Bot Vault / Privacy

Your data,
clearly explained.

Bot Vault helps you back up the characters you created on Character.AI as JSON, or transfer selected characters to private, unpublished drafts in your Emochi account. This policy describes the extension and this support website.

1. Publisher and contact

Bot Vault is published by Boyn. For privacy questions or support, email boyn@flowgpt.com. Effective date: 14 October 2026. This policy covers extension version 1.2.5.

2. Data the extension handles

Account identifiers and sign-in state: your Character.AI username and your Emochi account identifier/display name are used to identify the active accounts and avoid importing into the wrong account.
Character content: names, descriptions, definitions, greetings, avatar references and the other character fields provided by your own profile. Raw JSON backups retain those source fields, including character IDs and any supplied interaction/upvote counts.
Authentication information: the extension makes authenticated requests using your existing website sessions. Emochi’s session token is handled temporarily inside an isolated execution context in its website tab. Tokens and cookies are not returned to extension storage or written to backups. Bot Vault does not ask for or store your password.
Your choices and import progress: language preference, selected characters, edited copies and minimal records used to resume imports and avoid duplicates.

The extension does not collect chat history, contacts, browser history, recommended characters or other creators’ private definitions. It extracts the fields needed for this workflow from website responses; complete page/session responses and account email addresses are not exported. Normal network requests also expose standard connection metadata, such as IP address, to the services receiving those requests.

3. Why and where data is used

Character data is processed in your browser. Reading a profile, checking sign-in and verifying a draft use the relevant website’s existing services. A JSON backup is generated locally and saved through your browser’s download flow.

Only when you start an import, the selected character’s edited content is sent to Emochi’s service at emochi-backend-k8s.flowgpt.com to create and verify a private, unpublished draft. Bot Vault does not automatically publish characters. Source upvote/interaction counts and a separate source audit record are not sent to Emochi.

If you enable avatar transfer, the selected avatar is downloaded from characterai.io without Character.AI login credentials, then uploaded through Emochi’s existing Amazon S3 image storage and image-processing services. The extension allows upload destinations only in the flow-app-uploads and flow-app-uploads-temp S3 buckets. Emochi may serve the processed image through its image CDN, including image-cdn.flowgpt.com. Turning avatar transfer off skips this upload.

There is no Bot Vault-operated server receiving character content or authentication tokens. Bot Vault has no advertising, analytics or telemetry service, does not sell user data, and does not use user data for unrelated purposes, advertising or credit decisions. Character.AI, Emochi and their infrastructure providers handle requests and any content stored with them under their own policies.

4. Storage, retention and deletion

Browser session storage: original character data, edited content, selections and the current workspace step are kept in chrome.storage.session. They are cleared when the browser session ends or the extension is reloaded. Closing only the Bot Vault tab does not clear them.
Local extension storage: chrome.storage.local keeps your language and minimal import receipts: source username/character ID, destination account ID, draft ID, image URL, processing stage and update time. These are kept until extension storage is cleared or the extension is uninstalled. They do not include full character text or session tokens, and are not stored in Chrome Sync.
JSON files: backups remain wherever you save them until you delete them. They may contain private character content.
Emochi drafts and images: you manage these in Emochi. Uninstalling Bot Vault does not delete content already sent to Emochi. Requests about data retained by that service should be directed to Emochi.

Removing local import receipts also removes the extension’s ability to recognize those earlier imports in that browser.

5. Permissions and security

The extension requests scripting to run packaged logic in the relevant website tabs and storage for local workspace/preferences/import records. Host access is limited to character.ai, www.character.ai, emochi.com and characterai.io. It does not request cookies, browsing-history, download-management or all-sites permissions. Network transfers use HTTPS. Executable extension logic is bundled in the extension; it does not download and execute remote code.

6. This website and support email

This public website is hosted on Vercel. It uses no Bot Vault analytics, advertising scripts, cookies or browser-storage tracking. Vercel may process ordinary request metadata, such as IP address and user agent, to deliver and secure the website under Vercel’s privacy policy.

If you email support, Boyn receives your email address and anything you choose to include through the support mailbox. That correspondence is used to respond to and resolve your request and is retained only as needed for support and applicable obligations. You may request deletion by email. Please do not send passwords, tokens or private character exports.

7. Limited Use and policy changes

Bot Vault’s handling of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Changes to this policy will be published on this page with an updated effective date. New data uses that require consent will be disclosed before they are enabled. Contact Boyn at boyn@flowgpt.com with questions about this policy.

Your data,clearly explained.