Privacy Policy
This Privacy Policy explains what information ChibiArts collects, why we collect it, how long we keep it, who we share it with, and the controls you have - including the data we receive when you sign in with Google.
1. Who we are and what this policy covers
ChibiArts operates the AI chibi-art workspace at chibiarts.com, including the console and every generator inside it. This policy covers that service and explains what we collect, why we collect it, how long we keep it, who we share it with, and the controls you have.
It does not cover third-party sites we link to, or the AI providers described in section 9.
Data controller: the ChibiArts operator. Contact: support@chibiarts.com. Last updated: 1 October 2026.
2. Summary
The short version, in one table:
| What | Why we have it | Where it lives | How long |
|---|---|---|---|
| Google profile (name, email address, profile picture) | Create your ChibiArts account and show your name and avatar | In your browser only | Until you delete your account |
| Email address typed on the sign-in screen | Label your local account | In your browser only | Until you delete your account |
| Photos you upload and prompts you type | Produce the artwork you asked for | Sent to the AI provider for that request | Not kept on our servers |
| Generated artwork and video | Show your result and keep your gallery | In your browser, plus a temporary provider link cached on our server | Cache expires after 6 hours |
| Credits, notifications, preferences | Run the console | In your browser only | Until you delete your account |
| Server logs (IP address, request path, time) | Security and abuse prevention | Our server logs | Short-lived operational logs |
3. Information you give us
- The email address you type on the sign-in screen - used as your local account label. It is stored in your browser and is not sent to us.
- Photos you upload and text prompts you type - used only to produce the generation you asked for.
- Messages you send us - if you email support, we keep your message and our reply so we can help you and follow up.
4. Information we receive from Google Sign-In
Signing in is handled by Google Identity Services. We request only the basic profile scopes openid, email and profile.
From that we receive and use:
- your name;
- your email address;
- your profile picture URL.
The credential Google returns also carries a Google account identifier. We use it only to complete the sign-in and we do not store it.
We never receive your Google password. We cannot read your Gmail, Google Drive, Calendar, Contacts or any other Google product, because we do not request those scopes.
The access token and identity token are used only to complete sign-in and read the profile fields above. They are discarded immediately afterwards and are never written to storage.
5. How Google user data is used, kept and shared
Google user data (name, email address and profile picture) is used for exactly three things: to create your account, to label your gallery, and to show your name and avatar in the console. Nothing else.
It is not sold, not shared with advertisers, not used for advertising or retargeting, not used to build profiles, and not used to train machine-learning models. We do not transfer it to any other app.
It is stored in your own browser, and it is removed when you delete your account in the console (see section 15) or clear your browser data.
Limited Use disclosure. ChibiArts's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Information we collect automatically
Our server records standard access logs: IP address, the path requested, the time, the referring page and a user-agent string. We use these logs to keep the service running, to detect abuse and to debug faults.
We do not run third-party analytics, advertising or cross-site tracking scripts. There is no Google Analytics, no advertising pixel and no social plugin on this site. The only third-party script we load is Google's own sign-in library, and only on the sign-in screen.
7. How we use information
- to create and operate your account;
- to generate the images and videos you ask for;
- to show your gallery and, when you choose to, publish a work to the shared gallery;
- to grant and count the credits your plan includes;
- to keep the service secure and to prevent abuse;
- to answer your support questions;
- to meet our legal obligations.
We do not sell personal information, and we do not use your uploads or your results to train AI models.
8. Legal bases for processing (EEA and UK)
Where the GDPR applies we rely on: performance of a contract (generating the artwork you asked for and running your account); legitimate interests (security, abuse prevention, debugging and improving the service); consent (where you choose to sign in with Google, and where you publish a work publicly); and legal obligation (records we are required to keep). You can withdraw consent at any time by deleting your account or by revoking Google access.
9. Uploaded photos and AI processing
To create artwork we send your uploaded photo and/or your prompt through our own server-side proxy to a third-party AI model provider. Providers we currently use include Fal.ai, ByteDance Volcano Engine (Doubao / Seedance), Alibaba Cloud Model Studio and MiniMax. Which one handles a given request depends on the tool you use and on availability.
