Information you provide
The generator processes the English or display name and preferences you submit. The checker processes the Chinese characters you submit. These fields are intended for names, not sensitive information. Do not submit identity documents, precise addresses, financial details, health information, child information, passwords, or confidential records.
The original Name Art card is rendered in your browser. When the separate Art Pack preview is enabled, its characters and style are sent to our server renderer. Its encrypted name-and-style record and private watermarked images expire after 24 hours and are removed during cleanup. Neither tool creates a public gallery. Email messages you send to support are processed by the sending and receiving email services and may contain the information you choose to include.
If you choose to sign in with Google, we receive and store the Google account's stable identifier, email address, and display name to create your account. If you purchase Name Passport or Name Studio, we store your plan, Stripe checkout reference, amount, currency, and fulfillment status. Card and payment details are collected by Stripe, not by ChineseName. Paid members may save Chinese names and pinyin to their private shortlist; those entries are not public.
Private Art Pack orders and files
Where Art Pack purchasing is enabled, the confirmed characters and style are encrypted in a separate order snapshot. The snapshot and private files are retained for 365 days after payment confirmation, then removed during cleanup. Snapshots of closed, unpaid orders are removed after 24 hours; an unresolved payment can require the encrypted snapshot until its status is reconciled. Minimal order, payment, and support references are kept separately for account service and recordkeeping. Downloads require the purchasing account and a short-lived permission; permanent public storage URLs are not provided. There is no public gallery.
How the service processes requests
Generator and checker requests are sent to our service. The checker uses the website's versioned language data and automated rules. For generation, our service first creates a limited shortlist with those same local rules. When AI generation is configured, your submitted name, preferences, and that shortlist are sent to OpenRouter for processing by Alibaba's qwen/qwen3.7-flash model. The model may rank only the supplied shortlist; meanings, pronunciation, safety checks, and scores are still produced from our local data. If AI generation is unavailable, the generator falls back to local ranking and does not send the request to an AI model provider. Results are automated and are not reviewed by a native speaker.
Cloudflare hosts and protects the published website. Cloudflare may process network and request data needed to deliver pages, prevent abuse, diagnose errors, and operate a privacy-preserving rate limiter. The limiter stores keyed one-way aliases derived from limited network, browser, and device signals; it does not store the raw values in its quota records. Quota records expire within 48 hours.
Operational records
Interrupted generator and checker requests can be recovered in the same private browser and account context for 24 hours. Their result cache is encrypted; submitted input is represented by a keyed digest in request metadata. Result access expires after 24 hours and cleanup removes the ciphertext; minimal request metadata is removed after 48 hours. A browser recovery record contains random request and device references, account/context references, an input digest and a timestamp, rather than your submitted name. It is cleared after a confirmed result. Unconfirmed or expired recovery records may remain in this tab until you clear them or close the tab; they cannot recover an expired result. Browser storage restrictions limit recovery after a refresh.
Your original naming input, preferences, chosen name, pinyin, meanings and checks can be kept in session storage in the current browser tab for up to 24 hours, with an in-memory fallback where storage is unavailable. This private choice is not a public share link. Switching accounts prevents restoration of the previous account’s choice; you can clear it from My Chinese Name. Closing the tab normally removes its session storage.
With optional measurement enabled, our first-party funnel uses a random browser identifier and a website session that starts again after 30 minutes without activity. It records controlled interactions, random result references, broad source and device categories, landing paths and experiment variants for up to 90 days. Names, full referrer URLs and free-text prompts are excluded. Turning optional measurement off clears these browser identifiers and stops new funnel events; already received records expire through daily cleanup.
With optional measurement, an offer-placement test may use a random assignment reference to keep the same browser in the same group. The assignment contains no submitted name. It can continue when you first sign in from an anonymous session; signing out, switching between signed-in accounts, or turning optional measurement off clears that browser association. Assignment references are used through the test end plus a seven-day attribution window and cleared on the next site activity after that window. Server assignment records expire after 90 days through daily cleanup.
A functional private-name cookie keeps generation and refinement in the same browser context for 24 hours. It is HttpOnly and is separate from optional analytics. Refinement verifies keyed candidate and preference digests; it does not store the original input in its issuance registry. Encrypted refinement result caches expire after 24 hours and are removed at the next daily cleanup. Successful refinement allowances and provider-free request duration are recorded separately; refinement does not call an extra AI model. Changing accounts never automatically transfers a signed-in user’s private names.
