Privacy

Storycrest is a place to write stories. This page says what it holds about you, why it holds it, who else sees it, and what you can ask us to do with it.

Who is responsible. Storycrest is run by Philip Carden, a New Zealander living in Haarlem in the Netherlands. "We" on this page means that; we are the data controller for everything described here. Write to privacy@storycrest.org with a question or any of the requests below.

Storycrest is in an invite-only beta. It is small, it is changing, and this page changes with it — see "Changes to this page" at the end.

What we hold, and why

Your account. Your email address, a username, a display name, and — if you add them — a picture and a short biography. Also the date you joined, whether your email has been confirmed, and the date you asked for access if you came through the waitlist. We hold this to give you an account and to show you to the people you write with.

How you sign in. If you set a password, we store a hash of it (Argon2), never the password itself. If you use Sign in with Google, we store the account identifier Google gives us, along with the email address, name and picture from your Google profile. See "Google" below.

Your account's history. A record of what happens to your account: how it was made (with a password, with Google, by the person who runs Storycrest, or from an invitation, which we name), each time you sign in or a sign-in fails, and changes to how you sign in, to your role and to whether you test new features. Each entry keeps the time, who made the change if it wasn't you, and the internet address and browser it came from. We hold this to keep your account secure, to look into anything that goes wrong with it, and to know how people come to Storycrest. Only the person who runs Storycrest reads it.

Emails about your account. We email your own address when it matters for your account's security: a link to reset your password when someone asks for one, a link to confirm your address, and a note when your password or email address changes or a way of signing in is added or removed (the email-change note goes to your old address, with a link to undo it). Nothing else, and never to an address that has no account. Each is sent by Amazon Web Services (Amazon SES), in the EU, with no tracking. We keep a record of each send — when, to which address, which kind, and whether it went — and clear the address from it after 90 days.

Checking a new password. When you choose a password, we check that it hasn't appeared in a known data breach, using Have I Been Pwned's Pwned Passwords service. We send it only the first five characters of a fingerprint (a SHA-1 hash) of the password, which hundreds of other passwords share, and do the comparison ourselves: neither the password, its whole fingerprint, nor anything about you is sent.

Your session. While you are signed in, your browser holds two tokens in its local storage. We keep no cookies for this, and none for tracking. Our server stores only a hash of the longer-lived token, so that a session can be ended without us holding the token itself. For each session we also keep when it began and was last used, how you signed in, and the internet address and browser it was last used from, so you can see where you are signed in and sign a device out, and so a stolen session can be noticed and ended. Your browser also keeps a random code of its own, made the first time it signs in, which names nothing about you and stays when you log out. It is sent when you sign in, and we keep only a hash of it with the session, so that signing in again from the same browser ends the session it had before rather than adding another. Each story you open and can write in is also kept in your browser's storage on that device — its text, its outline and its lists as you last saw them, and anything you wrote offline that hasn't reached us yet — so that it opens, and can be written in, with no connection. It stays on that device alone, and goes when you log out, when you can no longer write in the story, or 30 days after you last opened it there; writing that hasn't reached us stays until you choose what to do with it. Safari may clear a site's storage sooner, after seven days without a visit. Your browser also keeps the Library's list as it last was: the titles of your stories and of stories shared with you, and the names of the people who shared them, so the list shows with no connection. It is deleted when you log out.

What you write. Your stories, their scenes, earlier versions of them, the notes and waypoints you capture in the text, your pins, and the names you give things — together with who made each change and when. This is the product. We hold it to show it back to you, to carry it between the people you share a story with, and to let you go back to an earlier version. A story's dictionary is part of the story too: the words its writers add so that spelling stops flagging them, with who added each and when. Spelling itself is checked in your browser, against dictionaries it fetches from Storycrest: nothing you write is sent anywhere to be checked.

Research and context. The notes and sources you keep beside your stories (research), and what your work holds true (context): the text you write in them, a source's details (its title, authors, address and the like), any passages you quote from it, and what each is linked to — the paragraphs and scenes that use it, and the characters or places an entry is about. Each keeps a history: who added or changed it, and when, with the text as it then stood. Research and context belong to a universe, beside its stories, and each item remembers the story it was added from. We hold them as part of what you write: to show them back to you and the people you share with, to carry them in an exact copy and a Google Drive backup, and to keep each change attributed. What you keep may include other people's words or details about real people, as notes for a memoir or a piece of journalism might; you choose what to keep, and it is treated like the rest of your writing.

Looking up a link. When you paste a web address into research or a reference, Storycrest's server fetches that one page to read its title and details, so the website sees a request from Storycrest, not from you or your browser. A DOI is looked up at Crossref, as "Who else processes it" says. Nothing about you or your story is sent with either.

