Privacy Policy

1. Operator and scope

This policy covers the Mutanai website, editor, accounts, credit purchases and subscriptions. The operator is responsible for information processed by our application. Payment providers also have responsibilities for information collected in their own checkout.

Policy version: 2026-10-04-v1

• Service: Mutanai
• data controller: CHEN WEIWEI
• Operator type: Individual developer
• Operator country or jurisdiction: China
• Support, billing and privacy contact: support@mutanai.com

Read our Terms of Service for purchasing rules. Accepting those terms does not provide blanket consent to optional tracking or marketing.

2. Information processed by the application

• Accounts: name, email, profile image if supplied, account identifiers, authorized login-provider information and authentication records. Passwords are stored as hashes. Sessions may include an IP address and browser user agent.
• Billing: order and account references, product, amount, currency, provider, payment and subscription status, billing periods, cancellations, refunds, and credit grants and deductions. Checkout responses and provider notifications may contain transaction-related billing details.
• Exports: request identifier, export format and character configuration. Asset-pack transactions also record the theme, nickname and language. These records support credit charging, request deduplication, support and usage history. Images and HTML files are generated in your browser; the export endpoint does not upload those files.
• Support: messages and information you submit by email or support ticket. Do not send full card numbers, security codes or passwords.
• Technical records: request times, IP addresses, browser information and errors needed to serve requests and protect the service. The character editor does not request precise location or biometric data.

3. Local collections and shared characters

Editing and previewing require no account. Characters render on your device without being sent to an AI image-generation service.

My collection stores up to 24 character configurations and preview images in this browser's local storage, without synchronization across devices or accounts. Preferences such as language, theme and recent colors may also be stored locally. A temporary session-storage draft can preserve character settings, pack selection and nickname while you sign in.

Clearing browser storage deletes local records, but not server-side account, payment or export records. Download backups of characters you want to keep.

Preset URLs contain character settings. Anyone with the link can open them, and the URL may appear in browser history or access logs. Avoid confidential information in shared presets and nicknames. Downloaded HTML loads a 3D library from jsDelivr when opened, making a network request subject to jsDelivr's privacy policy.

4. Waffo Pancake payments

Choosing Waffo Pancake sends checkout information including email, product, price, currency and order/account references to Waffo. It acts as Merchant of Record for purchases through its hosted checkout, handling payment collection and applicable transaction taxes. The seller identified on the checkout or receipt applies to that transaction.

Card details entered in Waffo checkout are handled by Waffo and its payment partners. Our application does not collect or store full card numbers or card security codes. We receive transaction information to confirm purchases, grant credits, manage renewals and reconcile cancellations or refunds. Waffo handles its checkout, billing and fraud-prevention information under its own Privacy Policy.

Other providers displayed at checkout handle their selected payment method under their own notices. Payments made through another provider are not processed by Waffo.

5. Purposes and legal bases

We use account and transaction information to deliver requested features, maintain credit balances, administer subscriptions and answer support requests. Where applicable, these activities rely on performance of our agreement with you.

Security, fraud prevention and diagnostics may rely on legitimate interests balanced against your rights. Records required by tax, accounting or other law rely on the applicable legal obligation. Optional activities requiring consent need separate consent, which can be withdrawn. We do not use character settings or nicknames to train an AI model.

6. Cookies, providers and international processing

Authentication cookies maintain sessions. Language and display preferences, collections and temporary drafts use cookies or browser storage. You can clear or block them through your browser; blocking necessary storage can prevent sign-in or saving a collection.

The application supports optional Google Analytics and Plausible. The public website did not load either integration when this revision was checked. Enabling optional tracking requires the notices and consent choices applicable to affected users. Purchasing does not require subscribing to marketing emails. Billing, security and support messages are service communications.

Hosting, database, payment, configured email and support providers receive information needed for their functions. The website uses Cloudflare hosting and a Turso production database. See Cloudflare's privacy policy and Turso's privacy policy.

We do not sell personal information for money or use avatar exports for cross-context advertising. Relevant records may be disclosed where legally required, to investigate abuse, protect rights, or during a business transfer subject to privacy protections.

Providers may process information outside your country. Transfer safeguards depend on the destination, provider and applicable law; contact us for arrangements relevant to your information. We do not claim an unverified certification or transfer agreement.

7. Retention and security

Account information is retained while the account remains active and for as long as necessary to provide the service. After account closure or discontinuation of the website service, personal information that is no longer necessary will be deleted or anonymized. Transaction documentation that must be retained by law and records relating to unresolved disputes will continue to be retained in accordance with the relevant requirements.

Cancelling a subscription stops future renewals; it is not an account-deletion request. Local collections remain on your device until deleted or browser storage is cleared.

Legal recordkeeping, payment disputes, fraud investigations or legal claims may require particular records to be kept longer. Records no longer required should be deleted or anonymized under the confirmed schedule. Changing this statement does not itself erase existing records.

We use HTTPS, hashed passwords and restricted access to application records. No safeguard guarantees prevention of every incident. Where breach notifications are legally required, we will notify affected people and authorities within applicable deadlines.

8. Privacy requests

Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction, or object to processing based on legitimate interests. You may withdraw consent and complain to your competent data-protection authority. Exceptions can apply, including to records we must retain.

Update available profile fields in account settings. For deletion, export or other privacy requests, email support@mutanai.com from your account email. We may request proportionate identity verification and respond within applicable legal deadlines. Not every privacy right has a self-service button. Contact Waffo for information it independently holds; we can help identify the related transaction.

9. Age, changes and contact

Accounts and paid purchases are intended for adults aged 18 or older. We do not knowingly collect children's personal information for these features. Contact us if you believe a child has supplied account information.

Material changes will be communicated by a prominent website notice or relevant account email where appropriate. A new purpose requiring consent is not authorized merely by changing this page. The date above identifies this revision.

Privacy, security, support and billing requests use support@mutanai.com. Include information needed to identify your request without sending card details.