blocking necessary cookies may affect sign-in.

7. International processing

We and our service providers may process information outside your country, including in the United States, China and other countries where the relevant services operate or authorized personnel access information. Applicable transfer requirements and safeguards depend on the actual recipient and processing route. Contact support@howworks.ai for information about the recipients, processing locations and safeguards applicable to your use. Your rights under applicable international-transfer rules remain available.

8. Retention and account closure

We retain account and product records to operate your account, preserve requested work or progress and meet the purposes above. Retention depends on account status, content type, deletion requests, legal recordkeeping, disputes, security needs and provider-specific retention. There is no single deletion period covering every system.

The current account-closure function disables the shared identity, removes linked sign-in accounts and sessions, and replaces basic profile information. It does not itself immediately erase all chats, uploads, game saves, billing records, backups or provider copies. Closure affects access across both brands. To request erasure of product data, contact support@howworks.ai and identify the relevant brand and content.

We assess and carry out applicable rights requests, retaining only records for which a lawful retention ground continues. Billing, tax and dispute records may need to be retained despite closure; backup and provider deletion can follow different schedules. We can explain the retention criteria and any applicable exception when responding to a request.

9. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, portability, restriction, objection or review of our response, withdraw consent for processing based on consent, and complain to the competent data-protection authority. We verify identity proportionately and explain a refusal or exception where required. Send requests to support@howworks.ai; do not send passwords, full payment credentials or unrelated identity documents.

We do not use these entertainment and creative tools to make decisions about your eligibility for employment, credit, housing or similar high-impact services.

10. Age, security and updates

The services are intended for people aged 18 or over. This is an eligibility rule, not a claim that identity or age verification is performed for every user. If we learn that an ineligible minor has supplied personal information, we take reasonable steps to restrict the account and address deletion, subject to legal and refund obligations.

We use access controls and security measures appropriate to our services, but no system is completely secure. The revision date appears above; material changes receive any legally required notice.