Privacy Policy

Depending on how you use the Service, we collect or process the following categories:

• Discord account data: Discord user ID, username, display name, avatar, email address, OAuth authorization information, server membership, and relevant role/access status.
• Profile data: display name, profile image and banner, biography, location, website, visual preferences, language, public/private status, moderation locks, badges, and timestamps.
• User Content: character-card names and descriptions, tags, category, opening message, images, JSON files, lorebooks, articles, file metadata, ownership identifiers, and publication timestamps.
• Activity data: unique download records, download totals, recommendation signals, ranking activity, search requests sent to our search service, and interactions needed to provide requested features.
• Technical data: session and security records, request logs, error logs, IP address, browser or device information, and similar data that may be processed automatically by the Service or its hosting providers.
• Device preferences: theme, layout, language, NSFW blur choice, saved tags, dismissed announcements, and certain profile-editing values stored locally in your browser.

We receive information directly from you when you edit a profile, upload a character card, publish an article, search, download, or contact moderators. We receive Discord account and membership information when you authorize sign-in and when the Service checks server roles. We also create records from your use of the Service, such as a unique download record or an upload timestamp.

Discord OAuth scopes used by the Service may include identify, email, guilds, and guilds.members.read. These allow the Service to identify you, obtain the email supplied by Discord, determine server membership, and check member information needed for access control.

• authenticate you, maintain sessions, and protect accounts;
• verify SFW or NSFW access using Discord server membership and roles;
• publish and manage profiles, character cards, lorebooks, images, articles, and creator attribution;
• deliver files and count a download once per signed-in user;
• provide search, feeds, recommendations, hidden-gem discovery, and time-based rankings;
• apply profile visibility choices and moderator-enforced visibility locks;
• detect abuse, enforce the Terms of Service, investigate reports, and keep the Service secure;
• debug, maintain, measure, and improve reliability and performance; and
• comply with legal obligations and respond to valid legal requests.

Where data protection law requires a legal basis, we rely as applicable on performing our agreement with you, our legitimate interests in operating and securing the Service, consent, and compliance with legal obligations.

Public profiles and published User Content can be viewed, copied, linked, indexed, or downloaded by others. Character-card pages may display the creator’s name, avatar, description, tags, category, opening message, file information, download count, and upload date.

A private account hides its profile and character cards from other users in website listings, search, feeds, rankings, previews, and direct card pages. Owners and authorized moderators retain access to cards. This does not erase copies already downloaded or revoke previously shared public storage URLs. Moderators may hide or lock a profile for safety or enforcement reasons.

We do not sell personal information. We may disclose information in these limited situations:

• Public and community sharing: information and content you choose to publish is shown to visitors and signed-in users according to visibility and access settings.
• Service providers: MongoDB supports database storage; Cloudflare R2 stores and serves uploaded files; Upstash Redis supports caching; and hosting, network, or security providers process requests needed to run the Service.
• Discord: Discord processes sign-in and provides account, membership, and role information under Discord’s own terms and privacy policy.
• Safety and legal reasons: information may be disclosed when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or enforce our terms.
• Organizational change: information may be transferred as part of a merger, acquisition, restructuring, or transfer of the Service, subject to appropriate notice and safeguards.

The Service uses essential session cookies or similar technology to keep you signed in, protect requests, and remember authentication state. These are necessary for account features to work.

Browser local storage remembers choices such as Simple UI, theme, language, NSFW blur, saved tags, dismissed notices, and some profile form values. You can clear these through your browser, although doing so resets those choices. We do not currently describe any advertising or cross-site tracking cookies because the Service does not intentionally use them.

We keep account and profile information while it is needed to provide the Service or until a valid deletion request is completed. Published uploads and articles remain until deleted by the creator where supported, removed by moderators, or no longer needed. Unique download records may be retained to preserve counts, rankings, recommendation quality, and abuse prevention.

Authentication sessions are configured to expire after a period of inactivity. Caches are temporary and may expire or be invalidated. Logs, deleted records, and files may remain for a limited period in backups, security records, or provider systems. We may retain information longer when required for legal compliance, dispute resolution, safety, or enforcement.

We use reasonable technical and organizational measures intended to protect information, including authenticated access, role checks, restricted moderation routes, signed sessions, and access controls for storage providers. No internet service or storage system is completely secure, and we cannot guarantee that information will never be lost, misused, or accessed without authorization.

Never send passwords, bot tokens, API keys, or other secrets in profile fields, character descriptions, articles, or public support channels. Report suspected account or security issues promptly.

The Service and its providers may process information in countries other than your own. Those countries may have different data protection laws. Where required, we use available contractual, technical, or legal safeguards for international transfers.

Depending on where you live, you may have rights to:

• access or receive a copy of personal information about you;
• correct inaccurate or incomplete information;
• delete information or ask us to restrict its use;
• object to certain processing or withdraw consent where processing is based on consent;
• receive portable data where applicable; and
• complain to a data protection authority, including Thailand’s Personal Data Protection Committee where applicable.

You can edit many profile fields and choose public or private profile visibility in Settings, unless a moderator has locked that setting. We may need to verify your identity through the connected Discord account before completing a request. Some rights are subject to legal exceptions, and deleting public content cannot recall copies already obtained by others.

You must meet Discord’s minimum age and the minimum age required by local law to use the Service. NSFW content is restricted to users who are at least 18 and hold the required Discord role. The Service uses role status as an access-control signal; it does not independently verify identity documents or guarantee a person’s age.

Do not submit personal data about children or any content that sexualizes minors. Report suspected violations immediately.

We may update this policy when features, providers, or laws change. The date at the top identifies the latest version. If a change materially affects how personal information is used, we may provide a more prominent notice through the Service or community before or when the change takes effect.