Legal

Privacy Policy

◆ Last updated: June 11, 2026
Contents
01
Introduction

This Privacy Policy explains how Charstory ("we," "our," or "us") collects, uses, discloses, and protects your information when you use our application ("Lore Chat"), website, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

02
Information We Collect
Information You Provide Directly
  • Account Information: When you register, we collect your email address and authentication credentials via Supabase Auth.
  • Profile Information: You may provide a display name, avatar image, and persona descriptions for characters you create or interact with.
  • Communications: If you contact us for support, we collect the contents of your messages and any attachments you provide.
Information Collected Automatically
  • Usage Data: We collect information about how you interact with the Service, including features used, session duration, and page views.
  • Device Information: We may collect browser type, operating system, device type, and IP address.
  • Cookies and Similar Technologies: We use essential cookies for authentication and session management. Analytics cookies may be used to improve the Service.
Information You Create

Chat Content: All conversation messages, character definitions, lore entries, and persona data you create are encrypted client-side using AES-GCM encryption before being stored. Your chat content is private and end-to-end encrypted — we cannot read it.

  • Compressed Story State: Automatically generated story summaries and lore state used to maintain conversation quality across long sessions.
03
How We Use Your Information

We use the collected information to:

  • Provide, maintain, and improve the Service
  • Process authentication and manage your account
  • Send service-related communications (e.g., security notices)
  • Aggregate anonymized data for statistical analysis and marketing promotion (see Section 7)
  • Detect, prevent, and address technical issues or abuse
  • Comply with legal obligations
04
Data Storage and Security
Encryption

All user-generated content is encrypted client-side using AES-GCM with 256-bit keys before transmission. Your encryption key is derived from your authentication credentials and is never transmitted to our servers in plaintext.

  • We cannot read your chat content, character definitions, or lore entries.
  • Only you (and those you explicitly authorize) can decrypt your data.
  • Certain indexed fields (IDs, names, timestamps) remain plaintext to enable database queries.
Data Locations
  • Authentication data is processed through Supabase.
  • Encrypted user content is stored locally in your browser's IndexedDB. No server-side copy of your content exists by default.
Secure Backup (Opt-In)

Charstory offers an optional Secure Backup feature. When you choose to enable it:

  • An encrypted copy of your characters, personas, and chat history is stored on our servers using AES-GCM encryption.
  • The backup is encrypted with a recovery key that is generated on your device and never transmitted to our servers in any form. We cannot decrypt your backup under any circumstances.
  • Your recovery key is a 12-word mnemonic phrase shown to you once at setup. You are solely responsible for saving it. We cannot recover it if you lose it, and without it, your backup is permanently unrecoverable.
  • The recovery key is independent of your account password. Changing or resetting your password does not affect your backup or your ability to restore it.
  • You can disable Secure Backup at any time from Settings, which deletes the server-side copy and clears your locally cached key.
  • If you never enable Secure Backup, no server-side copy of your content is ever created.
Security Measures

We implement commercially reasonable technical and organizational measures to protect your data, including encryption at rest and in transit (TLS 1.3), access controls, and regular security reviews.

05
Data Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

  • Service Providers: With trusted third-party service providers who assist in operating the Service (Supabase for auth and Cloudflare for infrastructure). These providers are contractually bound to protect your data.
  • Legal Requirements: If required by law, regulation, or legal process, or to protect our rights, property, or safety.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.
  • With Your Consent: With your explicit consent or at your direction.
06
Data Retention and Deletion
  • Account Data: We retain your account information until you delete your account.
  • Chat and Content Data: Encrypted content is retained for as long as your account is active. You may delete individual conversations, characters, or your entire account at any time.
  • Usage Analytics: Aggregated, anonymized data may be retained indefinitely for analytical purposes.
  • Backup Retention: Deleted data may persist in encrypted backups for up to 30 days before being purged.
07
Aggregated Anonymous Data for Marketing

We may aggregate anonymized, de-identified usage statistics for the purpose of marketing promotion and statistical analysis. This includes:

  • Total number of active users
  • Aggregate message counts and conversation volumes
  • Feature adoption rates and usage patterns
  • Performance metrics and platform trends

All aggregated data is stripped of any personally identifiable information before use. This anonymized data may be shared publicly or with partners for promotional purposes.

08
Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate data.
  • Deletion: Request deletion of your personal data (subject to legal retention obligations).
  • Portability: Request transfer of your data in a machine-readable format.
  • Objection: Object to the processing of your data for specific purposes.
  • Withdraw Consent: Withdraw consent where processing is based on consent.

To exercise these rights use the account settings within the Service.

09
Children's Privacy

The Service is not intended for individuals under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete it.

10
Third-Party Services
  • Supabase: Authentication and database services. supabase.com/privacy
  • Cloudflare: Infrastructure and edge services. cloudflare.com/privacypolicy
  • AI Model Providers: When you use AI chat features, message data may be sent to third-party AI inference providers based on your configured API endpoint. We are not responsible for the privacy practices of those providers.
11
Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.