Privacy Policy.
How your account and character files are handled.
01. Who is responsible for your data?
CHARAFOLD is operated by matt, at [Registered business address]. Contact matt1232024@163.com for privacy questions or rights requests. These operator details must be completed before the service launches.
02. What information do we collect?
We collect the email address you provide for sign-in, optional profile information, account and purchase records, character briefs, uploaded references, generated files, and messages you send to support. Service logs may include your IP address, browser information, timestamps, and task or security events. Do not upload sensitive information that is unnecessary for your creative task.
03. Why do we use this information?
We use account information to verify access and provide your workspace; reference images and prompts to process the character tasks you request; transaction information to manage payments, receipts, refunds and tax obligations; and support messages to answer your request. Security logs help prevent abuse, investigate failures, and protect accounts. We process data where necessary to perform our agreement with you, comply with legal obligations, or pursue legitimate interests that do not override your rights. Optional marketing or public showcase use requires a separate choice.
04. Your character files and AI processing
When you request generation or refinement, CharaFold sends your reference image, character brief and, for refinements, the selected image to OpenAI through its Images API. CharaFold does not automatically publish your work or use it for its own model training or advertising without separate permission. OpenAI API data is not used for model training by default. Its standard abuse-monitoring retention can be up to 30 days, with exceptions described in OpenAI’s data controls. Our 24-hour image deletion applies to CharaFold storage and does not shorten a provider’s retention.
05. Who receives your information?
Cloudflare hosts the site and stores account records and private files. Resend processes your sign-in email address and verification email to deliver login codes. OpenAI processes the images and prompts you submit for generation. These providers process information under their own applicable policies and contracts. CharaFold does not sell personal information. Payment purchases are not enabled in this version.
06. How long do we keep it?
Sign-in codes expire after 10 minutes and are stored as a one-way hash. Uploaded references and generated images expire 24 hours after each file is saved. Account details, character briefs and activity records remain until you delete them. Transaction records may be retained where tax or accounting law requires it. Download image files you want to keep before expiry.
07. Cookies and browser storage
Essential, HttpOnly session cookies keep you signed in. Browser session storage keeps navigation preferences and the sign-in email during the current flow. CharaFold does not use third-party advertising trackers in this version. Optional analytics, if introduced, will be described here and offered with a separate choice where required.
08. International transfers
Our service providers may process information outside your country. Before launch, we will identify provider locations and the safeguards that apply to restricted international transfers, such as an applicable adequacy decision or contractual safeguards. Contact the privacy address for details of safeguards available for your location.
09. Your choices and rights
Depending on your location, you may request access, correction, deletion, a portable copy, restriction, or objection to certain processing. You may withdraw an optional consent without affecting processing already carried out. Use Privacy & files in your workspace or the privacy contact to request assistance. We may verify your identity and may retain information where a legal requirement or applicable exception applies. You may complain to the data protection authority in your location.
10. Security and your account
We use email verification and access controls to protect the workspace. No online service can promise absolute security. Keep your email account secure, do not share sign-in codes, and contact support if you suspect unauthorized access. Technical security measures and provider arrangements will be reviewed before the public service launches.
11. Age and authorized content
The service is intended for adults. Do not submit personal information about children or other people unless you have the necessary authority and a lawful basis for that use. Requests involving unauthorized images or misuse may be rejected or removed.
12. Policy updates and contact
We may update this policy as the service or its providers change. The latest revision date appears above. Material changes will be communicated through the service or account email when appropriate. Privacy contact: matt1232024@163.com. This document is the pre-launch policy text and must be finalized for the actual operating entity and processing arrangements.
13. Image retention
Uploaded references and generated images are automatically deleted from CharaFold storage 24 hours after each file is saved. Download the files you want to keep before the displayed expiry time. Image links stop working at expiry. Account details, character briefs, purchase records and support requests remain until deleted or retained as required by applicable law. Public studio samples are not user uploads and do not expire. OpenAI and Resend may retain data under their own policies, separately from this 24-hour CharaFold limit. See the provider information above.