Where you left off. For each story you open, the place your caret was last: its scene, its paragraph and how far into it, and when. We hold this so the story opens there next time, on any device. It is yours alone: no one you write with sees it, and it goes when the story or your account does.

Which stories you have opened. For each story you open, when you last opened it. We hold this so Storycrest opens on the story you last had open, on any device, and so a story someone shares with you shows as new until you open it. We also hold when you last opened your Library, so its count shows only what has been shared since. It is yours alone, and it goes when the story or your account does.

What you have first done. The first time you do a few named things in Storycrest, we keep which thing it was and when. Today they are: that you have begun (you started a second paragraph, brought a file in, or took one of the other ways to start), and which of those other ways you took from a new writer's page: planning first, writing with someone, adding background or research, or reading how your work is protected. Each is kept once. We do not record a second time, or how often you do anything. We hold this so that a new writer's page folds away once you have begun, and stays folded on every device you use. It is yours alone, and it goes when your account does.

Notices of changes to this page and the terms. When this page or the terms of use change in a way that matters to you, Storycrest tells you in the app, in your notifications. For each such change we keep when it was first shown to you, when you opened it or marked it read, and, for the terms, whether and when you declined them or accepted them again. A decline and an acceptance are also kept in your account's history.

How you write. As you write in a story you can edit, we keep a tally of your own writing: in which scene, in which minute, how many words you added and removed, and how long you spent. We also keep the writing sessions you start, with the task you give each one. We hold this to show you your writing meter, your writing log and your week of writing. It is shown to you alone, not to the people you write with. If you set yourself targets — words a day, words for a story by a date, or what a session aims for — we keep each one with when you set it, so a day you met stays met if you raise the target later. We hold them to show you how close you are, in the meter and the log. How you like the page set is kept on your account too, if you change it: the theme, the size of the text, its width and its line spacing, how focus mode dims and scrolls, and whether spelling is checked. We hold these so the editor looks the way you set it, on any device. They are yours alone, and go when your account does.

If you tell word frequency to leave out words in a story, we keep that list for you, for that story, so it stays left out on any device. It is yours alone, and goes when the story or your account does.

Invitations. When a writer invites someone to a story by email, we hold the address they typed, the role they offered (coauthor, reviewer or reader), the note they wrote if any, who invited them and when, and what became of the invitation: waiting, accepted, declined, withdrawn or expired. We hold an address we were given by someone else only to send that one invitation; we do not add it to any list, send it anything else, or use it to give anyone access to a story. Access comes only from the invitation's link, opened by a person signed in to an account who chooses to accept it. We also keep a record of each send: when it went, to which address, and whether it was sent or failed. What the invitee is sent: their address, the inviter's display name, the story's title, the role, and the inviter's note. The inviter's display name and note are therefore seen by the person invited, and the email says who sent it and why. The email carries no tracking: we do not know whether it was opened or the link clicked. It is sent by Amazon Web Services (Amazon SES), in the EU.

Imports. When you import a file, we record the import: where the file came from, its name, a fingerprint (a SHA-256 hash) of its contents, the date you gave as the work's original date if you gave one, who imported it, and when. The file itself is not kept — its text becomes your story, and the upload is discarded. The record is there so a story can say where it came from.

While you review an import. While you review an import, what Storycrest read from your file is kept for 30 minutes at most, and deleted when you import, when you cancel, or within five minutes after the 30 are up; the file itself is not kept.

What the record says came in. The record also holds an account of what came in: what came in and how much; the title of each chapter and scene as it came in; each scene's length when it came in; what was left out and where; a sample line of each pattern found, and the text of any storytags left out; and each place that was in doubt, with your answer.

Set aside. Front matter set aside (a title page, a dedication, a copyright notice, an epigraph, a contents list, the pages after the story) is kept with the import's record. It may hold contact details. Anyone who can edit the story can read it. It is kept until you bring it in or delete the page, and otherwise as long as the story.

Characters and places. A list of characters and places is recorded with the universe it was added to.

Removing what came in. You can remove a story, a backstory, storytags or a list of characters and places that came in, from its record. A story or backstory is deleted, as a story you delete is, and only the person who made it can do that. Storytags it added are deleted. Characters and places it added are taken out of the universe's lists; any that has been described, or put in another category, since, or has a backstory or a pin, stays. If nothing has been written in what came in, removing it takes one press, and the person who removed it can undo it for 30 seconds. If something has, you are asked first, and there is no undo. A part that came into a story can be removed too, by the person who brought it in while she can still edit the story, or by an owner of it, with the same one press, question and undo: only the scenes that came in with it are taken out, and a scene or section that someone else added or moved inside it stays in the story where the part stood. What a removed part took out is kept, hidden, as a deleted story's scenes are: the scenes with their text, history, authors, comments and everything attached to them, and a copy of the part's lines in the outline, with the titles and synopses anyone wrote on them, so that undo can put them back. The scenes stay in the database, hidden, as long as the story; the copy of the lines is kept with the import's record as long as the story. A deleted story is kept, and removed from the database, as any deleted story is (see "How long we keep it"); as when you delete a story, its dictionary and writing targets are deleted with it. Deleted storytags are kept, hidden, as long as the story; a name taken out stays with its universe, out of sight, and comes back if anyone adds it again. Set-aside pages are kept as long as the story even when the import is removed, because until you bring them in they are the only copy of text that belongs to the story. You can delete a set-aside page on its own from the record, and it is then deleted from the database at once.

