Conversation privacy

Updated 20 October 2026. Current service information; full seller contact information and professional review remain outstanding.

What this Site accepts

PatientVille is fictional entertainment for adults 18+. The conversation accepts your written messages, up to 1,000 characters each. There is no account registration or file upload. When checkout is available, payment takes place on Stripe and may collect real money. PatientVille never receives card numbers or wallet credentials. Do not send personal, medical, financial or third-party information.

AI processing

After you select “Talk to” and send a message, your messages, the fictional character’s approved biography and a short conversation history are sent to OpenAI to generate and check replies. The server uses the Responses API with store=false. This does not eliminate OpenAI’s security or abuse-monitoring retention. See OpenAI API data controls. Processing location and international transfers depend on the hosting and provider configuration; no regional-residency guarantee is made.

Storage and clearing

The visible transcript and signed continuation token remain in this tab’s memory, not localStorage or an account database. Clear chat removes that room’s transcript and token. End conversation also withdraws the tab’s permission to send more requests. Refreshing clears all transcripts. Clearing does not delete any provider security records already created. Requests already sent may finish at the provider.

Operational protection

A necessary HttpOnly, Secure, SameSite=Strict cookie expires after 24 hours. Short-lived database counters enforce usage limits. They contain random session identifiers, daily one-way keyed network hashes and counts; never conversation text or raw network addresses. Counters expire within two days and expired rows are removed on subsequent successful quota checks. Hosting providers may maintain security and traffic logs. The application does not log messages or provider replies, sell data or use advertising analytics.

Digital purchases

Stripe handles payment details, billing and tax-location addresses, receipts and configured tax calculation. This does not confirm the operator’s tax registration or compliance. Its checkout requests an address for tax calculation and wallet eligibility; no physical item is shipped. PatientVille stores a random browser identifier as a one-way hash, order reference, item, character, design choices, currency, amount, status and Stripe checkout reference. It does not copy billing addresses, payment-card details or email addresses into its order database. Records are used to confirm payment and restore purchased decorations. Purchase records persist until removed by the operator. A formal retention schedule and direct operator contact still need to be published; these remain unresolved documentation limitations.

A necessary Secure, HttpOnly, SameSite=Lax cookie named __Host-pv-shop identifies your purchases for up to one year in the same browser and website host. Clearing it or moving to another browser does not refund a payment and prevents automatic purchase restoration. Keep the Stripe receipt for support. Stripe may set its own necessary cookies on its checkout domain. Purchases do not change the character’s conversation or wellbeing.

Controls

You can leave without starting AI. Stories remain readable. Chat has no access to tools, purchases, other visitors or personal records. No real patient, clinician or emergency service is involved. Full seller identity, address and direct contact remain incomplete; see the terms and purchase support information before buying.

Aggregate usage and campaign counts

We count public pageviews, room opens, first and third successful AI replies, gift views, checkout starts and chat-limit/errors by UTC day and public page. The counter uses no analytics cookies, visitor identifiers, chat content, raw IP addresses, full referrer URLs or arbitrary query strings. It accepts only broad sources or eight predefined campaign codes (pv_exp01 to pv_exp08); other query values are discarded. The latest valid code is remembered only in the current tab’s memory and passed to Stripe metadata when you start a checkout. It is not a cross-device or seven-day tracking profile.

Confirmed live purchases are counted only after server verification with Stripe. A private order-reference table prevents duplicate webhook events being counted twice; order references are not exposed in daily aggregates. Browser Do Not Track and Global Privacy Control signals disable client recording and mark new checkout sessions to exclude purchase analytics. Aggregate counts older than 365 days are removed on subsequent recording. These counters are separate from hosting security logs and payment records.