How Character App handles your data.

1. Overview

This Privacy Policy explains how charactr, inc. ("charactr," "we," "us") handles personal information when you use our websites, mobile apps, APIs, and related services (the "Service"). It applies to everyone who creates an account, submits a prompt, uploads a reference, subscribes to a plan, or otherwise interacts with the Service.

We built Character App for adults (17+). If you are under 17 or under the age of digital consent where you live, you may not use the Service.

Third-party AI consent. The app generates content using third-party AI providers (Fal.ai, GMI Cloud, BytePlus, Google, OpenAI). Before any prompt, photo, or other input you submit is sent to one of these providers, the app shows you an in-app consent screen explaining what is sent and to whom. You must accept that consent before generation can begin, and you can withdraw it at any time from Settings (which disables the affected features).

If you do not agree with how we handle data as described here, please stop using the Service. You can start account deletion from Account > Delete Account.

2. Information We Collect

We collect the following categories of information:

• Account data. Email address, user ID, display name, authentication provider (email/password, Apple Sign In, Google OAuth), date of birth (for age-gate compliance), and password hash (managed by Supabase Auth; we never see your plaintext password).
• Prompts and inputs. Text prompts, scene descriptions, character definitions, style notes, and any instructions you send to a generation model.
• Reference uploads. Images, photos, or short videos you upload, or add through ChatGPT, as references for characters or scenes.
• Generated content. Characters, images, videos, storyboards, and any other outputs produced for you.
• Subscription and purchase data. Plan tier, billing cycle, subscription status, purchase receipts, entitlement state, and transaction metadata. Full card and Apple ID details are handled by Stripe and Apple respectively, and we never see them.
• Device and crash data. Device model, OS version, app version, language, crash logs, and stack traces. When you are signed in, we attach your account ID to Sentry reports so we can investigate account-specific reliability problems. Before Sentry transmits an event, our sanitizer redacts bearer tokens, authorization/cookie/API-key headers, named prompt/character/filename/display-name fields, and email-like strings; the Sentry user object is reduced to its ID. Diagnostic data is not used for advertising or cross-app tracking.
• Push notification tokens. If you grant push permission on iOS, the app receives an Apple Push Notification service (APNs) device token from the operating system and stores it on your account so we can deliver generation-ready, moderation, and account notifications. You can revoke push permission at any time in iOS Settings; the token is rotated by Apple on reinstall and is removed when you delete your account. If a token is disabled or APNs reports it as dead, we soft-revoke its record so it cannot receive notifications and retain that disabled record until account deletion.
• Product interaction data. Pages viewed, features used, generations started, errors hit, and timing data. PostHog uses persistent app-scoped identifiers, which are associated with your account after sign-in. This data is not linked to advertising identifiers, we do not track you across other apps or websites, and we do not build advertising profiles. On web, Sentry also collects masked replays from a sample of visits. PostHog's masked session recording, heatmaps, and signals when clicks appear frustrated or ineffective are enabled; after sign-in, this data is linked to your account. PostHog masks text and inputs in recordings, but the interaction structure and displayed media can still be present. PostHog also derives an approximate city/country region from the connection IP for analytics.
• Support and safety communications. Emails, reports, appeals, or safety notices you send us, plus any notes we write when investigating them.

Account and signed-in activity data are linked to your account identity. This includes diagnostic telemetry: when you are signed in, Sentry reports carry your account ID for reliability diagnosis, and PostHog analytics identifiers are associated with your account. Before sign-in, product analytics can use app-scoped anonymous and session identifiers that are linked to your account if you later sign in. None of these categories are used for tracking across other apps or websites, and none are shared with advertising networks or data brokers.

3. How We Use Your Information

We use personal information to:

• create your account, authenticate you, and deliver the Service;
• route your prompts, references, and generations to AI providers to produce the outputs you request;
• process subscriptions, Apple IAP purchases, and Stripe web checkouts;
• provide customer support and respond to reports, disputes, and appeals;
• detect, investigate, and stop abuse, fraud, CSAM, non-consensual imagery, and Terms violations;
• measure reliability, diagnose crashes, and improve performance;
• comply with law, legal process, and lawful requests from authorities;
• enforce our Terms, Content Policy, and DMCA process.

We do not train AI models on your content. We do not sell your personal information. We do not use your prompts or generations to improve third-party foundation models beyond what is necessary to deliver the requested output under each provider's standard retention settings.

