We respect your privacy and your rights over personal data. This policy explains what we collect, why we use it, where it may be processed, and the choices available to you.
What we collect
- Account details
- Your username, email address, a cryptographic hash of your password, and your profile settings.
- Content you create
- Characters, worlds, images, and the posts and other community interactions you start.
- Technical data
- Network address (IP), browser and device information, request identifiers, and system logs used for security and diagnostics.
- Purchase records
- Membership status, transaction references, and fulfillment records. CharHaven does not store full payment-card numbers.
How we use it
- Running the service
- To store and display your content on CharHaven.
- Messages to you
- To send important account notices, security warnings, and billing messages.
- Security
- To detect unusual activity, stop abuse, and prevent unauthorized access to data.
- Improvement
- To troubleshoot bugs, analyze feature usage in aggregate, prioritize roadmap work, and measure the performance of platform systems.
Your choices
Depending on applicable law and the request, you may:
- Correct your data
- Update your profile and account details at any time from Edit Profile.
- Get a copy of your data
- Request a full copy of the data held about your account by emailing admin@charhaven.com.
- Delete your data
- Delete your account to remove your content from active public access, subject to limited backup, security, dispute, and legal retention described below.
Security
CharHaven uses administrative, technical, and organizational safeguards designed to reduce the risk of unauthorized access, disclosure, misuse, or loss of personal information. No internet service can be guaranteed perfectly secure, but we work to limit access, log important security events, and respond to credible threats. We do not sell your personal data to third parties for monetary consideration.
Age requirements and youth privacy
CharHaven is restricted to adults and does not knowingly collect personal information from anyone under 18.
- Users must be at least 18 years of age to register an account.
- Registration uses a birthdate-based age-eligibility check. This is not government-ID verification. Accounts found to belong to users under 18 will be disabled and handled under our safety and legal obligations.
- We do not serve targeted advertising to users under 18.
- If you are a parent or guardian and believe your child under 18 has created an account, please contact us immediately at admin@charhaven.com. We will disable the account promptly and delete or retain associated data only as required for safety, evidence preservation, and applicable law.
Content safety and mature content
CharHaven features user-generated content that may include mature themes. We implement the following safeguards:
- All mature content is hidden by default behind age-verification gates and content filters.
- Users must be 18+ and explicitly consent before they can view mature-tagged content.
- Consent records (including timestamp, IP address, and user agent) are stored for legal compliance.
- For the full content policy, refer to our Community Guidelines and Terms of Service.
Cookies and similar technologies
CharHaven uses the following types of cookies and tracking technologies:
- Session cookies
- Essential cookies for authentication, CSRF protection, and user session management. These are required for the platform to function.
- Preference cookies
- Used for browser preferences such as theme selection. Mature-content consent also depends on your signed-in account settings.
- Character worksheet copies
- Save on this device explicitly stores a worksheet in this browser with a seven-day validity period. Continue with my sheet keeps a copy in the same tab valid for 30 minutes through sign-in. Expired copies are ignored and cleared when the tool checks storage. These copies are not account backups or automatic saves. Remove saved copy clears both stored copies; browser data controls can also remove them. Account deletion does not clear copies stored on your device.
- Analytics
- We may use analytics tools for aggregate usage statistics such as page views, session patterns, and feature adoption. Browser privacy controls may limit some analytics behavior, but essential service and security logging may still occur.
- Security cookies
- Age verification block cookie and reCAPTCHA tokens for bot prevention. These are essential for platform safety.
Third-party services and data sharing
We share data with the following categories of third-party service providers as necessary to operate the platform:
- Payment Processors: Ko-fi and payment providers used by its checkout flow. We do not store full payment-card details on CharHaven servers.
- Authentication Providers: Google & Discord — for optional OAuth sign-in. Depending on the provider and permissions granted, CharHaven may receive a provider identifier, email address, display name, avatar URL, and verification status.
- Email Delivery: Resend and the configured SMTP infrastructure process recipient addresses and message content for transactional email.
- Hosting, DNS & Security: The VPS provider and Cloudflare process network, DNS, and security metadata needed to deliver and protect the service.
- Real-Time Messaging: CharHaven's self-hosted Soketi service processes connection identifiers and message payloads needed for live features.
- Bot Protection: Google reCAPTCHA — for preventing automated abuse. Subject to Google's privacy policy.
- Media Services: Tenor — for GIF search. Search terms and technical request data needed to deliver results may be sent to the service.
We do not sell, rent, or trade your personal data to advertisers, data brokers, or any third party for marketing purposes.
Data retention
- Account and content data
- Retained while the account is active and then deleted or de-identified through the account-deletion process, subject to backups, disputes, and legal obligations.
- Web-server logs
- Normally rotate daily with up to 14 rotations; incident evidence may be preserved longer when reasonably required for security, abuse investigation, or legal claims.
- Database backups
- The configured retention is normally 7 days for daily database archives and 14 days for database change logs intended to assist point-in-time recovery. Encrypted offsite backups of the database and uploaded media are configured for disaster recovery with rolling retention. These schedules do not guarantee that every run completes or that a full restore has been verified. An isolated archive may be retained longer only for a documented recovery, security, dispute, or legal purpose.
- Transaction records
- Retained for the period required by applicable tax, accounting, fraud-prevention, and payment rules.
- Moderation records
- Retained for as long as reasonably needed to enforce safety rules, address repeat abuse, and resolve legal claims.
Breach notification
If we determine that a security incident has affected your personal information and notification is required by applicable law, we will notify affected users and regulators within the legally required timeframe, including the 3×24-hour period required by Indonesia's Personal Data Protection Law where it applies. The notice may describe the nature of the incident, the information involved, and recommended protective steps where available.
International users and data transfers
CharHaven may store and process data in countries other than the one in which you live. When cross-border transfers occur, we use reasonable operational, contractual, or technical safeguards appropriate to the service and the nature of the data involved.
Access, deletion, and verification requests
If you submit a privacy request, we may ask you to verify ownership of the account or otherwise confirm your identity before disclosing, exporting, correcting, or deleting personal information. We may deny or limit a request where the law permits, including where we need to retain data for fraud prevention, moderation records, tax obligations, security logs, or unresolved disputes.
Rights in the European Economic Area (EEA) and UK (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):
- Right of access (Art. 15): Request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
- Right to erasure (Art. 17): Request deletion of your personal data, subject to legal exceptions (fraud prevention, moderation records, legal obligations).
- Right to data portability (Art. 20): Request your data in a structured, commonly used, machine-readable format (JSON export).
- Right to restrict processing (Art. 18): Request that we limit how we use your data under certain circumstances.
- Right to object (Art. 21): Object to processing based on legitimate interests, including direct marketing.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Legal basis for processing: We process your personal data on the following legal bases as applicable: consent, performance of a contract, legitimate interests such as security and service improvement, and legal obligations such as financial record-keeping. To exercise a privacy right, contact admin@charhaven.com. We will respond within the period required by applicable law and will explain any permitted extension or limitation. You may also have the right to complain to your local supervisory authority.
California privacy rights (CCPA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
- Right to know: Request the categories and specific pieces of personal data we have collected about you.
- Right to delete: Request deletion of your personal data, subject to legal exceptions.
- Right to opt out: CharHaven does not currently sell personal information. If covered practices change, we will provide any opt-out mechanism required by applicable law.
- Non-discrimination: We will not discriminate against you for exercising your CCPA rights.
To exercise any of these rights, contact us at admin@charhaven.com. We will verify your identity before processing requests.
Privacy questions or data requests can be submitted through Contact Support or by email to admin@charhaven.com.