Exporting. Anyone who may edit a story can export it, for four purposes: to back it up, to send it to a reader, to take it to another tool, or to submit it. The file is made when you ask and handed to you; Storycrest does not keep it. A back-up's exact copy holds the whole story, including the comments other people made, with their display names and a key that means nothing outside the copy, and an editor may take one. A Word, Markdown or Google Doc file holds other people's comments only when the person exporting asks for them. A file for a reader, and a file for another tool, carry no author's name.

Restoring an exact copy. An exact copy can be imported as a new story, held by the person who restores it. A coauthor's comments and display name can therefore leave Storycrest in an exact copy an owner or editor takes, and come back in a story that coauthor cannot see; they gain no access to it and are not notified. Comments and storytags written by others come back under the name the copy gives them, marked "from a restored copy", and are never assigned to anyone. The history of a character or place a restore adds holds only the copy's id, a fingerprint of the file and whether Storycrest sealed it, and no name or address. An exact copy also carries the story's research and context, with each item's history and the names of who added and changed it, in the same way. Restored into the same universe, the items already there are used again rather than copied, so a change to one shows in both stories. Staging copies of production scrub a restored story's text and these names.

Submitting a manuscript. The byline and short title (and the surname used for the page head) are kept with the story, and anyone who can edit it can see and change them; the byline is the submission file's author. Your name, address and phone number are kept only in your browser, for you on that device, and are removed when you log out. They go to Storycrest only in the request that builds the file, and Storycrest neither stores nor logs them.

What Storycrest keeps for export. For each story you export, your own choices: which switches were on, and when each kind of file was last made. For a file sent to a reader as a Google Doc, which Docs were made for which chapters, so that a later export from any browser updates the same Doc. A back-up made as a Google Doc is a new Doc each time and is not remembered. Your choices and your Docs are yours alone: no one else is shown them.

AI, in a story where it has been turned on. Storycrest's AI is off for every story until its owner turns it on, for that story or for all their work. It comes in kinds, each with its own switch. So far there is one, the clerk: it finds each scene's beats as the story is written, and drafts a short summary of each. Only an owner can turn a kind on or off, and everyone who writes in the story can see whether it is on and who turned it on. We keep each answer a person gives about a kind, yes or no: whether it was for one story or for all their work, which story, which kind, who answered and when. We hold this so that a kind runs only where a person turned it on, so that an owner who said no is not asked again, and so that the people who write in a story can see who decided. When the clerk is on, the part of the story a task needs is sent to Claude, a model made by Anthropic, running on Amazon Web Services' Bedrock service. See "AI" below. For each request we record which story and scene it was for, which kind made it, whose writing or request led to it, whether it was made as the story was written or because someone asked, which model answered, how many words were sent, and how much text went each way, counted in tokens. We record none of the text itself. We hold this to see what AI costs to run, so that limits can be set fairly.

Feedback. While the beta runs, reporting a bug or asking for a feature stores what you wrote, the page you were on (the path only — never anything after a "?"), your browser's user-agent string, and which account wrote it. A bug report also carries what a crash record does: your last few minutes of steps in Storycrest, and the shape of the scene you were in with every letter turned into an x — but none of your words. The form says so before you send it. A feature request carries nothing more. We read these to fix the product. Each report gets a number, a status and, from us, a priority; we keep what happens to it (each change of status, our replies to you, anything you add to it) with the report. You can see your own reports, their status and our replies under Feedback › Your reports, and we tell you in Storycrest when one you sent is fixed or done. No one else sees your reports. The people who run Storycrest may read and sort reports with an AI tool, Claude, made by Anthropic: what it is shown is what you wrote, the page and browser it came with, its history and the steps described above, with you shown only as a short code, never your name or email address. It is shown none of your writing.

Crashes. When Storycrest breaks while you are signed in — a page that stops working, or one of our servers failing a request — we record what happened, so that we can find the fault and fix it. A record holds:

• when it happened, and which version of Storycrest was running;
• the page you were on (the path only), your browser's user-agent string, and which account it was;
• the error itself, with anything it quotes replaced by its length;
• your last few minutes of steps in Storycrest: the pages you went to, the requests your browser made and how they ended, when you came into a scene, and where in it you typed, by position and length;
• whether live editing was connected, and how many others were in the scene — never who;
• if a scene was open, its shape: its paragraphs and headings, with every letter turned into an x and every digit into a 0.

