Beta · Last updated 2026-09-30

Privacy Policy

This policy explains what information is collected when you use the Haldun AI home page and studio, how it is used, who it is shared with, and what rights you have. Haldun Ai LLC is responsible for the information. We follow the Law of Mongolia on Personal Data Protection.

This is an English translation for convenience. If it differs from the Mongolian version, the Mongolian version prevails.

1. What information, and where

1.1Account. Email address, sign‑up and last sign‑in dates, credit balance and credit history (date, amount, reason, creation number). Each time you sign in, a 6‑digit code is sent to your email. We hold no password.

1.2In your browser (never sent to us). Studio settings, creation history, “My library” and character pictures are kept in the browser’s localStorage. Clearing the browser’s site data deletes them.

1.3Sent to the server when you create. The idea you wrote, the options you chose (aspect ratio, style) and a reference picture (the first one). The server passes these to AI service providers and returns the result to you. We do not write pictures or results to a database.

1.4Technical logs. Each request creates a server log entry: date, duration, success or failure, a short error description and part of a hash of your account number. Email addresses are not written to logs. To improve quality, text that Haldun prepared from your idea (up to 4,000 characters) may be written to the log. Pictures are not logged. The hosting service keeps IP addresses and browser information in its own logs for a short time.

1.5Limit counting. To protect against too many requests and to count daily limits, we use hashes of IP addresses and account numbers (beta codes). Daily counters are deleted automatically within 2 days.

1.6Home page sign‑up form. The email you type is kept briefly on your device and passed to the studio’s sign‑in window. It goes to the server only when you press “Send code”.

1.7We do not collect: passwords, payment card details, GPS location or phone contact lists.

2. What we use it for

• providing the Service — producing the results you ask for;
• accounts, sign‑in and credit accounting (sending sign‑in codes);
• protection — counting limits, detecting misuse and attacks;
• fixing errors and improving quality;
• meeting our legal obligations.

We do not use your information for advertising and do not sell it to anyone.

3. Who we share it with

To run the Service, the following third‑party services process your information on our behalf:

Sign‑in codes are delivered by Supabase or an email service connected to it. These providers process information under their own terms. Under their API terms, such data is not used to train models by default and may be kept for a limited time to monitor misuse. If a new provider is added, we will update this list.

These services are located outside Mongolia, mainly in the USA, so your information is processed there. By using the Service you agree to this.

We may disclose information when the law requires it (an official request from a court or law enforcement).

4. How long we keep it

• information in your browser — until you delete it;
• account and credit history — until you ask us to delete your account (payment‑related records for the period required by law);
• pictures and results — not stored on the server;
• server logs — for a short time, per the hosting settings;
• daily counters — 2 days.

5. Cookies

When you sign in, we set two necessary cookies to keep you signed in: hd_at (1 hour) and hd_rt (30 days). They are HttpOnly — site scripts cannot read them, and they go only to our server. They are deleted when you press “Sign out”. We use no advertising cookies, trackers or analytics. The browser’s localStorage is used only to keep your settings and creations. If we add analytics, we will update this policy first.

6. Security

The site runs over HTTPS. AI and database keys exist only on the server. Sign‑in tokens are in HttpOnly cookies, only the server changes credit balances, logs hold hashes rather than emails, and the number of requests and sign‑in attempts is limited. Please note, though, that no method of transmission over the internet is completely secure.

7. Your rights

You have the right to know about your information, get a copy, have it corrected or deleted, and withdraw your consent. You can delete the information in your browser yourself (browser settings → delete site data). To have your account deleted, or for any other request, write from your registered email to hello@haldun.ai. If you are not satisfied with our answer, you have the right to complain to the supervisory authority under the law.

8. Children

The Service is not intended for people under 18. If you believe a child’s information has reached us, let us know — we will delete it.

9. Changes

If we update this policy, we will write the date at the top and announce important changes on the site and in the studio.

10. Contact