Privacy Notice

This notice covers https://fantasywriter.app and the writing studio at portal.fantasywriter.app. [TRADER LEGAL NAME] ([REGISTRATION NUMBER]), [BUSINESS ADDRESS], is the data controller. For anything in this notice, write to [PRIVACY CONTACT EMAIL].

The short version: we collect what the product needs to work and nothing for advertising. There is no analytics package on this site and no tracking cookies. Your manuscript is never used to train an AI model.

What we collect, and why

Your account

Email address, name if you give one, and authentication events, all handled by Clerk. We need this to give you an account and keep you signed in. Lawful basis: performance of a contract.

What you write

Manuscripts, chapters, lore entries, timelines, notes, cover art and anything else you create. Stored so we can show it back to you, search it, and send the relevant parts to an AI model when you ask for help with a passage. Lawful basis: performance of a contract.

To make lore searchable we split your text into chunks and turn them into numeric vectors (“embeddings”). That step sends the text through OpenRouter, listed below, under a zero-retention instruction — it can only be served by providers contractually bound not to store it or train on it. The vectors are stored alongside your workspace.

How you use the AI features

Quick notes and their reference images are private to their author, including within shared worlds. They are not automatically sent to AI. Optional draft recovery stores an unencrypted copy in this browser, separated by account, world and chapter. Enable it only on a trusted device. Copies older than seven days are discarded when recovery next runs; clearing this site’s browser storage removes them immediately. Recovery is not a backup or a promise of offline syncing.

Which feature you used, which model served it, how many tokens it consumed, and what it cost us. We use this to enforce plan allowances, to bill accurately, and to record which chapters were AI-assisted so you can make an accurate disclosure to a retailer. Lawful basis: performance of a contract, and our legitimate interest in understanding what the service costs to run.

Problem reports and reliability diagnostics

When you submit a problem report, we store the description you choose to send, your account reference, optional contact email and error reference, browser family, time and deployment in a private support queue. Please do not include passwords, API keys or manuscript text. Reports are not published as GitHub issues automatically.

Better Stack receives infrastructure logs and, when error tracking is enabled, restricted technical diagnostics: error category, operation, application code position, deployment and error reference. The error integration excludes request bodies, cookies, prompts, manuscripts, full URLs and exception messages. Session recording is disabled. This supports our legitimate interest in keeping the service reliable.

Payment

Stripe collects and holds your card details directly. We receive a customer reference, your plan, and whether payments succeeded. Card numbers never reach our servers. Lawful basis: performance of a contract, and a legal obligation to keep financial records.

Reading and reviewing

If you use the public library: which books are on your shelf, how far through a book you are, and any rating or review you leave. Reviews are public and show the name on your account. Lawful basis: performance of a contract.

Email

We send account email (sign-in, receipts, payment problems) and a small number of lifecycle messages about getting started or coming back. We record that a message was sent so we never send it twice. Every non-essential message has an unsubscribe link. Lawful basis: performance of a contract for account email; legitimate interest for lifecycle email, which you can object to at any time.

Security and abuse prevention

Our free public tools are rate-limited per visitor. Rather than store your IP address, we store an irreversible salted hash of it — enough to tell two visitors apart, not enough to identify you or to recover the address. Our host, Vercel, keeps ordinary request logs containing IP addresses for a short period. Lawful basis: legitimate interest in keeping the service available and not being billed for abuse.

What we do not do

• We do not sell or rent personal data.
• We do not run advertising or advertising trackers.
• We do not use your writing to train AI models, and the providers we send it to are configured not to retain it for training. See the cookie notice for what is stored in your browser — currently only what is strictly necessary.
• We do not read your manuscripts. Access by a person is limited to what is needed to investigate a specific fault or a report of abuse.

Who else processes your data

These are every third party that receives personal data or your content. Each processes it only on our instructions.

Data leaving the UK and EU

Several of the providers above are in the United States. Where that is the case, transfers are made under the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, as provided for in each provider’s data processing agreement. Your account data and your written work are stored in the European Union.

How long we keep it

• Your content: until you delete it, or until 30 days after you close your account — a grace period so an accidental closure is recoverable. Then it is deleted.
• Account records: deleted with the account, on the same 30-day timetable.
• Payment and invoice records: kept for six years, because tax law requires it.
• Email send records: kept while the account exists, so we do not repeat a message.
• Rate-limit hashes: deleted automatically after 24 hours.
• Published books: unpublished when you close your account, though search engines may keep a cached copy for a while.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to processing we do on the basis of legitimate interest. You can also withdraw consent where we relied on it. Write to [PRIVACY CONTACT EMAIL] and we will respond within one month.

For your writing specifically you do not need to ask: the export function in the studio gives you the whole manuscript in an open format on every plan, immediately.

If you think we have handled your data badly, please tell us first — but you have the right to complain to a regulator. Ours is Datatilsynet, the Denmark data protection authority, because that is where we are established. You can also complain to the authority in your own country — the ICO if you are in the UK, or your national authority elsewhere in the EU.

If you are outside the EU

United Kingdom. UK GDPR gives you the same rights set out above, and you may exercise them the same way.

United States. Several states — California, Colorado, Virginia and others — give residents rights to know, delete and correct their data, and to opt out of its sale. We do not sell personal data to anyone, and we will honour a request to know, delete or correct regardless of which state you live in. Write to [PRIVACY CONTACT EMAIL].

Children

This service is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has an account, contact us and we will remove it.

Changes

When this notice changes materially we will email account holders before the change takes effect. The date at the top of the page always reflects the current version.