A crash record never holds your words — not your writing, a scene's title, a link or a name you typed. Your browser masks them before anything is sent, and our server checks again and refuses anything it can't be sure of. We record a crash without asking, because a fault we don't hear about can't be fixed. Only the people who run Storycrest see these records.

Server logs. Our hosts, Vercel and Railway, keep the ordinary logs a web server keeps: the address requested, the IP address it came from, the time, and the response. We use them to keep the site running and to find faults. Our own services add a line to those logs when something fails, with an id that joins it to the request it belongs to, and never what you wrote. How long they are held is set by those companies rather than by us, and it is short — hours at Vercel, which serves the website, and under a month at Railway, which runs the application and the database.

What we don't do. No advertising, no third-party trackers, and no tracking cookies. Typefaces are served from Storycrest itself, not from a font network, so visiting a page tells no one else that you did. We do not sell anything about you, and we share nothing for advertising.

What we do keep. Storycrest keeps a record of how it is used, from its own database, to see what works and to improve it. It keeps a history of how each work was written, which belongs with the work. A crash record is kept to find faults. What you have first done is kept once for each thing, and only where Storycrest itself reads it to decide what to show you.

Our legal basis for each of these

Under the EU GDPR, and under the UK GDPR where you are in the United Kingdom:

• Your account, your session, your writing (research and context included) and your imports — we hold these to perform our contract with you. Without them there is no account and no story.
• How you write — to perform our contract with you: it is what the writing meter and the writing log show you.
• Which stories you have opened — to perform our contract with you: it is what opens Storycrest on your story.
• What you have first done — to perform our contract with you: it is what stops Storycrest showing a new writer's page to someone who has begun.
• Notices of changes to this page and the terms — to perform our contract with you, and our legitimate interest in being able to show that we told you of a change and what you did about it.
• Exporting — to perform our contract with you: it is what lets you take your story out, and what makes the next export match the last.
• Server logs, password hashing, checking a new password against breaches, your account's history, and the record of who changed what — our legitimate interest in keeping the service running, secure, and accountable.
• Invitations — our legitimate interest, and the wish of the writer who invited them, in letting a writer share a story with a person they choose. The person invited can ask us to delete their address at privacy@storycrest.org. Accepting an invitation, once they choose to, is to perform our contract with them.
• AI — to perform our contract with the story's owner, who turns a kind on in order to have its work done. For anyone else who writes in that story, our legitimate interest in providing a feature the owner chose: they are told which kinds are on before they accept an invitation to write in it, are told again whenever a kind is turned on, and can ask the owner to turn it off. The record of each answer about a kind is kept under our legitimate interest in being able to show that AI ran only where a person turned it on.
• Feedback, and what a bug report carries with it — our legitimate interest in improving the product. Whether you write one is your choice.
• Crashes — our legitimate interest in finding and fixing faults. A record holds none of your writing, is seen only by the people who run Storycrest, and is deleted after 30 days.
• Importing from, and exporting to, Google Drive — your consent, given in Google's own window and withdrawable there or in your Google account.
• Backing up a story to your Google Drive — to perform our contract with you: you turn it on for a story you own, and turn it off in the story's settings or in your Google account. Other people's comments in a story you back up go with it, as they do in an exact copy; for them, our legitimate interest in giving a story's owner a complete copy of their work.

Who can see what you write

Your stories are private until you share them. Someone you add to a story can see that story; someone you add to a world (a "universe") can see the stories in it. Removing or lowering someone's access takes effect at once, including for anyone with the story open at the time.

Research and context follow the stories. An item can be seen by anyone who can read, at least as a reviewer, the story it was added from, a story that uses it, or its universe; readers of a story see none of it. Someone who can see an item only because a story they write in uses it is not told the title of a story they can't open, and items they can't see are shown to them only as a number, never by name. Only coauthors of the story an item was added from, and people with a role on its universe, can change or delete it.

The people who run Storycrest can reach the database. It is therefore technically possible for us to read what you write. We don't do this as a matter of course. It happens when you ask for help with something, when we have to fix a fault that involves your data, or where the law requires it.

Who else processes it

This is every company whose services Storycrest uses, with the country each one runs in.

