Privacy Policy

The short version

WriteLoom is a writing workspace. We collect the minimum data we need to run the service, store everything you create with strong encryption, and never use your manuscripts or any artifact you make to train any AI model. You can read every page of this policy below, or skip to the section you need from the table of contents.

• Who we are
• What we collect
• How we use it
• AI vendor data flow
• No training on your work
• Third parties and service providers
• When we share data
• How long we keep data
• Security
• Your rights
• GDPR (EEA & UK)
• CCPA / CPRA (California)
• International transfers
• Cookies and similar technologies
• Children's privacy
• Changes to this policy
• Contact

Who we are

WriteLoom is operated by the team behind writeloom.app. For the purposes of data-protection law, we are the data controller of the personal data we collect about you when you use the service. You can reach us at [email protected] or by writing to the postal address available on request.

What we collect

Account information

When you create an account we ask for an email address. You may optionally add a display name, profile picture, time zone, author bio, and website. If you enable two-factor authentication, we store the verified TOTP factor (a cryptographic shared secret bound to your authenticator app); we do not store the codes it generates.

Billing information

Paid plans are billed through Stripe. We receive a customer ID, subscription status, plan tier, billing email, and the last four digits of your card; we never see the full card number or CVC. Stripe's own privacy policy governs how they handle the rest.

Project content

Anything you create or upload inside WriteLoom is project content: manuscripts, chapter text, outlines, character sheets, world notes, beat sheets, relationship maps, research notes, uploaded images and reference files, comp sets, query letters, cover designs, marketing plans, audiobook renders, and so on. Project content is stored encrypted at rest in our database, scoped to your account, and accessible only to you and any collaborators you explicitly invite.

Usage data

We collect anonymized usage data so we can fix bugs, plan improvements, and prevent abuse: which pages you visit, which features you use, anonymized API call counts, error logs (without user-supplied content), and approximate geographic region derived from IP address. We do not log your keystrokes, manuscript text, or the content of AI conversations.

Device and log data

Our hosting provider records standard web-server logs (IP address, user agent, HTTP method, response code, timestamp) for the operation and security of the service. These logs are retained for a maximum of 30 days unless required longer for security-incident response.

How we use it

• To run the service. Show you your own work, process the AI features you use, generate exports, deliver emails, accept payment.
• To improve the service. Identify bugs, find slow pages, prioritize new features based on aggregate, anonymized usage patterns. Never on individual manuscripts.
• To communicate with you. Send confirmation, password-reset, billing, and security emails. We send no marketing email by default; if you opt in, you can opt out at any time from your account settings.
• To enforce our terms. Detect and prevent abuse, spam, fraud, or violation of our terms of service.
• To comply with law. Respond to valid legal process and protect the rights, safety, and property of writers and the service.

AI vendor data flow

WriteLoom uses several AI vendors to power specific features. For each call, we send only the context that feature needs and nothing more. Every vendor we use is bound by a written agreement that prohibits training their models on the content we send.

Anthropic (Claude)

Used for: the line editor, copy editor, developmental editor, the Plan-studio AI assistant, agent and publisher search, comp-set curation, reviewer finder, back-cover and one-pager drafting, the site assistant on writeloom.app. What we send: the specific chapter, prompt, or query context the feature requires; never the whole manuscript unless the feature inherently requires it (e.g., a full-manuscript line-edit pass). Anthropic does not train on the data we send.

OpenAI

Used for: legacy paths in the agent-search and reviewer-finder tools, image generation in the Sell-studio cover designer. What we send: the search-query text or generation prompt for that single call. OpenAI does not train on API-submitted data by default and we keep that default.

ElevenLabs (audiobook only, bring-your-own-key)

Used for: audiobook narration on the Sell studio. Because ElevenLabs bills per character of speech generated, this single feature runs against your own ElevenLabs API key. We do not see or store the audio output beyond presenting it to you in your project. Your ElevenLabs key is encrypted at rest in our database and never appears in any log.

Google (Gemini)

Used for: one specific step in agent research that needs grounded web-search results. What we send: the agent name we're looking up. Output is the public list of titles that agent has represented. No manuscript content is sent.

No training on your work

We do not use your manuscripts, plan notes, characters, cover designs, marketing artifacts, or any other content you create or upload to WriteLoom to train any AI model, ours or any vendor's. Every AI vendor we route data to is bound by a written agreement to the same effect.

This is materially different from pasting your draft into a general consumer AI interface like ChatGPT, Claude.ai, or Gemini, where your input may be used to train the underlying model unless you have specifically opted out in that tool's settings. WriteLoom routes around that risk entirely.

Third parties and service providers

We use the following service providers to run WriteLoom. Each is bound by a data-processing agreement that limits their use of your data to providing the service we hired them for.

