Privacy Policy
Charlo has no server. Character cards, chats, and memories are stored only on your device, and every character reply is generated by a language model running on that device. The app goes online only to download language model files, and even then no chat or card content is sent. So this policy explains what we do not collect rather than what we do.
- No sign-up, no login, no accounts.
- Chats, character cards, and memories stay on your device and are never transmitted.
- Replies are generated on-device by a Gemma model, never by an external AI server.
- The internet connection is used only to download model files from Hugging Face.
- No analytics, advertising SDKs, or crash reporting.
- Purchases are handled by Apple on the App Store. We never see your payment details.
Overview
toya (the "Operator") provides Charlo (the "App") and respects the privacy of its users. We comply with applicable data protection laws, including the Personal Information Protection Act of the Republic of Korea. This policy describes transparently how the App handles your information.
Information We Do Not Collect
The App does not collect any of the following, and contains no code or third-party tools for collecting it.
- Chat content, what you type, or the replies characters generate
- Character cards, lorebooks, or memories you import or create
- Identity information such as name, date of birth, gender, email address, or phone number
- Account information such as user IDs or passwords (the App has no concept of accounts)
- GPS, cell tower, or Wi-Fi based location
- Contacts, photos, camera, microphone, or calendars
- Advertising identifiers (IDFA) or device identifiers
- Usage history, navigation paths, or other behavioral data
As a result, the Operator has no means of identifying any user or seeing which characters you talk to or what you say.
Information Stored Only on Your Device
The following information, which you create or import in the App, is written only to your device's local storage.
- Character cards and your edits to them (name, description, first message, lorebook, card image)
- Chat history for each character, chat summaries, and the memory entries you manage
- Settings such as the user name shown in chats, app language, appearance, and execution backend (GPU or CPU)
- Downloaded language model files
This information is kept in the App's private storage as a SwiftData database, card files, model files, and the system settings store. No one outside your device, including the Operator, can access it, and it is never sent over the network.
Replies Generated on Your Device
Character replies are generated by running Google's open Gemma model directly on your device with the LiteRT-LM engine. The card content, chat history, and memories used to build each reply are processed only in your device's memory and are never sent to any external server, including the Operator's or Google's.
Once a model file has been downloaded, you can chat without an internet connection. Your chats are never used to train or improve any model.
Model File Downloads
When you tap to download a model, the App downloads a Gemma 4 model file (about 2.6 GB to 6.9 GB) from the public Hugging Face repository huggingface.co/litert-community, operated by Hugging Face, Inc. The download uses iOS background downloads, so it continues after you leave the App.
The App sends no account, identifier, chat, card, or other user information with this request and does not log in. As with any web request, Hugging Face receives your device's IP address and basic request details, such as the requested file and the time, in order to deliver the file. That information is handled under Hugging Face's privacy policy. The Operator does not receive any download records.
Model files are large, and downloading them over mobile data may incur carrier charges. Wi-Fi is recommended.
File Access and Device Permissions
When you import a character card, the App opens the iOS file picker and reads only the single card file (.charx, .png, or .json) you choose. The card is copied into the App's private storage, and the App does not browse any other files on your device.
The App does not request access to the camera, photo library, microphone, location, or contacts.
Payment Information
Charlo is a paid app purchased once on the App Store, with no in-app purchases or subscriptions. Payment is processed by Apple, and your card number, payment method, and Apple Account details are never shared with the Operator. The Operator cannot tell who has purchased the App.
Personal information handled during payment is governed by Apple's privacy policy.
Third-Party Sharing and Processors
Because we collect no personal information, none is shared with or entrusted to third parties. Apart from Apple Inc., which distributes the App and processes payment, and Hugging Face, Inc., which operates the repository the model files are downloaded from, the App communicates with no outside company.
The App contains no advertising networks, analytics, crash reporting tools, or tracking.
Retention and Deletion
Data on your device is kept until you delete it. Deleting a character card in the App also deletes its chat history, and you can delete individual memory entries and downloaded models in the App.
Deleting the App from your device removes all of its data, including cards, chats, memories, and model files. The Operator keeps no copies, so deleted data cannot be recovered.
Device Backups
If you use iCloud Backup or computer backups, your cards, chats, memories, and settings may be included in those backups under your device's backup settings. Such backups are between you and Apple. The Operator is not involved and cannot access them.
Large model files are excluded from backups, so after restoring a device from a backup you will need to download the model again.
Security
App data is stored in the sandbox provided by the operating system, where other apps cannot reach it. Never sending chats or cards off the device is itself the strongest safeguard against leaks.
The App cannot prevent access through a lost, stolen, or unlocked device, so we recommend using a device passcode.
Your Rights
Because all data lives on your device, you can view, edit, and delete it directly in the App at any time without any request process. There is no information held by the Operator for you to request deletion of.
Children's Privacy
The App is not directed to children under 14 and collects no personal information of any kind, including age.
Privacy Contact
Please send any questions, complaints, or requests for remedy regarding privacy to the email above, and we will reply after review.
Changes to This Policy
If this policy changes because of new laws or App features, we will post the changes and their effective date on this page. We will also announce here first if the repository used for model downloads changes. For significant changes that are unfavorable to users, we will give advance notice, for example within the App.