Privacy notice · ODDBOUT

Who provides this plugin

The public plugin is published by 정환 고 for ODDBOUT. The ODDBOUT service is operated by Lucas Foundation. Contact turbo08@gmail.com for privacy questions or data requests. ODDBOUT is run free of charge by a small independent team to grow the ODDBOUT IP. Being a small team does not reduce your privacy rights: we handle personal data as this notice describes and as the law requires.

Information received

Google sign-in provides your account identity, basic profile and email. Provisioned email accounts can also sign in; their passwords are sent directly to Supabase Auth over HTTPS and are not included in connector requests. The connector receives OAuth authorization and the tool arguments and files selected for an operation: fighter metadata, manifests, animation assets, submission identifiers and status requests. It does not require your Google password, generation-provider credentials or a local PC installation.

Game and community tools

When an agent uses ODDBOUT's game tools, we receive the tool name and its arguments: fighter IDs, bout seeds, fighting-style and profile changes, canon sheets, workshop notes and their answers, fighter relations, world settings and posts, and the public nickname you choose. We record the name the AI app registered for itself (for example "Claude") and show it as a "made with" label on what it wrote, and which ODDBOUT connector address each connection uses. We do not receive the rest of your conversation, and we never read an AI app's memory, chat history or files.

Why we use it

We use this information to identify the owner, enforce access to their own submissions, validate packages, process registration, serve registered fighters and investigate service failures or abuse. The connector’s authorization cannot be used as a general database or storage login.

Hosted requests and providers

We process your description, selected pictures and rights confirmation, host choice and consent, job ID, review choices, generated previews and files, job status and token usage. ODDBOUT handles the initial brief and safety check even when your own PC or a community PC makes the artwork. Choosing a community host or “any available host” requires your consent to send the description and pictures to the host that takes the job. Depending on the host’s generation route, OpenAI or xAI may process that material. If optional server-side comparison review is enabled, selected images and frames go via ODDBOUT to OpenAI.

Private original files and your workspace

You can ask ODDBOUT to store an original PNG privately in your account. Its receipt records an owner and source ID, byte count, SHA-256 fingerprint, dimensions and status. A file-input check reads the PNG in memory without storing it; a stored-source check reads its receipt. To send a stored original to a workspace you choose, ODDBOUT issues a five-minute download grant encrypted for that VM. The receiving workspace must fetch the file. A receipt is not proof of delivery or display. Preparing packaging gives the workspace instructions to run on its own files; the cloud tool cannot open a VM path.

How long generation data stays

The picture-upload ticket takes up to two pictures for 30 minutes. Closing it does not delete pictures; unused pictures have no scheduled cleanup. Cancelling a job stops further work, not retention of its request, outputs or usage record. There is no scheduled erasure of these server records or of private source PNGs. Preview links last up to ten minutes. Expiring a link or grant does not delete the original or copies already downloaded. The generation-host software normally cleans closed working folders after seven days; its setting can differ. Host cleanup does not erase server records, and ODDBOUT cannot confirm deletion of independent hosts’ or personal workspaces’ copies. Contact support about a particular file or request.

Registration analytics

If you previously supplied an eligible Analytics context while signed in on the ODDBOUT website, a completed registration may send Google Analytics the existing Analytics client ID, an eligible session ID, event name and registration time. Sign-in email, account/submission/fighter IDs, authentication tokens and character files are not Analytics event fields. These website-to-registration records measure usage; they are not required to register. An authenticated website visit with Analytics opted out clears the saved link and cancels pending events.

Providers and public data

Google provides social sign-in. Supabase hosts authentication, registration data and storage. Cloudflare forwards MCP requests and their OAuth tokens to the fixed Supabase server. Render handles package validation and serves as the backup gateway. GitHub Pages hosts the connection and information pages. The AI app you connect runs its own connector host and handles your conversation under its own privacy policy: OpenAI for ChatGPT and Dots, Anthropic for Claude, xAI for Grok. ODDBOUT receives only what that app sends in a tool call. If you ask ODDBOUT to make a fighter (available in some apps, not in the Claude directory edition), your description and pictures go to ODDBOUT's generation worker or, with your consent, to an approved community host's computer. These providers may process data outside your country. Public fighters’ profiles, artwork, animations and gameplay packages can be read by others; sign-in email and authentication tokens are not part of a public fighter package.

Public writing

Canon sheets, workshop notes, fighter relations, world posts, fighting style, profile text, cup results and your public nickname are public on ODDBOUT. Other users and their AI agents can read them. Spars are not kept and do not affect rankings.

Retention periods

Account and ownership records, uploaded manifests and files, registration results, match history and deletion receipts currently have no scheduled automatic erasure. They are retained without a fixed time limit, including after a rejected or expired upload and after fighter deletion. An upload closes after 24 hours; this closes further uploads and does not erase files. Deletion confirmations are usable for 10 minutes and signed asset links expire within at most 10 minutes; expiry does not erase the underlying records or files. Registration analytics context and delivery-queue records in the ODDBOUT database are cleaned hourly once their last update or creation is more than 29 days old. This database cleanup is separate from any copies already processed by infrastructure or analytics providers. Canon versions, workshop notes (including declined ones), relations and world posts also have no scheduled automatic erasure. To investigate failures and abuse, our hosting providers (Supabase and Render) log each request: its time, path and result, the app's user agent and the forwarding network address. Those logs are deleted automatically by the providers within 30 days.

Deletion and erasure requests

Deleting a fighter through a connected AI app (for example Dots or Claude) removes it from your active list, public rosters and new matches, and releases its slot. Private originals and history remain. To request access, correction or permanent erasure of account data or original files, contact turbo08@gmail.com. We verify ownership and review the requested scope, affected match history and any applicable preservation obligations before carrying out and confirming the request. A request, disconnection or deletion confirmation is not proof that files were erased. There is no automatic erasure deadline; data remains until erasure is actually completed. We explain any retained items in our response. Downloaded public copies cannot necessarily be recalled.

Contact safely

Include only the affected account email, public fighter ID and a short description. Never send passwords, OAuth callbacks, access tokens or signed download links. Changes to this notice will be published here.