Four of them process personal data on our behalf:

• Vercel (a United States company) — hosts the web app you are looking at. It serves pages from its own network, which runs in many countries, inside and outside the EU.
• Railway (a United States company) — hosts the API, the live-editing service that carries text between co-writers, and the database that holds your stories. All three run in the Netherlands (Amsterdam). Backups made before 6 October 2026 may still be held in the United States (San Francisco).
• Amazon Web Services (a United States company) — runs the AI model, only for stories where an owner has turned AI on (see below), sends the emails about your own account, and sends the invitation email when a writer invites someone to a story. The AI model is called in Germany (Frankfurt), and Amazon may route a request between Germany, Sweden, France, Italy, Spain and Ireland, never outside the EU. Email is sent from Germany (Frankfurt).
• Google (a United States company) — only if you use Sign in with Google, import or export a Google Doc, or back a story up to your own Google Drive. Google handles those on its own network, which runs in many countries. See below.

The others are sent nothing of yours, or nothing that says who you are:

• Cloudflare (a United States company) — holds our domain names, and forwards email that people send to us. It serves from its own network, which runs in many countries. It sees your message if you write to us, and nothing in your account.
• Have I Been Pwned (served through Cloudflare's network) — is sent part of a fingerprint of a new password, as "Checking a new password" describes, and nothing about you.
• Crossref (a United States organisation) — is sent a DOI when a writer pastes one into a reference, to look up the published work it names. Nothing about the writer or the story is sent.
• GitHub (a United States company) — holds Storycrest's own code. It holds none of your writing and nothing from your account.
• Anthropic (a United States company) — its tools help write Storycrest's own code, and the people who run Storycrest use its AI, Claude, to read and sort bug reports and feature requests, as described under "Feedback". It is sent none of your writing; from your account, only your reports, with you shown as a short code. The AI model that reads a story runs at Amazon, as above, not at Anthropic.

When we add a company or change what one does, we will change this list and say so under "Changes to this page". We keep a dated record of every such change, and will send it to you if you ask at privacy@storycrest.org.

Google

Sign in with Google is optional. You can use an email address and a password instead. If you do use it, Google tells us your Google account identifier, email address, name and profile picture, and we keep those as your account.

Importing a Google Doc. Storycrest asks Google for the narrowest access there is: drive.file, which covers only the file you yourself pick in Google's own picker. Your browser then exports that one document and uploads it to us like any other file. For an import the access token stays in the page: our servers never hold it, and never ask Google for anything else in your Drive. We keep the text that became your story, the import record described above, and, while you review the document, what Storycrest read from it, for 30 minutes at most and deleted within five minutes after that — nothing else.

Exporting to a Google Doc. If you export a story to Google Docs, your browser asks Google for the same drive.file access, fetches the exported file from us, and uploads it to your Drive, where Google turns it into a Doc. drive.file lets Storycrest reach only the Docs it made for you, which is what lets a later export update the same Doc. Today's Export pane remembers which Doc that is in your browser. The new Export remembers a reader's Docs with the story instead, not in your browser, so a later export from any browser updates the same Doc; a back-up made as a Google Doc is a new Doc each time and is not remembered. In both, for an export made by pressing a button, the access token stays in the page, and our servers never hold it.

Backing up to your Google Drive. The owner of a story can turn on a backup of it. Storycrest then keeps one more copy of the story in your own Google Drive, in a folder called "Storycrest backups": a Google Doc of the story, an exact copy, dated earlier copies, and a copy of each backstory of yours that the story uses. The copy is yours: it is in your Google account, in plain text, kept by Google under its terms with you and wherever Google keeps your Drive. It is not one of Storycrest's own backups of its data, and it will stay outside story encryption when that comes. It uses space in your Drive. Old earlier copies are moved to your Drive's bin; Storycrest deletes nothing there. Other people's comments go into the exact copy always, and into the Doc only if you turn that on.

To write there while you are away, Google gives our servers a lasting permission: drive.file, which reaches only the files Storycrest made or that you chose. We keep it encrypted, use it only for your backups, and give it up (delete it, and withdraw it with Google) when you turn off your last backup, when you stop being the story's owner, or when your account is closed. If Google does not confirm that it has withdrawn the permission, we keep the sealed token for up to 7 days after you turn the backup off, only to try again to withdraw it, and then delete it. Turning it off means Google will ask again the next time you send a story to Google Docs. With the permission we keep the address of the Google account, so that the story's settings can say which Drive the backup writes to. Storycrest's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI

Storycrest's AI reads; it does not write your story. It summarises and describes what you wrote. What the clerk produces, a scene's beats and their summaries, are notes about your story, shown as the clerk's. They are never part of its text, nothing it produces is put into your text, and anything it drafts stays marked as the clerk's until a person changes it.

It works as the story is written. Once the clerk is on in a story, a scene that changes is sent a little while after the writing in it pauses, so that the clerk can find where its beats fall and summarise them. A summary is redone only when its beat has changed by more than a little. When the clerk is turned on in a story that already has writing in it, each scene with no beats from the clerk yet is sent once, for its beats, and a writer can ask for a scene to be tried again if that fails. When it is turned on for all of a writer's work, that happens at once in the story they are in, and in each of their other stories when they next open it. The offer to turn it on says so. Reading a story, or opening its outline, never adds a request of its own.

