Privacy Policy

Last updated: October 9, 2026

Orichar is an AI character creation service operated by Motang LLC. This policy explains how we handle information when you use orichar.my. For privacy questions or requests, contact support@orichar.my.

Information we collect

• Account information: your name, email address, profile image, language preference, verification status, and account settings. If you use a password, we store a password hash rather than the readable password. Authentication records can include session identifiers, IP addresses, browser information, and sign-in provider identifiers and tokens.
• Google sign-in information: when you choose Google sign-in, we receive your Google account identifier, name, email address, email verification status, and profile image to create and authenticate your Orichar account. We request basic profile and email permissions; we do not request access to Gmail, Google Drive, or your contacts.
• Creation content: prompts, reference images you upload, generated images, generation settings, creation history, and technical records such as request identifiers, errors, usage, and credit charges.
• Purchase information: payment and checkout identifiers, amounts, currency, payment and refund status, and your credit balance and transaction history. Stripe handles checkout and payment details. Orichar does not receive or store your full card number or card security code.
• Service information: technical logs and information needed to operate the site, investigate failures, prevent misuse, and respond to support requests.

How we use information

We use this information to authenticate accounts, generate and store images, show your private creation history, process purchases and credits, send account and security emails, provide support, and maintain the reliability and security of the service. We may also use relevant records to address fraud, disputes, and legal obligations.

Google account information is used for account access and associated account functionality. We do not sell Google user data or use it for personalized advertising. We do not use Google account information to train AI models. Prompts and reference images are sent separately to image generation providers when you request a generation.

Service providers and disclosures

We use providers to operate Orichar, including Vercel for hosting, Neon for the database, Cloudflare R2 for file storage, Resend for account emails, Stripe for payments, and Google for optional sign-in. Messages sent to our support address are forwarded through Cloudflare Email Routing to our support inbox hosted by Google; these providers process the message and its attachments to deliver and store your correspondence.

Image generation requests are processed through OpenRouter and the selected model provider, currently OpenAI. Your prompt, reference image if supplied, and generation parameters are sent to these providers to produce the requested image. Their processing, safety review, and retention practices are also governed by their own policies and our service configuration. We do not promise that providers retain no data or that every request is excluded from their model improvement processes. Do not include confidential information or another person's personal information unless you are authorized to share it for this purpose.

Your creations are private by default; the service does not automatically publish them to a public gallery. Authorized administrators may access relevant account, creation, and transaction records to investigate support, safety, billing, or service problems. Private files are accessed through temporary signed links; anyone you share a valid link with may access that file until the link expires.

We may disclose information when necessary to meet legal requirements, protect users and the service, or handle a business transfer, subject to applicable safeguards. We do not sell personal information.

Cookies and local storage

We use cookies for authentication and language preferences, and browser storage for interface preferences and creation drafts. Draft text and selected settings can remain in that browser until replaced or cleared. You can clear browser storage through your browser settings; doing so can sign you out and remove local drafts. The current service does not enable advertising cookies or third-party marketing analytics.

Retention and deletion

Account and creation records remain available while needed to provide the service, unless you delete them or your account. Temporary reference uploads under our temporary upload prefix are configured for deletion after one day. A reference image attached to a generation has a separate history copy, which remains with that generation until it is deleted.

You can delete creations from your account and request account deletion in account settings. Deletion removes access to the affected creations and triggers file cleanup. Cleanup can be retried if a storage service is unavailable. Account deletion may be delayed while generation tasks or related credit checks are still in progress. Previously issued signed links can remain usable until they expire.

Service providers may retain backups, security logs, or payment records under their own retention requirements. Removing your Orichar account does not necessarily delete records that Stripe or other providers must retain independently. We may retain information where required for legal, security, fraud prevention, or dispute purposes.

Your choices and requests

You can update account information, manage available security settings, delete creations, and request account deletion through the service. You can also revoke Orichar's access in your Google account settings; this does not by itself delete your Orichar account or its existing records.

Depending on your location, you may have rights to access, correct, delete, obtain a copy of, or restrict certain uses of your personal information, or to object to processing. Send requests to support@orichar.my. We may need to verify your identity before acting on a request.

International processing and security

Our providers may process information outside your country, including in the United States. We use HTTPS, access controls, and private file storage to protect information, but no online service can guarantee absolute security.

Changes to this policy

We may update this policy as the service changes. The date above identifies the latest version. Where required, we will provide additional notice of material changes.