Privacy Policy

EroticWriter is run by its operators ("we", "us"), who decide how the personal data described in this policy is used and are responsible for it.

For anything in this policy, write to [email protected].

We hold four kinds of data, and no more than we need for each.

• Account data — your email address, a cryptographic hash of your password if you set one (never the password itself), the identifier Google gives your account if you sign in with Google, and a record of which version of the Terms you accepted and when. From Google we receive only that identifier and the email address — not your name, your photo or anything else on your Google account.
• The work you author — your universes, character bibles, world facts, stories, and the individual beats those stories are built from, together with the keyword triggers you attach to entries.
• Session data — a record of each active sign-in so that you and we can end sessions one at a time, including the browser and operating system it was created from. We do not store the network address it came from, so we cannot tell you a location and neither can we tell anyone else.
• Technical data — server logs containing IP addresses, timestamps, request paths, the internal identifier of the signed-in account where there is one, and error traces, kept for security and debugging. These logs never contain the text you write or the directions you give the model.

We do not buy data about you, we do not build advertising profiles, and we do not ask for anything about your identity beyond an email address.

Account data, your work and session data are processed to provide the service you asked for — that is, to perform our contract with you.

Technical data is processed on the basis of our legitimate interest in keeping the service available and free of abuse, balanced against the fact that it is the minimum needed for that purpose and is short-lived.

Where we retain or disclose data because the law requires it — see "Legal disclosure" below — the basis is compliance with a legal obligation.

Visit statistics, described below, are processed on the basis of our legitimate interest in understanding how the site is used, limited to what that needs: they never include what you write.

We do not rely on consent for anything necessary to run the service, so there is no consent for you to withdraw and no feature that turns off if you decline something.

Your work is yours. We process it for exactly two purposes: to store it so it is there when you come back, and to assemble the context sent to the model when you ask for a generation.

We do not use your work to train models, we do not licence it to anyone, and we do not read it. Nothing you write is published or shown to another writer, and no one here reviews it to judge it against the Content Policy — that is done by a classifier as you write, and nothing after it looks at the result. The one exception is a valid legal demand for a named account.

You can export any story as DOCX or PDF at any time, without asking us and without losing anything in the process.

Generating text means sending text to a model. This is the most significant disclosure in this policy, so it is set out in full.

Our model provider is Featherless.ai, a Delaware limited liability company. It publishes no postal address in its terms or its privacy policy, and it does not state where its servers are; what it does state is that it does not transfer personal data internationally.

When you ask for a generation, we send the text needed to produce it: your prompt, the story text it continues, and the lorebook entries whose keyword triggers matched — the character bibles and world facts described on this site as being injected into context. We do not send your name, your email address or your account identifier.

On retention, its documentation states: “Featherless does not log chats, prompts, or completions sent through our API” and “Requests made via the API are processed in real time and are not stored on our servers.” Its privacy policy states: “We do not collect or store prompts or completions.”

The same policy sets out what it does keep: “information regarding model usage to improve discoverability (i.e. # prompts, tokens in and tokens out)”, and “sampler settings so as to provide guidance to new users on what sampler settings are known to work well”. Neither its terms nor its privacy policy says anything either way about training on user data, so this page does not say that it does not.

Those are the provider's representations about its own service; they are not guarantees we are able to give on its behalf.

It names two third parties of its own: “analytics services (like Posthog)”, and Stripe, which processes its payments. Neither is described as taking any part in generation. Their handling of data would be governed by its policy rather than this one.

Every generation goes to that provider today. Machines of our own, rented in the United States or Canada, are prepared for this work and the move remains open. Served that way the text would reach a machine under our control and no third-party model service would see it, but the machine itself would belong to the marketplace we rent it from — that operator would take the place of the model provider in this disclosure rather than removing it. This section is rewritten, and dated, in the same change that moves the work.