• Supabase (database and authentication), project content, account data, session storage.
• Railway (application hosting), runs the WriteLoom server processes and serves the website.
• Cloudflare (DNS, CDN, DDoS protection, email routing), handles network-level traffic and routes inbound email at our domain.
• Resend (transactional email), delivers signup confirmations, password resets, account notices, and any marketing email you have opted in to receive.
• Stripe (payments), accepts subscription payments and stores billing records.
• Anthropic, OpenAI, ElevenLabs, Google (AI vendors), used per the data-flow table above.
• Plausible Analytics or Cloudflare Web Analytics (privacy-friendly analytics, no cookies, no personal data), aggregate page-view counts.

When we share data

We share data outside the service providers above only when:

• You ask us to. If you invite a collaborator to a project, that collaborator gets access to the project content you share with them.
• Legal process requires it. We may disclose data in response to a valid subpoena, court order, or other legal obligation. We will tell you about it unless we are legally prohibited from doing so.
• A business transition happens. If WriteLoom is acquired, merged, or sells assets, your data may transfer to the successor under the same privacy commitments. We will notify you in advance and give you the option to delete your account first.
• It's aggregated and anonymized beyond the point of re-identification (e.g., “X% of WriteLoom users use the Pitch studio”).

We never sell your personal data, and we never share it with advertisers.

How long we keep data

• Active account. Project content and account data are kept for as long as your account is active.
• Paid to Free downgrade. If you cancel a paid plan, your account drops to the free Thread tier. Project content is preserved; the paid studios are paused until you resubscribe.
• Inactive free accounts. If a Thread account is inactive (no sign-in) for 6 consecutive months, we remove the projects associated with it. The account itself remains. We send a warning email before any deletion.
• Deletion request. When you delete a project or your account, we remove the data from live systems immediately and from backups within 30 days.
• Billing records. Kept for the duration required by tax and accounting law in our jurisdiction (typically 7 years).
• Server logs. 30 days, longer only if required for security-incident response.

Security

We use industry-standard security practices to protect your data: encryption in transit (TLS 1.2+), encryption at rest for all database and storage records, isolated row-level security so users cannot read each other's data, secret-management for API keys and credentials, mandatory HTTPS via HSTS, and a strict Content-Security-Policy on every page. Optional two-factor authentication (TOTP) is available from your account settings.

No system is perfectly secure. If we ever experience a data breach that affects your information, we will notify you within 72 hours of becoming aware of it, in compliance with applicable law.

Your rights

Regardless of where you live, you have the following rights:

• Access. See what data we hold about you. Available immediately from Account → Privacy.
• Correction. Update any inaccurate information. Most fields are editable from Account → Profile.
• Export. Download your project content in portable formats (.docx, .epub, .pdf, .md, .json) any time.
• Deletion. Delete any single project or your entire account from Account → Privacy → Delete account.
• Restriction and objection. Ask us to stop or limit specific processing of your data. Email [email protected].
• Withdraw consent for any optional processing (e.g., opt out of marketing email).
• Lodge a complaint with the data-protection authority in your jurisdiction.

GDPR (EEA & UK)

If you are in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation. The legal bases on which we rely for processing your data are: contract (to provide the service you signed up for), legitimate interest (to improve and secure the service), consent (for optional marketing), and legal obligation (for tax, accounting, and lawful requests). To exercise any of your rights or to inquire about our data-processing register, email [email protected].

CCPA / CPRA (California)

California residents have specific rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know what personal information we collect, the right to delete it, the right to correct inaccurate information, the right to opt out of any sale or sharing of personal information (we do not sell or share your personal information for cross-context behavioral advertising), and the right not to be discriminated against for exercising these rights. To make a CCPA request, email [email protected] with the subject “CCPA request.”

International transfers

Our service providers may store and process data in countries other than your own, including the United States. When we transfer data internationally, we use Standard Contractual Clauses or equivalent legal mechanisms approved by relevant authorities to ensure your data continues to receive an adequate level of protection.

Cookies and similar technologies

We use a small number of strictly-necessary cookies and local-storage entries to run the service: session cookies for authentication, a theme preference cookie so the page paints correctly on first load, a font-family preference cookie for the same reason, and a cookie that tracks whether you have completed the welcome flow. We do not use advertising cookies, behavioral tracking, or third-party analytics that set cookies. Our analytics (Plausible or Cloudflare Web Analytics) are cookie-free.

Children's privacy

WriteLoom is not intended for children under 13 (or under 16 in jurisdictions where that is the age of digital consent). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please email [email protected] and we will delete the account.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email and post a notice on the service at least 14 days before the change takes effect. The date at the top of this page reflects the last revision.

Contact

For any privacy question or to exercise any right described above, email [email protected]. For general questions, email [email protected]. We read every message and aim to reply within five business days.