Legal · Public

Privacy Policy

Last updated: August 9, 2026 · Service: Character Toolkit · Site: localhost:3000

This Privacy Policy explains what information Character Toolkit collects, how we use it, and your choices. It applies to the website and related APIs at the address above. It is intended for users and for OAuth providers (Google, Discord) that require a public privacy policy URL.

1. Who we are

Character Toolkit ("we," "us") operates a character-creation toolkit for adult roleplay creators. The Service is for users 18+ only.

2. Information we collect

2.1 Account and authentication

OAuth profile data from Discord and/or Google when you sign in: provider user id, display name, email address (if the provider shares it), and profile image URL.
Linked accounts: if you connect both Discord and Google from your profile, we store both provider links on your account.
Age verification: date of birth and timestamps for age verification and Terms acceptance. We use this to enforce the 18+ requirement — not for marketing.

2.2 Content you create

Character drafts and profiles (identity fields, personality text, lists such as likes/kinks, and related metadata such as draft status and last updated time).
Optional future content (HTML cards, exports, AI prompts/results, uploaded images) when those features are enabled.

2.3 Technical and session data

Session cookies used by our authentication library to keep you signed in.
Server logs (IP address, user agent, request path, timestamps) for security, abuse prevention, and debugging.
Optional cache/session data in Redis (for example session or rate-limit keys) with short retention.

2.4 What we do not collect (currently)

We do not sell personal data.
We do not use third-party advertising or tracking pixels on the Service.
We do not require a separate password; sign-in is via OAuth providers you already use.

3. How we use information

Authenticate you and maintain your account.
Enforce age eligibility and acceptable-use rules.
Provide character design, storage, export, and related product features.
Improve reliability and security (logs, error diagnosis, abuse detection).
Comply with law and respond to valid legal requests where required.
When AI features are enabled, send the minimum content needed to fulfill your request to the AI provider you trigger (see Section 5).

4. Legal bases (where applicable)

Depending on your location, we process data to perform the contract (providing the Service you request), based on legitimate interests (security, fraud prevention, product improvement), and/or with your consent (for example age verification and optional linked providers).

5. Third-party services

We share data with processors only as needed to run the Service:

Discord — authentication (and, later, optional bot features). Their privacy policy applies to data Discord holds: discord.com/privacy.
Google — authentication when you use Google sign-in or link Google. Policy: policies.google.com/privacy.
Hosting / database / cache — infrastructure that stores application data (for example server host, PostgreSQL, Redis) under our control or our hosting provider's data processing terms.
AI / compute providers (when enabled) — process prompts and generation jobs you initiate. We do not send your OAuth tokens to those providers.

We do not sell or rent your personal information to third parties for their marketing.

6. Cookies and similar technologies

Session / auth cookies — required to keep you logged in after OAuth. These are first-party and essential to the Service.
We do not use advertising cookies or cross-site tracking cookies.

7. Data retention

Account and character data are kept while your account is active.
After account deletion (when self-serve deletion ships, or upon operator-assisted request), we delete or anonymize personal data within a reasonable period, except where we must retain records for legal, security, or abuse-prevention reasons.
Server logs are retained for a limited operational period, then rotated or deleted.

8. Security

We use reasonable technical and organizational measures (HTTPS, isolated application database, access controls, HTML sanitization for untrusted imports when that feature is enabled). No method of transmission or storage is 100% secure.

9. Children

The Service is for adults only (18+). We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us; we will terminate the account and delete associated data as appropriate.

10. Your rights and choices

Access / correction: profile and character data are available in your account; you can update character content anytime.
Linked providers: you may link Discord or Google from your Profile page so either method can sign you in.
Deletion: request account and data deletion by contacting the operator (Section 13). We will process requests subject to legal retention needs.
OAuth revocation: you can disconnect our app from your Discord or Google account settings; that may prevent sign-in until you reconnect.
Depending on your region (for example GDPR/CCPA), you may have additional rights to access, portability, restriction, or objection. Contact us to exercise them.

11. International transfers

The Service is hosted on infrastructure that may be located in the European Union or other regions. If you access the Service from another country, your information may be processed where our servers and providers operate.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date will change when we do. Material changes will be reflected on this page. Continued use of the Service after an update constitutes acceptance of the revised policy where permitted by law.

13. Contact

Privacy questions, deletion requests, or data rights requests: contact the site operator for Character Toolkit via the support channels published on the Service or the operator's public contact associated with the domain localhost:3000.

Related: Terms of Service.