It is off until an owner turns it on. Every kind of AI is off for every story until its owner turns it on. The clerk is offered once, to a story's owner, in the outline, where its beats would show, once there is enough written to read. The offer says what the clerk does, what it never does, and what turning it on sends. Yes turns it on for all of that person's work: every story they own, including stories they start or bring in later, and never a story someone else owns. They can instead turn it on for just the one story. No is kept too, and covers all their work in the same way: they are not asked again, and the switches stay in their account and in each story's settings. A story's own setting comes first: a story turned off on its own stays off when the clerk is turned on for the rest of its owner's work. A story with more than one owner is not covered by one owner's answer for their work, and is asked about on its own. Only an owner can turn a kind on or off, at any moment. Everyone who writes in the story can see whether it is on and who turned it on. They are told before they accept an invitation to write in it, and told again whenever a kind is turned on. Turning it off stops anything not yet sent. What the clerk has already drafted stays, marked as the clerk's. If the person whose answer turned a kind on stops being an owner of the story, their answer no longer covers it: the story follows its new owner's answer for their own work, and where they have given none, they are asked.

Stories that used AI before this change. A story whose owner turned AI on by hand keeps the clerk on. A story whose owner turned it off by hand keeps it off, and stays off if its owner turns the clerk on for the rest of their work. A story that had AI on only because new stories started that way is now off, and its owner is offered the clerk once, for all their work. Beats and summaries already found stay where they are.

Where it runs. Requests go to Claude on Amazon Bedrock in Frankfurt, through Amazon's EU route, which keeps each request within EU regions: Germany, Sweden, France, Italy, Spain and Ireland. Amazon processes it under its data processing terms and the EU's standard contractual clauses.

Nothing is kept, and nothing is trained on. Amazon Bedrock does not store what it is sent or what the model answers, and neither Amazon nor Anthropic trains a model on it. We only use models for which this is true. The model's answer comes back to us and is stored with your story, like anything else in it.

Where your data is held

The API, the live-editing service and the database run in Railway's EU West region (Amsterdam, in the Netherlands), so your account and your writing are stored in the EU. They have been since 6 October 2026; before then they ran in Railway's US West region (San Francisco), and backups of the database made before that date may still be held there. Vercel serves the web app from its own network, which reaches beyond the EU. Both companies are based in the United States, so if you are in the United Kingdom or the EEA, some of what they handle to run and support the service — the ordinary logs of a request, for one — may be processed outside it; where it is, that relies on the providers' standard contractual clauses. Requests to the AI model are processed in the EU, as "AI" describes. A Google Drive backup you turn on is a copy in your own Google Drive, held wherever Google keeps your Drive, outside Storycrest's EU storage.

