Privacy Policy

Last updated: 2026-04-19

1. What we collect

• Account: your email address, via Supabase Auth.
• Usage: characters you create, prompts you submit, and outputs generated for you.
• Payments: Stripe handles payment processing. We receive only purchase metadata (product, amount, timestamp); we never see your card details.
• Logs: basic request logs (IP, timestamp, endpoint) for security and abuse prevention.

2. How we use it

Your data powers the Service — we store characters so you can revisit them, we count credits so billing works, we send you transactional emails tied to your account. We do not use your prompts or generated content to train AI models. We do not sell your data. We do not share your data with third parties except service providers required to operate the Service (Supabase, Stripe, Resend, Venice AI).

3. Third-party providers

CharaForge integrates with: Supabase (auth + database), Stripe (payments), Resend (transactional email), Venice AI (AI generation), and Vercel (hosting). Each provider has their own privacy policy governing data they receive.

4. Your rights

You can export all your data from your Account page (Download all my data). You can delete your account by emailing support@charaforge.io — deletion removes your profile, characters, tags, and purchase history permanently, typically within 7 days.

5. Data retention

Account data is retained until you delete your account. Signup attempt logs (used for abuse prevention) are retained for 90 days. Purchase records are retained for 7 years for tax/legal compliance.

6. Children

CharaForge is for users 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, email support@charaforge.io and we will delete it promptly.

7. Changes to this Policy

Material changes will be announced via email at least 14 days before taking effect.

8. Contact

Privacy questions or data requests: support@charaforge.io

Notice: This is a starter template. Have a lawyer review for jurisdiction-specific requirements (GDPR, CCPA, etc.) before production launch.