Privacy Policy

Scope and who is responsible

This policy applies to Chara Social and the services that link to it. It does not govern websites, applications, or independent fediverse servers operated by other people.

Chara Social is responsible for the personal information described in this policy. Questions and privacy requests can be sent to the contact address at the end of this policy.

Information we collect

We collect information you provide, information created when you use the service, and limited information received from your device, other users, and federated servers.

• Account and profile information. This includes your email address, authentication and account identifiers, username, display name, profile details, preferences, profile images, and other information you choose to add.
• Content and activity. We process the characters, worlds, locations, lore, galleries, media, posts, replies, comments, reactions, follows, messages, reports, and other communications or interactions you create or submit, together with their visibility settings and timestamps.
• Trust and safety information. Creator-access requests include your creator statement, optional portfolio or social links, safety-pledge acceptance, confirmation that you meet the age requirement, and review status. We also process reports, moderation decisions, and related audit records. We collect an age confirmation, not your date of birth.
• Device, log, and diagnostics information. This can include IP address, user agent, request path and time, device or installation identifier, operating system, platform, app version, push-notification token, analytics events, performance data, and crash or error diagnostics.
• Federation information. When you use fediverse features, we may receive public profiles, posts, activities, server addresses, delivery information, and identifiers from other ActivityPub servers.

How we use information

We use personal information to:

• create and secure accounts; authenticate you; host, deliver, and display content; support community interactions, federation, realtime features, and account deletion;
• remember preferences, provide relevant feeds and navigation, and deliver notifications you request;
• review creator-access requests, moderate media and conduct, investigate reports, prevent abuse, enforce community rules, and protect users and the service;
• measure use, diagnose errors, maintain performance, and understand how to improve Chara Social;
• respond to support and privacy requests, comply with law, and establish or defend legal claims.

Where applicable law requires a legal basis, we rely on providing the service you request, our legitimate interests in operating and securing it, your consent where requested, and compliance with legal obligations.

Visibility, public content, and federation

Your visibility choices determine who can access content through Chara Social. Public content and profiles can be viewed by anyone and indexed by search engines. Community-limited content can be accessed by eligible signed-in users. Content with more limited settings is made available only through its intended service features and to authorized people.

People who can view content may still copy, screenshot, link to, or misuse it. We cannot guarantee that content already seen or copied by someone else will disappear when you change its visibility or delete it.

Federation is decentralized. If you choose to federate content or interact with another server, Chara Social sends the information needed for that interaction to independent servers. Those servers may store, display, or redistribute copies under their own policies. We send deletion activities where supported, but we cannot control or guarantee deletion by remote servers.

Chara Social does not train AI models on creator content and does not sell or license creator content for AI training. Public availability may still allow unrelated third parties to scrape or misuse public content beyond our control.

Analytics, logs, and storage on your device

Chara Social uses PostHog on the public website, in applications, and for server-side events to understand usage and diagnose problems. Depending on how you access the service, this may involve page or feature activity, browser or device information, identifiers, error details, and cookies or similar browser storage.

Our servers log requests, including IP address, user agent, path, status, and timing, for security, reliability, and troubleshooting. Browser settings may let you block or clear cookies and local storage, although doing so may not prevent server request logs and may affect service operation.

Our applications use secure device storage for authentication sessions and local or shared preferences for settings, notification state, and installation identifiers. You can remove this local data by signing out where supported, clearing app or browser data, or uninstalling the application.

How we disclose information

We disclose information only as needed to operate the service, honor your visibility and federation choices, or meet legal and safety obligations. Current service providers include:

• Supabase: account authentication, database, realtime, and related backend infrastructure;
• PostHog: product analytics, operational events, and error diagnostics;
• Google Firebase: push-notification delivery and device-token processing;
• Tencent Cloud: media storage, delivery, and automated image-moderation processing through Cloud Object Storage and related services;
• Other users, the public, and federated servers: according to the content visibility and federation actions you choose.

We may also disclose information when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or support a merger, financing, acquisition, reorganization, or transfer of the service, subject to appropriate protections.

We do not sell personal information. We do not sell or license creator content for AI training.

Retention and account deletion

We keep account data and content while your account is active and for as long as needed to provide the service. Security logs, analytics, trust and moderation records, and support records are kept only as long as reasonably needed for their operational, safety, dispute, or legal purpose.

When you request account deletion, we process and complete deletion of account data from active Chara Social systems within 30 days, unless limited information must be retained for security, fraud prevention, legal compliance, or the establishment or defense of claims. Residual copies may remain in backups until they are overwritten through the normal backup cycle.

Rejected uploaded media may be retained for moderation and becomes eligible for cleanup after 90 days. Aggregated or de-identified information may remain when it no longer identifies you. Copies held by other users, search engines, archives, or independent federated servers are outside our control.

Your choices and privacy rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing of your personal information, and to withdraw consent where processing is based on consent. You can also:

• edit profile and content information using available account controls, or delete your Chara Social account;
• choose visibility before publishing and change supported visibility settings later;
• manage push-notification permission in Chara Social and your device settings;
• contact us to make a privacy request or raise a concern about how information is handled.

We may need to verify your identity before completing a request. Some rights are subject to legal exceptions. If your local law permits it, you may also complain to your local data-protection authority.

Age requirement

Chara Social is intended for people who are at least 17 years old. Creator-access applicants must confirm that they meet this requirement. We do not ask for a date of birth as part of that confirmation.

If you believe a person under 17 has provided personal information to Chara Social, contact us so we can investigate and delete it as appropriate.

Security and international processing

We use technical and organizational safeguards designed to protect information, including authenticated access, access controls, secure session storage, moderation boundaries, and encrypted network connections where supported. No online service or storage system can guarantee absolute security.

Chara Social and its providers may process information in countries other than your own. Those countries may have different data-protection laws. Where required, we use protections appropriate to the information and applicable law.

Changes and contact

We may update this policy as Chara Social, its providers, or legal requirements change. We will publish the revised policy here, update its effective date, and provide additional notice when required.

For privacy questions, requests, or concerns, contact Chara Social at contact@chara.social.