4. Legal Bases (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland, we rely on the following legal bases:

• Contract. Most processing is necessary to deliver the Service you asked for (authentication, generation, billing, support).
• Legitimate interests. Abuse prevention, fraud detection, security monitoring, crash analytics, and basic product analytics. We balance these interests against your rights and you can object at any time.
• Consent. Any optional marketing communication or future features that require it. You can withdraw consent anytime without affecting processing that already occurred.
• Legal obligation. Tax, accounting, CSAM reporting (NCMEC), responding to lawful requests, and honoring your statutory rights.

5. Third-Party Processors

We share personal information only with vendors that process data on our behalf to deliver the Service. Each is bound by a data processing agreement and industry-standard confidentiality terms.

• Supabase — database, authentication, storage, and edge functions. See supabase.com/privacy.
• RevenueCat — iOS subscription management (wraps Apple StoreKit 2). See revenuecat.com/privacy.
• Apple — iOS In-App Purchase, Sign in with Apple, and App Store delivery. See apple.com/legal/privacy.
• Stripe — web checkout and subscription processing. See stripe.com/privacy.
• OpenAI (OpenAI API) — we send your text prompts (and, for vision-based prompt assistance, the photo you reference) to produce moderation results, prompt enhancements, scene regeneration, and certain image and script generations. We use API tiers that, per OpenAI's published commitments, do not use submitted data to train OpenAI's models. See openai.com/policies/privacy-policy and openai.com/enterprise-privacy. This describes our use of OpenAI’s API. It is separate from ChatGPT; see section 14.
• Google (Gemini API, Veo, Imagen via Google Cloud) — we send your text prompts and, for image-to-video and image-conditioned generations, the photo you select (as a URL or, for the Gemini path, base64) to produce videos, images, and prompt enhancements. On web we also use Google OAuth sign-in. We use the paid Gemini API and Google Cloud tiers, which per Google's published commitments do not use submitted prompts or files to train Google's foundation models. See ai.google.dev/gemini-api/terms, cloud.google.com/terms/data-processing-addendum, and policies.google.com/privacy.
• Fal.ai — we send your text prompts and, for image-to-video and image-conditioned generations, the photo URL you select, to produce videos and images via the model providers Fal hosts. Fal's published privacy terms describe the retention applied to API submissions. See fal.ai/privacy-policy.
• GMI Cloud — we send your text prompts and, for image-to-video and image-conditioned generations, the photo URL you select, to produce video and image outputs on the model endpoints GMI Cloud hosts. GMI Cloud's published privacy terms describe the retention applied to API submissions. See gmicloud.ai/privacy-policy.
• BytePlus (BytePlus Ark, ByteDance) — for certain Seedance-family video generations we route the request to BytePlus Ark (the ByteDance enterprise inference platform). We send your text prompt and, for image-to-video and image-conditioned generations, the photo URL you select, to produce the requested video output. BytePlus Ark processes data in the Asia-Pacific region. We use enterprise API tiers under which, per BytePlus's published terms, submitted prompts and reference media are not used to train BytePlus or ByteDance foundation models. See byteplus.com/legal/privacy-policy.
• Sentry — crash, error, and performance tracing. Signed-in reports carry the account ID; before transmission, the sanitizer redacts the credential, named-field, and email-like values described in Section 2 and reduces the user object to its ID. On web, this includes masked session replays of a sample of visits (5%) and every visit in which Sentry captures an error, linked to your account after sign-in. See sentry.io/privacy.
• PostHog — first-party product analytics for pageviews, feature usage, generation lifecycle events, checkout outcomes, app lifecycle events, error diagnostics, and network/web-vitals performance signals. Persistent app-scoped identifiers are associated with the account after sign-in. We do not send raw prompts, emails, auth tokens, payment secrets, or advertising identifiers to PostHog, and do not use it for cross-app tracking. This includes masked session recordings linked to your account after sign-in, plus heatmaps and signals for frustrated or ineffective clicks. Recording masks text and inputs but can retain the interaction structure and displayed media. PostHog also derives an approximate city/country region from the connection IP for analytics. See posthog.com/privacy.
• Capgo — iOS over-the-air updates of the web bundle for the native app. It receives an opaque installation identifier plus app and bundle versions, but no prompts, media, or auth tokens. See capgo.app/privacy.
• Vercel — web hosting and edge network. See vercel.com/legal/privacy-policy.
• Render: hosts the server that connects Character App to ChatGPT and other assistants, and the worker that cuts, joins and prepares video files. See render.com/privacy.