How long we keep it

• Your account and your writing — until you delete them, or until you ask us to close your account, whichever comes first.
• A story you delete — hidden from everywhere immediately, and removed from the database 30 days later, so that a deletion can be undone or looked into in the meantime. That automatic removal is not running yet; until it is, a deleted story stays in the database, and we will remove it at once if you ask.
• Research and context — kept as long as its universe, like the stories in it, unless you delete it. An item deleted is hidden at once, and removed from the database with its history after the same window as a deleted story. When a story is deleted, an item added from it goes with it unless another story still uses it; then it stays, as part of that story's research. If you close your account, your research and context go as your writing does; where they live in a universe others write in, the history keeps the change but no longer names you.
• Session tokens — they expire on their own, and logging out revokes the refresh token at once. A session's record (when, how, the internet address and browser) is deleted 30 days after it ends or runs out, by a job that runs every day.
• The record of each email about your account — the address is cleared 90 days after it was sent, by a job that runs every day.
• Your account's history — kept as long as your account. The internet address and browser on each entry are cleared 12 months after it, by a job that runs every day.
• Stories kept in your browser — until you log out, can no longer write in the story, or 30 days after you last opened it on that device. Writing that hasn't reached us is kept until you choose.
• Which stories you have opened — kept as long as the story and your account, and deleted with either. The Library's list in your browser — until you log out.
• What you have first done — kept as long as your account, and deleted with it.
• Notices of changes to this page and the terms — kept as long as your account, and deleted with it.
• How you write — kept as long as the story it belongs to, and deleted with it or with your account. How you set the page is kept while your account is, and deleted with it. Your targets are deleted with the story they're for, or with your account.
• Words you've told word frequency to leave out — kept as long as the story, and deleted with it or with your account.
• A story's dictionary — kept as long as the story, and deleted with it. If you close your account, the words you added stay in the stories you added them to, since they are those stories' words, and no longer say that you added them.
• Import records — kept as long as the story they belong to, since they are what lets a story say where it came from. For characters and places, as long as the universe they were added to.
• A part you remove — hidden from everywhere at once. Its scenes stay in the database, hidden, and the copy of its lines is kept with the import's record, both as long as the story they belong to. Nothing removes them earlier.
• Set-aside text — kept with the import's record until you bring it in or delete the page, and otherwise as long as the story it belongs to. A page you delete is deleted at once.
• What Storycrest keeps for export — your choices for a story, your reader Google Docs for it, and the story's byline, short title and surname are kept as long as the story, and deleted with it. Your choices and your reader Docs are also deleted with your account; the byline, short title and surname stay with the story, as they are the story's. They are not deleted when you lose your access to a story: they stay, shown to no one else, and come back if you are given access again, until the story or your account goes. Your name, address and phone for a submission are kept only in your browser, until you log out.
• Your Google Drive permission for backups — while any backup of yours is on; deleted when the last is turned off, when you are no longer the story's owner, or when your account is closed. If Google does not confirm that it has withdrawn the permission, the sealed token is kept for up to 7 days more, only to try again to withdraw it, and then deleted.
• The record of a story's backup (which files in your Drive, when each was written, the address of the Google account) — as long as the story; deleted with it.
• What was read from a file while you review it — 30 minutes, then deleted within five minutes.
• Invitations — the address and the note while the invitation waits, and cleared 90 days after it is settled (accepted, declined, withdrawn, or expired and not sent again), by a job that runs every day. The address on the record of the send is cleared at the same time. Who invited whom, the role and what became of the invitation stay with the story.
• AI usage records — kept as long as the story they belong to, and deleted with it.
• Answers about AI — each yes or no about a kind for one story is kept as long as the story it is about, and deleted with it. Each yes or no for all of a person's work is kept as long as their account. An earlier answer is kept when a later one replaces it, and when the person who gave it stops being an owner, as the record of who decided.
• Feedback — kept while the beta runs, with its status, our replies and what you added to it, and deleted when your account is.
• Crashes — 30 days, then deleted automatically, and at once if your account is.
• Server logs — for our hosts' own retention periods.

Your rights

You can ask us to:

• give you a copy of what we hold about you, or send it somewhere else in a portable form;
• correct anything that is wrong;
• delete your account and what we hold with it;
• stop or limit some particular use of it;
• withdraw a consent you gave — for Google Drive, in your Google account, or by turning off a backup in the story's settings.

Write to privacy@storycrest.org. We will answer within one month. If you think we have got it wrong, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live.

Security

Passwords are stored as Argon2 hashes. Traffic to the site and the API is over HTTPS. The long-lived half of a session is stored as a hash, so a stolen database does not hand over live sessions. Access to the production database is limited to the people who run the site.

No system is proof against everything. If a breach affects your data we will tell you, and the regulator, as the law requires.

Children

Storycrest is not intended for children under 16, and we do not knowingly hold data about them.

Changes to this page

We will date every change here and keep the earlier versions. If a change matters to you — a new company processing your data, or a new use of what we already hold — we will tell you in the app, in your notifications.

