Privacy Policy

DokiPal (dokipal.com) lets you browse AI characters, start conversations, and create your own characters. This policy explains what we collect, why we collect it, and the limited set of third parties we share data with to make the platform work. We try to keep it human and specific — if anything is unclear, email us at support@dokipal.com.

We collect only what we need to run your account and the chat experience:

• Account info — your email, display name, and password. Passwords are hashed with PBKDF2 using the Web Crypto API before they touch our database. We never store or log plaintext passwords.
• Sign-in cookie — when you log in we set one signed, encrypted cookie so you stay signed in across visits.
• Content you create — characters you author (name, description, personality, scenario, first message, tags, and related metadata) and any avatar images you upload. Avatar files live in Cloudflare R2; the upload records live in our uploads table.
• Conversations — messages you send to AI characters and the responses you receive, plus the conversation threads that tie them together and the characters you've liked. These are stored in our conversations, messages, and characterLikes tables.
• Technical data — your IP address (used for rate limiting via Cloudflare KV) and basic request logs needed to keep the service running and catch abuse.
• Usage data — the pages you visit and how you move through them (clicks, taps, scrolls), plus your device, browser, and rough location. Google Analytics and Microsoft Clarity collect this for us; see below.

• Providing the service — authenticating you, loading your characters and conversations, and streaming AI responses back to your browser.
• AI personalization — using the character prompts and recent conversation history so the AI stays in character and picks up where you left off.
• Rate limiting — enforcing per-user and per-IP limits (for example, 5 character generations per hour) so the platform stays fast and affordable for everyone.
• Abuse prevention — detecting automated scraping, spam, and misuse patterns that would harm other users or partners.
• Support — responding to you when you email us with questions, bug reports, or account requests.

DokiPal is a small set of thoughtful pieces glued together. We do not sell your data, and the services below only receive what they need to power a specific DokiPal feature:

• OpenRouter — receives the character prompt and the messages in your current conversation so it can generate the AI's reply. Responses are streamed back to you over SSE and saved to our database.
• Runware (Flux Klein model) — receives the text prompts we craft when you generate character avatar images. The resulting image is stored in our Cloudflare R2 bucket.
• Cloudflare — hosts the application (Workers), our D1 database, our R2 file storage, and the KV cache we use for rate limiting. Your traffic naturally flows through Cloudflare's edge.
• Google Analytics and Microsoft Clarity — show us how DokiPal is used: pages viewed, clicks, taps and scrolls, device, browser, and rough location. Clarity also records sessions so we can see where the site confuses people or breaks. Everything you type, your messages, story titles, notes and memory, persona descriptions, and character drafts are masked in your browser, so they never reach Clarity. When you're signed in, both get your account id (never your email) so we can look into a problem you report.
• Our error tracker (Sentry, which we host ourselves) — receives a report when something breaks: the error, the page, and your browser and device.

These providers process data on our behalf solely to run DokiPal features. We do not sell personal data to advertisers or data brokers.

We use one sign-in cookie, set when you log in, plus the analytics cookies that Google Analytics and Microsoft Clarity set to count visits and tie a session together. We don't use advertising cookies or advertising pixels. Your browser's localStorage holds a few small preferences, and a guest persona if you use one without an account. Clearing your cookies will sign you out.

We keep your account data for as long as your account is active. Conversations and messages stay in our database until you delete them or delete your account. Uploaded avatar images remain in Cloudflare R2 until you remove the character or upload a replacement. Basic request logs used for rate limiting and abuse prevention roll over on a short window.

You can:

• Access the data associated with your account.
• Delete individual conversations at any time from your dashboard.
• Delete your account, which removes your user record along with your sessions, characters, conversations, messages, likes, and uploads.
• Update your profile details (display name, email, password).

To exercise any of these rights, email us at support@dokipal.com from the address tied to your account and we'll take care of it.

Character replies on DokiPal are generated dynamically by large language models routed through OpenRouter. Outputs can be imperfect, inconsistent, or unexpected, and they do not represent the views of DokiPal or the authors of any source material a character is inspired by. Your messages are processed server-side and sent to OpenRouter to produce each reply; please don't share real personal secrets, financial details, or anything you wouldn't want stored in a conversation history.

DokiPal is intended for users who are 18 or older. Because the platform allows optional NSFW content and features mature storytelling, it isn't appropriate for minors. We do not knowingly collect data from anyone under 18. If you believe a minor has registered an account, please contact support@dokipal.com and we will remove the account.

If we make meaningful changes to how we handle your data, we'll post the updated policy on this page and update the "Last updated" date at the top. For significant changes we may also send a notice to the email on your account.

Questions, data requests, or anything you'd like us to look into — reach out at support@dokipal.com. A real person reads every message.