Your prompts and reference uploads may pass through one or more of the AI providers above to produce a requested output. Each provider processes that data under its own privacy terms and retention policies, and we choose API tiers that do not use customer data to train their foundation models.

6. Data Retention

We retain personal information only as long as we have a lawful reason to:

• Character-defining uploads — any photo you save to a character (the source photo you upload when creating a character, or a reference photo you later set as that character's visual reference): kept for as long as the character exists in your library, so the character can be re-rendered consistently. When you delete the character, we also remove every file tied to it: the source photo, the AI-generated reference image, the aspect-ratio variants, every image and video the character produced, and every prompt attachment.
• One-off generation uploads — anything you upload for a single generation that does not get saved to a character (for example, a reference image used for image-to-video, a driving video used for motion transfer, a prompt attachment, or a storyboard scene image upload): automatically deleted within 14 days of upload by a daily scheduled cleanup that runs at 03:00 UTC, even if your account remains active. Files added through ChatGPT are covered in section 14.
• AI-generated outputs — the images, videos, and character reference images our system produced: kept in your account until you delete the output, delete the character it belongs to, or delete your account. Account deletion removes work that belongs only to you and your personal source media. Where a collaborative or Bible artifact is needed by other members, it may be retained only after your identity and personal face-source data are removed; an active collaborative World must be archived or transferred before deletion can complete.
• Billing and tax records: retained for up to 7 years to meet tax, accounting, and audit obligations, even after account deletion.
• Safety, abuse, and moderation records: retained for up to 2 years to protect users and enforce our Terms, even after account deletion.
• Crash logs: retained for 90 days, then purged.
• Backups: encrypted backups containing deleted data age out within 30 days.

7. International Transfers

Character App is operated from the United States. Our primary infrastructure (Supabase, Vercel, Render, Stripe, OpenAI, Google, Fal.ai, GMI Cloud, BytePlus, Sentry) processes data in the United States and, in some cases, the EU or other regions — and, for BytePlus, the Asia-Pacific region.

When personal information of EEA, UK, or Swiss users leaves those regions, we rely on European Commission–approved Standard Contractual Clauses (SCCs) and equivalent transfer mechanisms for the UK and Switzerland. Where a provider offers EU-region data processing, we use it by default.

8. Security

We use industry-standard security controls:

• encryption in transit (TLS 1.2+) and at rest (AES-256) across databases, storage, and backups;
• Supabase row-level security to isolate every user's data;
• principle-of-least-privilege access controls for operators and support staff;
• automated dependency scanning and secrets scanning in CI;
• short-lived auth tokens and signed URLs for file access;
• an incident-response process and a 72-hour breach notification target to affected users and regulators where required.

No system is perfectly secure. You share the responsibility by using a strong, unique password (or passkey) and keeping your device secure.

9. Your Rights Under GDPR / UK GDPR

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — ask us to correct inaccurate data;
• Erasure — start account deletion from Account > Delete Account, or email us;
• Portability — export your data in a structured, machine-readable format;
• Restriction — ask us to pause processing in defined situations;
• Objection — object to processing based on legitimate interests;
• Withdraw consent — where processing relies on consent;
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@character.app. We respond within 30 days. We may ask you to verify your identity before acting on certain requests.

10. Your Rights Under CCPA / CPRA (California)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose;
• Delete personal information we hold about you;
• Correct inaccurate personal information;
• Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of;
• Limit use of sensitive personal information — we only use sensitive PI for the purposes the CCPA already permits without this limitation;
• Non-discrimination — we will not penalize you for exercising these rights.

Categories collected (last 12 months). Identifiers (email, user ID, IP), customer records (display name, DOB), commercial information (subscription status, purchase history), internet activity (pages viewed, features used), audio / visual information (uploaded photos and videos, generated outputs), and inferences drawn from prompts.

Sources: directly from you (account inputs, uploads, prompts), automatically from your device (app version, crash data), and from our service providers (Apple, Stripe, and RevenueCat for purchase confirmations).

Business purposes: delivering the Service, processing payments, customer support, security and fraud prevention, legal compliance, and AI generation on your behalf.

Categories of recipients: the third-party processors named in section 5. We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months and have no intent to do so.

