Privacy Policy

This policy explains what CharID collects, why, and what you can do about it. It applies to charid.app and the CharID application.

1. What we collect

• Account information: your email address and a display name if you set one. Passwords are handled by our authentication provider and are never visible to us.
• Your projects: the text, images, characters, settings and other material you create or upload, and the images and text generated for you.
• Usage: which features you use, generation counts, credit balance and ledger, error logs, and the pages you visit in the app.
• Payment records: what you bought and when. Card details go directly to Stripe; we store only the last four digits and the card brand for display.
• Technical data: IP address, browser type, device type, and cookies needed to keep you signed in.
• Early access requests: the email and note you submit through the tester form.

Categories, in the terms California law uses: identifiers (email, IP address), commercial information (purchases, credit ledger), internet activity (feature use, pages visited), and the content you create or upload. Sources: you, your device, and Stripe for payment confirmations. We do not collect sensitive personal information as defined by California law, and we do not collect precise location, biometric data or government identifiers.

2. How we use it

• To run the Service: store your projects, generate what you ask for, lay out and export your books, and show your published work if you publish it.
• To bill you and keep the credit ledger accurate.
• To keep the Service safe: rate limiting, abuse detection, content moderation, and enforcing the Terms.
• To support you when you contact us.
• To understand how the Service is used so we can improve it. We use this in aggregate.

We do not sell your personal information. We do not show ads. We do not use Your Content or generated Output to train AI models.

3. Who else sees your data

We use a small number of service providers to run CharID. Each receives only what it needs:

• Supabase: database, file storage and authentication.
• Vercel: hosting and delivery of the website and app.
• Stripe: payment processing.
• AI providers (currently OpenAI and Google): when you run a generation, the relevant text, reference images and settings are sent to the provider to produce the result. These providers process the data to fulfill the request under their API terms and do not receive your account details.
• Resend: transactional email, such as tester-invite notifications.

We may also disclose information if required by law or to protect the rights and safety of users and the public.

4. Published work

If you publish a project to your portfolio or the marketplace, the published pages, your display name and the audience rating are visible to others according to the visibility you chose. Private works are visible only to you and anyone you share a link with.

5. Retention

Your projects and account data are kept while your account is open, because the Service needs them to work. After you close your account, we keep your data for 30 days so you can export it, then delete it, except for billing records we must keep for tax and accounting purposes (seven years), security logs (up to 90 days), and copies held briefly by our providers until their own deletion cycles complete. Data sent to AI providers to fulfill a generation is not retained by them for training and is deleted under their API retention terms.

6. Your choices and rights

• You can view, change or delete your projects at any time in the app.
• You can export your projects.
• You can close your account from settings, or by emailing support@charid.app.
• California residents have the right to know what personal information we collect and how it is used, to request deletion, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context advertising. To make a request, email privacy@charid.app from the address on your account.
• To verify a request we will match it to the email on your account and may ask you to confirm from that address. We respond within 45 days. If we decline a request you can appeal by replying to our response, and a different person will review it.
• We do not sell or share personal information, so there is nothing to opt out of; we honor Global Privacy Control browser signals anyway.
• If you are in a jurisdiction with additional rights, such as the European Union, contact us and we will honor the rights that apply.

7. Cookies

We use cookies and similar storage only to keep you signed in, remember your preferences, protect against abuse, and understand aggregate usage. We do not use advertising cookies.

8. Children

CharID is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has an account, email privacy@charid.app and we will delete it.

9. Security

Data is encrypted in transit and at rest with our providers. Access to production systems is limited to the founder. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

10. Changes

We will post updates here with a new effective date and notify you of material changes by email or in the app.

11. Contact

CharID Los Gatos, California privacy@charid.app