Privacy notice

The short version

Your manuscript is yours. We do not sell it, we do not use it to train anyone's AI models (see our AI pledge), and we do not read it except when you ask us to help with a specific problem and give us permission to look.

Your work is stored with Google Firebase so it can reach your other devices. Payment is handled by Stripe, which never shows us your card number. Nothing else receives your data unless you start an action that needs it, such as sharing a chapter by link.

Anything below that is unclear, or any request about your data, goes to [email protected].

Our AI pledge

No AI reads your manuscripts. Author Sweets has no AI features today. Nothing in the app sends your words to a language model, and nothing rewrites, summarises or suggests. The style check runs on your own device and sends nothing anywhere.

Your manuscripts will never train an AI model. We will not use your books, notes or files to train or improve any model, ours or anyone else's, and we will not let any company we work with do so. This holds on every plan, including any AI features we add in the future.

If we add AI features, they will be optional, they will run only when you start them and only on the text you choose, and they will use a provider whose contract forbids training on what it receives. We will announce them here and in the product before they arrive.

Who is responsible for your data

Author Sweets is operated by ProductSeal of Torrance, California, USA. For data-protection purposes that operator is the controller of the personal data described here.

Contact us about anything in this notice at [email protected]. We answer privacy requests at that address; you do not need to use a form.

What we collect

• Account data: the email address you sign up with, or the identifier your sign-in provider returns, plus the display name, avatar and preferences you set.
• Your content: books, chapters, scenes, outlines, characters, places, notes, uploaded files, versions, share links, reader comments and exports. They are stored so we can show them back to you and sync them across your devices.
• Subscription data: your plan, its status and its renewal dates, and the Stripe customer and subscription identifiers that tie them to you. Card numbers are handled by Stripe and never reach our servers or your browser storage.
• Technical data: the requests your browser makes to us, including timestamps, coarse device and browser information, and error reports. Error reports carry a reference and a stack trace, not your manuscript text.
• Reader data: when someone opens a chapter you shared, the name they type beside a comment and the comment itself. Readers do not create accounts.
• Support correspondence: what you write to us, and what we write back.

Why we use it, and on what basis

• To provide the service you asked for: storing and syncing your work, running the tools you open, keeping your session signed in and producing the exports and share links you request. Where the UK and EU GDPR apply, the basis is performance of our contract with you.
• To keep the service working and safe: rate limits, plan limits, abuse prevention, backups and diagnosing errors. The basis is our legitimate interest in a service that stays up and is not abused.
• To take payment and meet tax and accounting obligations. The basis is performance of the contract and our legal obligations.
• To send service messages you cannot opt out of: a receipt, a security notice, a change to these terms. We do not send marketing email.

We do not use your content to train AI models, and we do not permit our providers to; see our AI pledge.

Who else processes your data

• Google Firebase (Google LLC): sign-in, database, file storage and the server functions that run exports, share links and billing. This is where your account and your books live. Firebase App Check, built on Google reCAPTCHA Enterprise, checks that requests come from the real app and not from a script.
• Stripe, Inc.: subscription checkout, the billing portal and payment records. Stripe receives your email address and payment details directly; we receive the subscription status and identifiers.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Where your data goes

Our infrastructure runs in Google Cloud's United States regions, so data is processed in the United States regardless of where you are. For transfers out of the UK or EEA we rely on the providers' Standard Contractual Clauses and the UK Addendum, as published by Google and Stripe.

How long we keep it

• Account content is kept while your account exists, because it is your working library. Deleting a book moves it to the trash, from which it can be restored; emptying the trash removes it and its files. Deleting your account removes the books, files and account record we hold for you.
• Billing records are kept as long as tax and accounting law requires, typically several years, even after an account closes.
• Error and request logs are short-lived operational records, not an archive of your writing.
• Google and Stripe keep their own records under their own policies; where a deletion needs a step on their side, we take it.

Your rights

Wherever you are, you can ask us for a copy of your data, ask us to correct it, ask us to delete it, or ask us to stop a particular use. The app covers most of this itself: Download my data and Delete account are on the Account page, and the help page explains both.

If the UK or EU GDPR applies to you, you also have the rights to restrict or object to processing, to portability, and to complain to your supervisory authority; in the UK, the Information Commissioner's Office.

If you are a California resident, you have the rights to know, delete and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information as the CCPA defines those terms.

Ask at [email protected]. We will verify that the request comes from the account holder before acting on it, and answer within the period the applicable law allows.

Security

Access to your data is enforced by server-side security rules, not by the interface. Traffic is encrypted in transit, and the credentials our servers use are held in Google Secret Manager rather than in the application.

No service is immune. If a breach affects your data we will notify you and the relevant regulator as the law requires. To report a vulnerability, write to [email protected].

Children

Author Sweets is not directed at children under 13, and we do not knowingly collect their personal data. Where local law sets a higher age for consent to online services, that age applies instead. Tell us if a child has created an account and we will remove it.

Cookies and local storage

We set no cookies of our own. Your browser stores what keeps you signed in, your theme choice, and a copy of your books so the app works offline; these are necessary for the service to function and are not used to track you. Google reCAPTCHA Enterprise, which protects sign-in and the server from automated abuse, may store an identifier of its own under Google's privacy policy. There is no analytics or advertising tracking.

Changes to this notice

We will change this notice as the product changes. The date at the top always reflects the current version, and a change that materially affects how we handle your data will be announced in the product before it takes effect.