To exercise these rights, email support@character.app. Authorized agents may submit requests with written authorization.

11. Children’s Privacy

Character App is rated 17+ and is not intended for children. We present an un-dismissible date-of-birth age gate on first launch. Users under 17 are blocked from creating an account.

We do not knowingly collect personal information from anyone under 17. If you are a parent or guardian and believe your child created an account, email support@character.app and we will delete the account and associated data immediately.

Character App is not directed to children under 13 and we do not knowingly collect personal information from children under 13 within the meaning of the U.S. Children's Online Privacy Protection Act ("COPPA"). If we become aware that we have collected such information we will delete it.

If you are in the EEA, UK, or Switzerland, the minimum digital age of consent varies by country (typically 16). We enforce the strictest in your jurisdiction.

12. Photos and Face Data

This section addresses, in order, the six face-data disclosures Apple requires under App Review Guideline 5.1.1(i). Apple's term "face data" can refer to (a) photos that contain faces and (b) any biometric features extracted from those photos. Character App does not extract biometric features — we do, however, store photos that may contain faces. The sub-sections below describe each practice explicitly.

How we collect photos. Photos enter the Service only when you actively choose to add them: by tapping the camera button (which opens the iOS camera through the standard system permission prompt), by tapping the photo-picker button (which opens iOS's PHPicker), or by uploading from your device on the web. We do not scan your photo library, and we do not pull photos in the background.

Where photos are stored. Photos are uploaded to Supabase Storage at the path uploads/users/{userId}/images/{imageId}. The bucket has row-level security policies that block anonymous access and restrict each user to objects under their own users/{userId}/ path. Files are served to authorized parties (your own browser, our AI providers) via short-lived signed URLs that expire automatically. As an additional layer, every storage path includes random UUIDs that are not enumerable from the URL pattern alone.

12.1 Whether face data is retained

We do not extract or store any biometric face data such as faceprints, face embeddings, face geometry vectors, or other identifiers derived from facial features. We do not run face-recognition or face-identification algorithms on your photos. The Apple Vision face APIs and the iOS Face ID framework are not used by this app. What we DO retain are the photos themselves, including any photos in which a face appears, treated as ordinary user content. The retention rules in section 12.3 apply to those photos.

12.2 Reasons for storing the photos containing faces

We store photos containing faces only to provide the service you requested:

• Character-defining photos (photos you save to a character) are kept so the character can be re-rendered consistently from the same source reference in future generations.
• One-off reference photos (photos used for a single generation that is not saved to a character) are kept transiently to fulfill the immediate generation request.
• AI-generated outputs (images and videos that the system produces, which may include faces) are kept so you can view, edit, or download them later.

We do not use stored photos for training AI models, advertising, fraud profiling, or any purpose other than delivering the requested feature.

12.3 Length of storage, and why each duration

• Character-defining photos: kept for the lifetime of the character. Reason: a saved character is, by definition, intended to be re-used across multiple generations; deleting the source reference would break consistent re-rendering. The user can delete the character at any time, which immediately removes the source photo. We do NOT keep these photos beyond the lifetime of the character.
• One-off reference photos: kept up to 14 days, then automatically deleted by a daily cleanup job that runs at 03:00 UTC. Reason: 14 days is short enough to honor the one-off nature of the upload while leaving a brief window for retry or debugging if the generation failed; this is the shortest practical window we have validated does not break legitimate retry flows.
• AI-generated outputs: kept until the user deletes the output, the character it belongs to, or their account. Reason: the user explicitly created and is intended to manage these outputs (download, edit, share, or remove). They are not raw face data; they are AI compositions.
• Encrypted backups: age out within 30 days. Reason: standard cloud-storage backup window for incident recovery; backups are encrypted at rest and not used for any other purpose.

We do not store face-containing photos indefinitely. Account deletion removes client-uploaded face-source photos associated with your account; the daily 14-day cleanup removes one-off reference photos automatically. A shared artifact that remains for other members is kept without your identity and with its face-source fields removed, and character deletion removes the photos tied to that character.