Besides the model provider, the following service providers process data on our behalf and only on our instructions:

• Hosting and database — servers we rent and run ourselves. The database runs on them; no outside database service holds your data.
• Network delivery and protection — Cloudflare, Inc., United States. Every request to the site passes through it, including your IP address, so that it can deliver the site and protect it from attack.
• Account email such as password resets and confirmations — Twilio SendGrid, United States. It receives your email address and the message we send you.
• Sign-in with Google, only if you choose it — Google LLC, United States. Google learns that the Google account you picked signed in to EroticWriter, and when. Signing in with an email address and password involves Google in nothing.
• Visit counts — Cloudflare Web Analytics, as above. It receives the page you opened, the page that sent you, your browser and your approximate location.
• Visit counts in more detail — Google Analytics, Google LLC, United States. It receives the pages you open, the page that sent you, your browser, device and approximate location, and a few events such as creating an account, and it sets cookies to recognise your browser when you come back. Its advertising features are switched off.

Both run on every page, signed in or not, and neither receives the text you write, the titles of your stories or universes, or the names of your characters. The address of a page that shows your work holds only an internal number, and Google is given a generic name for such a page in place of the title your browser shows. We do not use advertising providers. If that changes, this list changes first.

Generation involves a transfer to the United States, because the model provider is a United States company. Where you are in a jurisdiction that restricts such transfers, we rely on the standard contractual clauses approved for that purpose, together with the retention restrictions described above.

Cloudflare, Twilio SendGrid and Google, listed in the previous section, are United States companies too, and the same safeguards apply to them.

Your account data and your work are kept until you delete them. Deleting a story, character or universe removes it from the service; deleting your account removes all of it, together with your account record.

Sessions are removed when they end or expire. Technical logs are kept for 30 days and then discarded.

Deleted data can persist in backups for up to 14 days before those backups age out. We do not restore deleted content from backups on request.

Two things survive a deletion request, because they must: records we are required by law to keep, and data we have received a valid legal request to preserve, for as long as that request requires.

Passwords are stored only as hashes, computed with a slow, salted algorithm designed for the purpose. We could not tell you your password if you asked.

Sessions are held server-side and can be revoked individually, so signing out actually ends a session rather than discarding a token locally. Your account page lists every device you are signed in on and ends any of them, including all of them but the one you are reading this on.

Traffic between your browser and the site is encrypted.

Nobody here can read your work through the product. The administrative screens list accounts and act on them; no screen anywhere opens a story, a character or a universe belonging to somebody else.

What is done to an account is on the record: a block, or a change to the staff rights on an account, is written down with who did it and the reason for it, and the reason is required rather than optional.

No system is perfect. If a breach affects your data, we will tell you and the relevant regulator within the time the law allows, and we will tell you what we know rather than waiting until we know everything.

Wherever you are, you can ask us to do the following, and we will answer within 30 days.

• See what we hold about you, and get a copy of it.
• Take your work elsewhere — story export is built into the product, so you do not need to ask.
• Correct anything inaccurate.
• Delete your account and everything in it, subject to the two exceptions in "Retention and deletion".
• Object to, or ask us to restrict, processing based on our legitimate interests.

Write to [email protected]. We will not charge you, and we will not make you explain why. If you are in the EU or UK and think we have got it wrong, you can also complain to your national data protection authority.

We set one cookie of our own: the session cookie that keeps you signed in. Signing in with Google adds a second for the few minutes it takes, which proves that the answer coming back from Google belongs to the sign-in you started, and is deleted when you return. Both are strictly necessary, so they do not require your consent.

Google Analytics sets its own cookies, whose names begin with _ga and which last up to two years. The site works exactly the same without them: you can block them in your browser settings or with Google's opt-out browser add-on. Cloudflare Web Analytics sets no cookie. We do not use advertising cookies or tracking pixels.

EroticWriter is for adults. You confirm you are 18 or older when you create an account, and we do not knowingly hold data about anyone younger.

If we learn that an account belongs to someone under 18, we close it and delete the data, except anything we are required to retain.

We disclose data to authorities where valid legal process requires it, and we require an instrument that is valid and specific before doing so. Where we are permitted to tell you that your data has been requested, we will.

We also make any report the law requires of us. Where notification is prohibited or would prejudice an investigation, we do not notify the account.

If we change this policy in a way that affects you, we will tell you by email and show a notice in the product before the change takes effect. Minor corrections are made without notice, and the date at the top changes when anything does.

Privacy questions, requests and complaints, and legal notices: [email protected]. Reports of prohibited content: [email protected].