Technical request ceilings use short-lived keyed network hashes to limit bursts, with aggregate daily and monthly request counters. Raw IP addresses are not stored in these counters. This admission control is separate from your successful-use allowance and from optional analytics.
Service cost records distinguish conservative budget allocations from provider-reported usage. With optional measurement, a cost operation may reference your current random website session so we can compare usage by broad source and device category. This link contains no submitted name. It is cleared after 90 days through daily cleanup, or during verified account erasure; minimal budget and cost records remain separately. Work without a verified measurement link stays unattributed, and signed monitoring is recorded separately.
We keep minimal tool-operation records for 90 days, with removal during the next daily cleanup: tool type, success or controlled error code, time, duration, and whether a request carries a verified monitoring signature. These records do not include submitted names, generated names, audio, IP addresses, or browser fingerprints. Daily cleanup removes expired operation records. Payment attempts are recorded separately to recover interrupted checkout and reconcile payment status; payment confirmation comes from Stripe, not a return URL.
Analytics and your choice
Optional measurement uses GA4, Plausible (through plausible.shipsolo.io), and Ahrefs only after you enable it. Their measurement code runs on our separate measure.chinesename.art origin in a sandboxed document. Browser origin rules prevent it from reading this page’s form fields, private results, local storage, links, or downloaded files. Account and private-context cookies use host-only HttpOnly protection and are not exposed to that measurement document. We send fixed page paths and controlled interaction categories, counts and error codes. Raw URL queries, fragments, referrers, names, account details and private file references are excluded.
GA4 receives a random, consented browser reference rather than your Google account or purchasing identity. Its host-only measurement cookies are limited to the separate measurement host, with a maximum configured lifetime of 90 days. The providers can still process network metadata such as IP address and browser information when receiving a measurement request. Turning optional measurement off removes the isolated document, stops new optional events and clears our browser measurement references and requests removal of measurement-host cookies. A failed cleanup request is reported in Privacy choices so you can retry. It cannot recall data already received by a provider. Your choice does not prevent the core tools from working.
Pronunciation audio, logs, and retention
When you press the audio button, the displayed Chinese name and selected pinyin reading are sent through our service to Amazon Polly to create synthesized Mandarin audio. Amazon Web Services processes the request in its Singapore region. We do not send an audio request until you press the button, and you can use the written guide without playing audio. The returned audio is kept in the current page session for replay and is not a human recording.
Operational logs may include request time, route, status, diagnostic identifiers, truncated technical headers, and network information handled by Cloudflare. We use them for security, reliability, debugging, and abuse prevention and retain them only as configured for those purposes. We do not create public result pages.
Sharing and international processing
We disclose information only to providers needed to host, secure, measure as described above, authenticate, process payments, and operate support communications, or when required to protect users, enforce the Terms, or comply with valid legal obligations. Providers may process data in countries other than yours under their own infrastructure and safeguards. We do not sell submitted names or generated results.
Your choices and requests
Depending on applicable law, you may ask about access, correction, deletion, restriction, objection, or portability. Some requests may not apply where we do not hold information that can reasonably be linked to you. We may need enough information to verify and locate a support record, but do not send an identity document unless we specifically explain why it is necessary.
Email support@chinesename.art with the subject “Privacy request.” You can also report a security or rights concern through the contact page.
After we verify an account deletion request, we first resolve any unfinished payment attempts. We then disable existing account sessions, remove the Google sign-in link, email and display name, erase saved names and linked refinement records, and revoke private Art downloads. Encrypted order snapshots and checkout email copies are cleared. Private file deletion is retried if storage is unavailable. Minimal pseudonymous transaction, refund, security and erasure references remain for reconciliation and recordkeeping; a later Google sign-in creates a new free account.
Some encrypted naming recovery caches use short-lived aliases that cannot be located by account alone. They become inaccessible through the deleted account and expire within 24 hours; their minimal metadata expires within 48 hours. We do not confirm the deletion process as finished while file cleanup is pending or that expiry window remains. Clear your private browser tabs and storage to remove local copies. Deletion cannot recall files you downloaded, messages already sent, or payment and provider records held independently by those services.
Age, security, and changes
You must be at least 13 to use the service, and a higher local minimum age may apply. We use reasonable safeguards, but no online service can guarantee absolute security. We may update this policy when the service or its providers change; the effective date above identifies the current version.