Privacy Policy

This policy explains what personal data Charmotion collects, why, and your rights. The controller is TRY2APP LTD, registered in England and Wales. Contact: support@charmotion.try2.app.

What we collect

Data	Why	Legal basis (UK GDPR)
Email address, optional display name	Sign-in codes, your account, service emails (e.g. “your set is ready”)	Contract
Images you upload and the animation files we produce	To create and deliver your Sets	Contract
Plan, credit and order records (from Polar)	To give you what you paid for	Contract; legal obligation (accounting)
Support tickets and messages	To help you	Contract; legitimate interests
Security data: session cookie, hashed IP addresses in audit logs, rate-limit counters	To keep accounts and the Service secure and prevent abuse	Legitimate interests
Waitlist email and plan interest	To tell you once when checkout opens	Consent (you can withdraw any time)

We do not use advertising or analytics trackers, and we do not sell or share your data for marketing.

How your images are processed

• Uploads are stored privately (never in a public bucket) and are only reachable through your signed-in account or short-lived signed links.
• Your image is processed by our animation engine on machines we operate. The engine uses computer-vision and AI-assisted analysis to find your character’s parts; it does not send your image to third-party AI providers.
• We never use your images or Sets to train AI models, and never publish them without your written permission.
• “Try it with your character” on our website runs entirely in your browser: that image is not uploaded or stored by us.

Who processes data for us

• Cloudflare — hosting, database and private file storage, security.
• Polar — payments and billing as merchant of record (Polar receives your payment details directly; we never see card numbers).
• Resend — sending sign-in codes and service emails.

Some of these providers process data outside the UK (for example in the United States) under appropriate safeguards such as the UK International Data Transfer Addendum or adequacy regulations.

Retention

• Uploads and Sets are kept while your account is open so you can re-download them.
• When you delete your account, we delete your account record, uploads, outputs, ticket attachments and related records immediately from our live systems; residual copies in provider logs or backups expire within 30 days.
• Order and invoice records may be kept for up to 6 years where UK tax law requires (held by Polar and, in minimal form, by us).
• Security logs are kept for a limited period and store IP addresses only in hashed form.

Cookies

We use one strictly necessary cookie to keep you signed in (cm.session_token, HttpOnly, Secure, SameSite=Lax). No analytics or advertising cookies, so no cookie banner is needed.

Your rights

You can access, correct, export or delete your data, restrict or object to processing, and withdraw consent. Most of this you can do yourself: Account → Export my data downloads a JSON copy, and Account → Delete account erases everything. For anything else, email support@charmotion.try2.app. You can also complain to the UK Information Commissioner’s Office (ico.org.uk).

Children

Charmotion is not intended for children under 18.

Changes

We will post updates here and, for significant changes, email account holders.