Privacy policy

Last updated: October 18, 2026. Headcanon Maker is operated by wayperlee.

Your stories are private

Account email, password authentication records, private character profiles, and saved creations are stored in Headcanon Maker’s database. Passwords are hashed by Better Auth. Saved stories are available only to their owner through authenticated server routes and database policies. You can delete saved creations and profiles in your library.

Generation and service data

This browser tab temporarily keeps your draft and latest results so a refresh or sign-in does not lose your work. This tab storage is cleared on sign-out; drafts older than 24 hours are not restored. Signing in after choosing Save continues that private save.

Prompts and supplied character details are sent to Fal’s text generation service, using its OpenRouter integration to access the selected model. Do not submit sensitive personal data. Request records make input and result data recoverable for 24 hours. After expiry, access is blocked and a bounded cleanup removes content on subsequent generation requests. Minimal quota and cost records remain. We record tool usage, model, prompt version, tokens, latency, and estimated cost to monitor quality and prevent abuse.

A signed guest cookie supports daily quotas. An irreversible keyed network identifier supports abuse prevention; raw IP addresses are not saved in these quota records. Better Auth uses essential session cookies. First-party analytics honors the existing consent setting. When analytics is enabled, Pageview (self-hosted Plausible) receives sanitized pageviews; account pages and sensitive URL parameters are excluded. Character details, generated text, email addresses and verification codes are not included in these pageviews.

Account help and privacy requests

Production requires email verification and supports password recovery. Preview is a separate test environment and does not offer these email features. To request a copy or deletion of your account data, email support@headcanonmaker.com from your registered email address. Tell us whether you want data access or account deletion. We verify account ownership before disclosing or deleting data. Never send your password or verification codes. Deletion closes sign-in access, removes sessions, saved creations and character profiles, and anonymizes account contact details; pseudonymous account identifiers and minimal security, abuse-prevention and cost records may be retained, and backups expire on their normal cycle. We aim to acknowledge requests within two business days; this is not an automated deletion service.