Privacy Policy 🔒
How Character Tavern collects, uses, and protects your data, under the GDPR. No lawyer wrote this. It's the actual policy, in plain language, and it's the only version there is.
Last updated: September 7, 2026
The whole policy in three lines
- 🛡️We follow EU data protection law (GDPR).
- 🚫Your data is never sold. To anyone. Ever.
- 🎛️You can access, correct, or delete your data anytime.
🗃️1. What We Collect
Account basics. Your email address, username, and password (encrypted, we couldn't read it if we wanted to).
What you create. Text prompts, character definitions, chats, and images you upload or generate.
Technical data. IP address (anonymized where possible), browser type, and device information, collected via Cloudflare.
Aggregate page views. We use Cloudflare Web Analytics to see which pages are visited and how the site performs. It sets no cookies, stores nothing in your browser, does not fingerprint your device, and never follows you across sites. We only ever see anonymous totals, never who you are.
Cookies & local storage. A session token to keep you logged in, and local settings like your theme preference. That's the full list.
⚙️2. What It's Used For
Running the service (contractual necessity). Creating your account, keeping your library and chats in order, and generating AI responses.
Safety & moderation (legitimate interest). Detecting content policy violations and enforcing platform eligibility. Moderation filters run through the same AI provider used for chat, or on our own servers. Your messages are never sent to a separate third-party moderation service, so the same privacy controls and training restrictions that protect your chats also apply to moderation.
Legal compliance (legal obligation). Complying with applicable EU law when we genuinely have to.
Understanding site usage (legitimate interest). Counting page views and load times in aggregate through Cloudflare Web Analytics so we know what's working and what's broken. Nothing in it identifies you or builds a profile.
And that's it. No tracking, no ad profiles, no engagement tricks.
🤖3. AI & Your Chats
In CT Direct mode (the default), your chat inputs are sent to our AI routing provider, OpenRouter, which forwards them to the selected model provider. We configure OpenRouter to only use providers that do not train on your prompts or chats, based on OpenRouter's provider privacy controls and the providers' stated policies.
If you link a Kyara Intelligence (KAI) key in your account settings, chats with eligible models go to Kyara Intelligence instead, using your own key. Same rule there: no training on your prompts or chats.
The fine print, kept short
- Staff access: we don't read private chats. Access is restricted to authorized personnel, and only for support you asked for, abuse or safety investigations, security incidents, legal compliance, or troubleshooting.
- Data transfer: requests routed through OpenRouter may be processed in the US, under safeguards such as SCCs or the Data Privacy Framework where applicable.
- Moderation: content filters run through the same providers or our own infrastructure, never a separate third-party moderation service.
⏳4. How Long We Keep It
Active account: as long as your account exists, so does your data. That's the deal.
Deleted account: erased within 30 days, except the rare bits the law requires us to keep.
🤝5. Who Touches Your Data
Running a platform solo means relying on a few good services. Here's the complete list of companies that process data on our behalf, and what each one does:
Hetzner
EUHosting & database
OpenRouter
USA (Global)AI text generation (CT Direct mode)
Kyara Intelligence
EUAI text generation, with your linked key
Cloudflare
GlobalSecurity, CDN & privacy-first web analytics
BunnyCDN
EU (Global)Image storage & delivery
Resend
USATransactional emails
That's everyone. If a company isn't on this list, it doesn't see your data.
🍪6. Cookies
One session cookie to keep you logged in. That's the entire cookie section. Our analytics (Cloudflare Web Analytics) is cookieless and doesn't touch local storage, so there are no trackers either, which is also why there's no cookie banner: the law only requires one when a site does things we simply don't do.
⚖️7. Your Rights
Under the GDPR, your data is yours. Concretely:
👀Access
Get a copy of everything we hold about you.
✏️Rectify
Correct anything that's wrong.
🗑️Delete
The right to be forgotten. Delete your account and everything that goes with it.
✋Withdraw consent
Change your mind at any time about anything you agreed to.
To exercise any of these, email [email protected]. A person reads it and handles it. You also have the right to complain to your data protection authority.
🔞8. Adults Only
Character Tavern is restricted to users aged 18 and older. We don't knowingly collect data from anyone under 18, and if we find out we have, it gets deleted immediately.
📬9. Questions?
For anything privacy-related, contact our Data Protection Officer at [email protected].