• 2026-09-20 — first version.
• 2026-09-21 — exporting a story to a Google Doc, under "Google".
• 2026-09-29 — the tally of your own writing behind the writing meter and log, under "How you write".
• 2026-09-30 — AI that a story's owner can turn on, run by Amazon Web Services in the EU, under "AI"; Amazon Web Services added to "Who else processes it".
• 2026-10-01 — where you left off in each story, so it opens there, under "Where you left off".
• 2026-10-01 — what we record when Storycrest crashes, under "Crashes"; what a bug report carries, under "Feedback"; our own services' error lines, under "Server logs".
• 2026-10-01 — how you set the page, kept on your account so it applies on any device, under "How you write".
• 2026-10-01 — the word-count targets you set yourself, under "How you write".
• 2026-10-01 — a story's dictionary, and spelling checked in your browser with nothing sent anywhere, under "What you write"; whether spelling is checked, kept with how you set the page, under "How you write".
• 2026-10-01 — the stories you open kept in your browser, so they open and can be written in offline, under "Your session".
• 2026-10-01 — the words you tell word frequency to leave out, under "How you write".
• 2026-10-02 — AI that finds a story's beats as the story is written, not only when someone asks, under "AI"; AI used from the start in a story started from this date, with nothing sent until its owner has seen a notice in the story, while a story started before it stays off until its owner turns AI on, under "What we hold" and "AI".
• 2026-10-04 — which stories you have opened and when, when you last opened your Library, and the Library's list kept in your browser.
• 2026-10-04 — what Storycrest reads from a file while you review an import, kept for 30 minutes at most; the account of what came in; front matter set aside with an import, which may hold contact details and which anyone who can edit the story can read; and characters and places recorded with their universe, under "Imports" and "Importing a Google Doc"; how long each is kept, under "How long we keep it".
• 2026-10-05 — removing what came in, and what it does for each kind; that a removal with nothing written in it can be undone for 30 seconds; and that a set-aside page can be deleted on its own, under "Imports" and "How long we keep it".
• 2026-10-06 — exporting a story: what an exact copy holds, including other people's comments, and when other files hold them, under "Exporting"; the byline, short title and surname kept with a story, and the contact details kept only in your browser, under "Submitting a manuscript"; the choices and reader Google Docs kept for each writer and story, under "What Storycrest keeps for export" and "Google"; how long each is kept, under "How long we keep it".
• 2026-10-06 — restoring an exact copy as a new story: whose comments and names it can bring back, that nobody gains access or is notified, and what a restored name's history holds, under "Restoring an exact copy".
• 2026-10-07 — inviting someone to a story by email: the address and note we hold, the one email sent through Amazon SES in the EU, that the inviter's display name and note are sent to the invitee, and that the address and note are cleared 90 days after the invitation settles, under "Invitations", "Who else processes it" and "How long we keep it".
• 2026-10-08 — your account's history, with the internet address and browser of each entry kept for 12 months, under "Your account's history" and "How long we keep it"; checking a new password against known breaches with Have I Been Pwned, sending only part of a hash, under "Checking a new password"; the security emails about your own account, sent through Amazon SES in the EU, under "Emails about your account" and "How long we keep it". Each session's start, last use, sign-in method, internet address and browser, kept until 30 days after it ends, under "Your session" and "How long we keep it".
• 2026-10-10 — a correction: the API, the live-editing service and the database have run in the EU (Amsterdam) since 6 October 2026, where this page still said the United States, under "Where your data is held".
• 2026-10-10 — every company whose services we use, with the country each one runs in, where this page used to offer the full list on request, under "Who else processes it".
• 2026-10-11 — Storycrest now measures how it is used, from its own database only, to see what works and to improve it; no outside analytics service is used. There is still no advertising, no third-party trackers and no tracking cookies. Under "What we don't do" and "What we do keep", which replace "What we don't hold".
• 2026-10-12 — AI is off for every story until one of its owners turns a kind on, where before a new story used it from the start; the clerk, offered once, with a yes or a no that covers all of a writer's work, or a yes for one story; what happens to stories that used AI before, under "What we hold" and "AI". The record of each answer about a kind, and how long it is kept, under "What we hold", "Our legal basis" and "How long we keep it". A usage record now also keeps the scene, the kind and the number of words sent.
• 2026-10-19 — the first time you do a few named things, kept once each so that a new writer's page folds away on every device, under "What you have first done", "Our legal basis" and "How long we keep it".
• 2026-10-20 — backing a story up to your own Google Drive, and the permission our servers keep for it, with the address of the Google account, under "Google"; its legal basis, under "Our legal basis"; how long each is kept, under "How long we keep it"; withdrawing it, under "Your rights"; that the copy is held wherever Google keeps your Drive, outside Storycrest's EU storage, under "Where your data is held"; the sealed token kept for up to 7 days after a backup is turned off, only to retry withdrawing it, under "Google" and "How long we keep it".
• 2026-10-22 — what we keep about a report you send (its number, status, priority, our replies and what you add), seeing your own reports and being told when one is fixed, and the people who run Storycrest reading reports with Claude, made by Anthropic, without your name, under "Feedback", "Who else processes it" and "How long we keep it".
• 2026-10-23 — research and context kept beside your stories: what they hold, their history, who can see them and who can change them, and how long they are kept, under "Research and context", "Who can see what you write", "Restoring an exact copy", "Our legal basis" and "How long we keep it"; the page Storycrest's server fetches when you paste a web address, under "Looking up a link". Applies from 30 October 2026; until then, the earlier wording applies.
• 2026-10-23 — telling you of a change to this page or the terms in the app, in your notifications, where it used to say "and by email"; the record of each such notice shown to you, opened, marked read, declined or accepted, under "Notices of changes to this page and the terms", "Our legal basis" and "How long we keep it". Applies from 30 October 2026; until then, the earlier wording applies.
• 2026-10-24 — a random code your browser keeps and sends when you sign in, kept by us only as a hash with the session, so that signing in again from the same browser replaces its earlier session, under "Your session". A correction: it is for the same purpose as the rest of your session, and nothing new is used.
• 2026-10-25 — Storycrest is for people aged 16 and over, where this page said 13, under "Children". Nothing new is held or processed.

Contact

privacy@storycrest.org