12.4 Third parties we share face data with

When you trigger an AI feature that processes a photo containing a face, that photo (or a reference URL to it) is sent to one of the following third-party AI providers, depending on the feature and model you select:

• Fal.ai (fal.ai)
• GMI Cloud (gmicloud.ai)
• BytePlus / ByteDance (BytePlus Ark)
• Google (Gemini API, Veo, Imagen via Google Cloud)
• OpenAI (OpenAI API)

We do not share photos with any other third parties. We do not sell, license, or otherwise transfer your photos to data brokers, advertisers, social platforms, or any other recipients.

12.5 Reasons for sharing with each third party

We share each photo with a third-party AI provider for the sole purpose of fulfilling the specific generation request you initiated:

• Fal.ai: image-to-image generation, character image generation, motion-transfer composition, and similar pipelines that require a reference image.
• GMI Cloud: video generation (Seedance models), image generation, and image-conditioned video pipelines.
• BytePlus / ByteDance: Seedance-family video generation, used as a backup or capacity-overflow path when capacity on other providers is constrained.
• Google: image generation (Imagen) and video generation (Veo) when you select a Google-backed model; image understanding via Gemini for prompt-attached photos.
• OpenAI: prompt enhancement, image description, scene generation, and similar text/vision LLM tasks where the photo provides reference context.

We do not send photos for any purpose other than completing the in-app feature you triggered.

12.6 Whether each third party stores face data, and if so, their practices

Each third party named above receives the photo over an authenticated API call. The retention practice of each provider, as published in their developer agreements as of October 8, 2026, is summarized below. We rely on these providers' published commitments and do not have visibility beyond what they publish; for the most current information, please consult each provider's privacy policy.

• Fal.ai: enterprise API tier. Per Fal's published terms, customer inputs and outputs are stored only to deliver and improve the immediate inference and are not used to train Fal's foundation models. Standard inference data retention is up to 30 days for abuse monitoring and operational debugging. Reason: Fal cites operational integrity (abuse detection, debugging failed jobs) for the 30-day window. Source: fal.ai/legal.
• GMI Cloud: enterprise API tier. Per GMI's published terms, customer inputs and outputs are not used to train GMI or third-party models. Inference logs are retained for up to 30 days for service operation. Reason: GMI cites service-operation needs (debugging, capacity planning) for the 30-day window. Source: gmicloud.ai/privacy.
• BytePlus / ByteDance: enterprise API tier. Per BytePlus published terms, prompts and reference media submitted via the Ark API are not used to train BytePlus or ByteDance foundation models. Submission logs are retained for up to 30 days for operational and abuse-monitoring purposes. Reason: BytePlus cites service operation and content compliance for the 30-day window. Source: byteplus.com/en/legal/privacy-policy.
• Google (Gemini API, Veo, Imagen via Google Cloud): Google AI for Developers paid tier. Per Google's terms, prompts and outputs in the paid tier are not used to improve Google's models. Google retains data for up to 55 days for abuse monitoring and operational logging on Gemini API; Veo/Imagen retention follows Google Cloud's standard customer-data retention policies. Reason: Google cites abuse monitoring and operational logging for these windows. Source: ai.google.dev/gemini-api/terms and cloud.google.com/terms.
• OpenAI (OpenAI API): OpenAI API tier (zero-data-retention disabled by default; we do not opt into ZDR for cost reasons but do operate under the standard API-tier no-training commitment). Per OpenAI's API data-usage policy, prompts and outputs are not used to train OpenAI models. OpenAI retains API request data for up to 30 days for abuse monitoring and then deletes it. Reason: OpenAI cites abuse monitoring and Trust & Safety review for the 30-day window. Source: openai.com/policies/api-data-usage-policies.

We do NOT direct any of these providers to perform face recognition, face matching, biometric template extraction, or any face-identification operation. We use the providers strictly for image, video, and text generation.

13. AI-Specific Disclosures

Third-party AI services we use. The Service routes generation requests to five third-party AI providers: Fal.ai, GMI Cloud, BytePlus (BytePlus Ark, ByteDance), Google (Gemini API, Veo, and Imagen via Google Cloud), and OpenAI (OpenAI API). Section 5 names each provider, links its privacy policy, and states what we send and why.

What data we collect for AI use. For AI generation we collect: the text prompts you type or paste, the photos and short videos you upload as references (camera, photo picker, or web file upload), the generation parameters you choose (model, aspect ratio, duration, etc.), and the outputs the provider returns. We collect this data only when you actively invoke a generation feature.

