YOUR EMAIL.
YOUR CONTROL.

Operator and contact

RuneCodex AI operates this account pilot. Questions and personal-data requests can be sent to privacy@auth.runecodex.com.

What we process

We receive your email address, an authentication user identifier, email-verification and session information, and limited technical information needed for security, delivery, and abuse prevention (which may include IP addresses and request logs). We also store the character descriptions, creative notes, preferences and reference images you choose to save, with file metadata, model-access registration, rights declarations and request history.

Why and how

We use this information to create and maintain the account you request, verify access, and safeguard the service. The legal bases are steps at your request before a service contract and legitimate interests in operating a secure service. Signing up does not subscribe you to promotional email.

Service providers and international transfers

Supabase provides identity and session infrastructure for our separate Character Lab project in London (eu-west-2). Transactional authentication emails use Resend, configured in its US East region. Private references, generated outputs and thumbnails are stored in a dedicated encrypted Backblaze B2 bucket in its US East region. When you request generation, Runware receives the prompt, character instructions and selected reference image to create your output. We request short-lived provider result links and save validated results privately. These providers may process information under their own processing and transfer arrangements.

Retention and your choices

Account information remains while the account is active, subject to deletion requests, security requirements and necessary backup/log retention. You can remove reference images and their stored versions, cancel and remove preparation requests, and delete empty projects in your workspace. Interrupted image removals remain pending until retried. Model-access email notices are optional, and you can leave the access list. Email privacy@auth.runecodex.com to request access, correction or erasure, or to exercise other applicable privacy rights. You may also complain to your relevant data protection regulator.

Browser storage

Signing in stores an authentication session in your browser so it can persist across visits. Signing out clears the local session. Essential security storage does not track advertising preferences.

References and saved outputs are private to your account and accessible through short-lived links. Preparing a custom model request does not start training or send a dataset to RunPod. Generation requests use Runware; provider usage records may be retained for security and accounting even when you remove project history. No customer payment is collected. Approved synthetic accounts can use Stripe sandbox checkout, billing and invoices. Billing records are kept separately from creative projects; deleting a project does not remove financial history. Payment details are entered directly on Stripe’s hosted pages.