Our proxy does not write your uploaded photo to disk: the request is forwarded in memory and the photo is not retained by us once the request completes. Provider API keys are held server-side and never reach your browser.
Once a request reaches a provider, that provider's own privacy terms govern what it does with it. Please do not upload photos of other people unless you have their permission.
Prohibited uses. ChibiArts is a character-art tool. We do not use Google APIs — or any information received from them — to create, process or distribute AI-generated non-consensual intimate imagery (NCII), or for any other purpose prohibited by the Google APIs Terms of Service. Requests of that kind are refused. The full list of prohibited content is in section 6 of our Terms of Service.
10. Cookies and local storage
We do not set any cookies of our own, and we use no advertising or analytics cookies.
Instead we use your browser's local storage (keys prefixed chibi.) to remember your account, your gallery, your credit balance, your notifications and a short-lived list of pending results. This data stays on your device except as described above, and the delete button in section 15 removes it.
Google's sign-in library may set its own cookies on Google's domains while you sign in. Those cookies belong to Google and are governed by Google's Privacy Policy, not by this one.
11. How long we keep information
Because the console keeps your account in your own browser, most retention is under your control. The table below states each period honestly.
| Data | Retention |
|---|---|
| Account, gallery, credits, notifications (in your browser) | Until you delete your account or clear your browser data |
| Photos you upload | Not stored on our servers; discarded when the request completes |
| Generated-result cache on our server (provider link plus a one-way request fingerprint) | Up to 6 hours, then deleted automatically. The fingerprint cannot be reversed back into your photo |
| Server access logs | A short operational window for security, then rotated out |
| Support email | Until your question is resolved, plus any period the law requires |
12. When we share information
We share personal data only in these situations:
- AI providers - the photo and/or prompt needed to produce the result you asked for (section 9).
- Our hosting provider - runs the server that serves this site and proxies generation requests.
- Legal requirements - where we are legally required to disclose information, or where it is needed to protect the rights and safety of users.
We do not sell your personal information, and we do not share it with advertising networks or data brokers.
13. International transfers
Our infrastructure and the AI providers we use may process data in countries other than yours, including the United States and Singapore. Where personal data leaves the EEA or the UK we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
14. Your rights
Depending on where you live you may have the right to access, correct, export, delete or restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. If you are in California you also have the right not to be discriminated against for exercising these rights.
Because the console stores your account in your browser, you can exercise most of these rights instantly yourself. For anything else, email support@chibiarts.com from the address on your account and we will respond within 30 days.
15. Deleting your account and data
There are three ways to delete:
- In the console - open Account and data and use Delete account and all data. It removes your account, gallery, credits and notifications from this device immediately, and cannot be undone.
- By email - write to support@chibiarts.com from the address on your account and ask us to delete your data. We will action it within 30 days.
- Revoke Google access - at myaccount.google.com/permissions, so ChibiArts can no longer read your basic profile.
Generated images already cached by an AI provider expire on that provider's own schedule, typically within 24 hours.
16. Security
The site is served over HTTPS. Google tokens are used once and discarded rather than stored. AI provider keys live on the server and are never sent to your browser. Uploaded files are proxied in memory rather than written to disk.
No online service can promise absolute security, and you should not upload material you would not want processed by a third-party AI provider.
17. Children
ChibiArts is not directed at children. You must be at least 18 years old to create an account, and we do not knowingly collect personal information from children under 13 (or under 16 in the EEA). If you believe a child has given us their data, email us and we will delete it.
18. Changes to this policy
We may update this policy as the service changes. The last-updated date in section 1 always shows the current version, and material changes will be announced in the console. Continued use after an update means you accept the revised policy.
19. Contact
Privacy questions, data requests and complaints: support@chibiarts.com. If you are in the EEA or the UK you also have the right to complain to your national data protection authority.