How we collect that data. Prompts are collected from the in-app prompt fields. Photos and videos are collected through the iOS camera (via the system camera permission prompt), the iOS photo picker (PHPicker), or web file uploads — never by background scanning. Generation parameters are collected from the in-app controls you set.

All uses of that data. We use this data to (a) call the relevant third-party AI provider to produce the output you requested; (b) store your prompts, saved characters, and generated outputs in your account so you can view, re-use, edit, or delete them — one-off reference uploads are held only for the 14-day window described in section 6 before being auto-deleted; (c) run automated moderation classifiers on prompts (and, in some cases, outputs) to detect prohibited content (CSAM, non-consensual imagery, certain real-person and celebrity categories); and (d) diagnose errors when a generation fails. We do not use prompts, photos, or generations for advertising, for our own model training, or for any purpose outside fulfilling and supporting the feature you invoked.

Equivalent third-party protection. We send your data only to AI providers whose published privacy and data-processing terms commit to protections at least equivalent to those described in this policy: (i) data submitted via the API is not used to train the provider's foundation models; (ii) data is retained only for the operational window the provider documents and is then deleted; (iii) the provider operates under enterprise-grade security controls. Each provider's policy is linked in section 5 so you can review the specifics. If a provider materially changes its terms in a way that weakens these protections, we will move that workload to a different provider or update this policy before continuing to use the new terms.

Training. We do not use your prompts, uploads, or generations to train AI models of our own. We use API tiers with our AI providers that, per each provider's published commitments, do not train their models on customer-submitted data.

Provider processing window. When you generate something, your prompt and any attached reference photos are sent to the relevant AI provider to produce the requested output. The provider may temporarily process and store that request according to its standard retention policy (linked in section 5). We pick providers and tiers that minimize that window.

Outputs are probabilistic. AI models can produce incorrect, offensive, or unexpected content. You are responsible for reviewing any output before using it publicly or commercially.

Ownership. Subject to applicable law and the Terms of Service, generated outputs are yours to use, including for commercial purposes, provided your inputs and outputs comply with our Content Policy and the underlying AI provider's acceptable-use terms.

Automated moderation. We run automated classifiers on prompts and, in some cases, outputs to detect prohibited content (CSAM, non-consensual imagery, certain real-person and celebrity categories). Flagged prompts may be blocked or sent to manual review. You can appeal a moderation decision by emailing support@character.app; a human will review within 48 hours.

14. Character App in ChatGPT

Character App is also available as an app inside ChatGPT. When you connect it, ChatGPT can act in your own Character App account, and only as you. This section explains what ChatGPT and OpenAI see, what we receive, what we keep and for how long, and how to disconnect and delete. Everything else in this policy still applies.

What you are connecting. You approve the connection on a Character App page while you are signed in. The connection can see your account email, read your Characters, Worlds, Stories, Clips and Images, see your Credit balance and plan status, and start creation steps for you. It cannot see other members’ private content. A chat message never spends Credits: each paid step shows its exact price first and spends only when you press the button in the Character App card. Nothing is sold inside ChatGPT, and we do not receive card or payment details through ChatGPT.

What ChatGPT and OpenAI see. Whatever Character App returns into the conversation. For example: names, descriptions, titles and Scene text from your Characters, Worlds and Stories, your Credit balance, prices, and the status of what you are making. Private previews and video links are shown in the Character App card and expire quickly. ChatGPT may also keep small pieces of card state with your conversation, such as item IDs, prices, the Story idea you typed, attachment titles, and an internal reference to a file you added (which includes your Character App account ID). A photo or clip you attach in ChatGPT is first held by OpenAI. OpenAI handles all of this under its own privacy policy and your ChatGPT settings, not under our provider agreements; what sections 5 and 12 say about OpenAI’s API does not describe ChatGPT. Removing something in Character App does not delete what ChatGPT already received. Use ChatGPT’s own controls for that. See OpenAI’s privacy policy.

What we receive from ChatGPT. Your approved sign-in (your account ID and email); the words ChatGPT sends us when you ask for something, such as a Character description, a name, a Story idea or a Clip prompt; and the photos or clips you add. When you add a file, Character App downloads it once from OpenAI’s file host and stores a copy in your account storage. Photos can be up to 25 MB and clips up to 100 MB. Adding a file costs nothing and does not send it to an AI provider. Before a clip is prepared you confirm you have the rights to it, and you confirm permission before a photo of a real person is used for a Character.

What we keep, and for how long. What you add or make is stored in your Character App account with Supabase, in the United States, the same as anything you create in the app (section 5).

• Photos and clips added through ChatGPT, and the working copies we prepare from them: kept until you delete them, delete the Character they belong to, or delete your account. They are not part of the 14-day one-off cleanup in section 6. A photo you turn into a Character becomes that Character’s source photo (section 6) and is removed when you delete the Character.
• Characters, Clips, Images and Stories you make: kept until you delete them or delete your account (section 6).
• Technical logs on our ChatGPT connection server: when a request happened, which tool it used, a file’s size and whether it worked, never the file itself. We keep them only as long as needed for security and debugging.
• A temporary copy of an added file exists on that server while it is being stored, then it is deleted when the request finishes.

Who processes it. When you ask Character App to prepare or make something, the providers described in sections 5 and 12 process only what that step needs. Google Vertex AI reads your clip and Character images and draws Characters, first frames and Images. fal.ai renders video Clips from your Character images and prepared clip. Render prepares video files (cutting and joining) in Oregon, United States. Supabase stores everything. If our main Story-writing service is unavailable, OpenAI’s API may be used instead to write a Story. We use API tiers under which these AI providers commit not to train on your content (sections 5 and 12.6). We do not train AI models on your content, we do not use it for advertising, and we do not sell your personal information.

17+, consent and rights. Character App is for people 17 and over, and connecting ChatGPT does not change that. ChatGPT does not tell us your age. Age confirmation, AI-processing consent and the rights and permission confirmations are checked in your Character App account before anything is sent to an AI provider. If you are under 17, you may not use Character App, in ChatGPT or anywhere else.

Disconnecting and deleting.

• To stop ChatGPT using your account, disconnect Character App in ChatGPT’s app settings. New requests stop; access you already granted may keep working for a few minutes.
• Disconnecting does not delete anything stored in Character App. Delete a Character, Clip or Image in Character App. To delete everything, use Account > Delete Account (section 18): it removes the photos, clips, working copies and generated media in your account, subject to the retention exceptions in section 6. You can also email support@character.app.
• To delete what ChatGPT holds, use ChatGPT’s own controls, such as deleting a conversation and your data controls.

15. Cookies and Local Storage

We use cookies and local storage to keep you signed in, remember your V5 theme preference, preserve CSRF tokens, and run first-party product analytics. Product analytics stores anonymous, session, and signed-in identifiers so we can understand pages viewed, features used, checkout outcomes, generation blockers, generation success rates, errors, and app lifecycle events. We do not use advertising cookies, cross-site tracking pixels, advertising identifiers, or Do Not Track bypasses.

If you block cookies in your browser, core features (sign-in, persistent session) may not work. If you block local storage, product analytics identifiers, saved preferences, and draft state may not persist. See our Cookie Policy for full details.

16. Do Not Track and Global Privacy Control

Because we do not run advertising networks or cross-site tracking, DNT and GPC signals have nothing to disable. We honor the spirit of these signals by not engaging in the tracking they are designed to opt you out of in the first place.

17. Automated Decision-Making

We use automated systems (prompt classifiers, provider-side moderation, rate-limit heuristics) to detect and block harmful or Terms-violating content. These systems can block a generation or, in rare cases, suspend an account before human review.

You can request human review of any automated decision by emailing support@character.app. We review appeals within 48 hours and will overturn the decision if it was wrong.

18. Account Deletion

You can start account deletion from Account > Delete Account in the app. The service removes your sign-in account, eligible personal data, work that belongs only to you, subscription metadata, and push notification token records. If you own an active collaborative World, deletion pauses until it is archived or transferred. Shared artifacts that other members rely on can remain only with your identity removed after your personal data and face-source media are removed. We keep the minimum retention described in section 6 for tax, legal, and safety purposes.

If you cannot access the app to delete your account, email support@character.app from the address on file.

19. Changes and Contact

We may update this Privacy Policy from time to time. For material changes we will notify you in the app and by email before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

Questions, rights requests, or complaints:

• Email: support@character.app
• Mail: charactr, inc., 415 Mission Street, 37th Floor, San Francisco, CA 94105, United States
• EU / UK representative: charactr, inc. is a US-based company and does not currently have a designated representative in the EEA or UK. EEA and UK users may contact us directly at support@character.app regarding data protection matters. We will respond within 30 days as required by GDPR and UK GDPR.