Privacy Policy | writefolio

Introduction

This privacy policy ("Policy") describes how the personally identifiable information ("Personal Information") you may provide on the writefol.io website ("Website" or "Service") and any of its related products and services (collectively, "Services") is collected, protected and used.

It also describes the choices available to you regarding our use of your Personal Information and how you can access and update this information. This Policy is a legally binding agreement between you ("User", "you" or "your") and writefolio, Inc., a Delaware corporation that operates the Website ("writefolio", "Operator", "we", "us" or "our").

By accessing and using the Website and Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy. This Policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.

Who is responsible for your information

The data controller for the purposes of the UK and EU General Data Protection Regulation is writefolio, Inc., a Delaware corporation that operates writefol.io, at:

writefolio, Inc. 1100 Gorham St., Suite 1B, Lowell, MA 01852, United States hi@writefol.io

Children

The Services are for adults. You must be at least 18 to use them. We do not knowingly collect Personal Information from anyone under 18. If you believe a child has given us their information, write to us and we will delete it.

Automatic collection of information

When you open the Website, our servers automatically record information that your browser sends. This data may include information such as your device's IP address, browser type and version, operating system type and version, language preferences or the webpage you were visiting before you came to the Website and Services, the campaign or referral tags carried by a link you followed to reach us (such as a link in an advertisement or in one of our emails), pages of the Website and Services that you visit, the time spent on those pages, information you search for on the Website, access times and dates, and other statistics.

We use information collected automatically to operate and secure the Website and Services, to identify potential cases of abuse, and to understand in aggregate how the Website and Services are used. Where the relevant category is enabled, we also use it for the analytics, attribution and advertising described under Cookies and similar technologies. We do not use it to identify you in the statistics we produce.

Diagnostic traces. We may also keep a detailed record, a "diagnostic trace", of a sample of the requests made to the Services and of the tasks the Services carry out in the background. A trace describes how the request or task was handled: when it happened, how long it took, which part of the Services handled it, whether it succeeded and, if it did not, the type of error. It may also include the technical information described above, such as your IP address, your browser type and the address requested, and, if you are signed in, the identifier of your account. We use diagnostic traces only to find and fix errors, to keep the Services fast and reliable, and to investigate security incidents. We keep them in our own storage with our hosting provider, which holds them on our behalf; only authorised members of our team can read them; and we delete them automatically after thirty days. We do not use them for advertising or to build a profile of you, and we do not sell them or share them for advertising.

Collection of personal information

You can access and use the Website and Services without telling us who you are or revealing any information by which someone could identify you as a specific, identifiable individual. If, however, you wish to use some of the features on the Website, you may be asked to provide certain Personal Information (for example, your name and e-mail address).

In addition, if you link your Google or Facebook account, or accounts from other third-party services, we also get information from those accounts. The information we get from those services depends on your settings and their privacy policies. From Google or Facebook, we receive only an identifier that is unique to your account with that provider, your email address, and the name on your account with that provider; we do not receive contacts, friends, or any other information. We receive and store any information you knowingly provide to us when you create an account, or fill any online forms on the Website. When required, this information may include the following:

Personal details such as name, country of residence, etc.
Contact information such as email address, address, etc.
Account details such as user name, unique user ID, password, etc.
Any other materials you willingly submit to us such as articles, images, feedback, the passages you save from stories you read, etc.

You can also join our mailing list without creating an account. When you do, we collect your email address together with information about how you joined, such as the page you joined from and your language, as described under Our mailing list.

If you ask us to advertise your work, we collect a phone number and, for advertising shown in the European Economic Area, your legal name, as described under Advertising your work.

Today, we collect Personal Information directly from you; from the sign-in provider you choose if you link a Google, Facebook or single sign-on account; from an app you connect to your account, which acts on your behalf, as described under Apps you connect to your account; and from other users of the Services who give us your email address or name — for example, a writer who invites you to a project or brings a list of their existing readers, as described under Disclosure of information.

We may in future obtain information about you from other sources, such as public databases, analytics partners, or marketing partners we work with. We do not do this today. If we start, we will update this Policy first, and we will tell you what we obtained, which categories it falls into, and where it came from.

Use and processing of collected information

In order to make the Website and Services available to you, or to meet a legal obligation, we need to collect and use certain Personal Information. If you do not provide the information that we request, we may not be able to provide you with the requested products or services. Any of the information we collect from you may be used for the following purposes:

Create and manage user accounts
Send administrative information
Send you email about the Services, your stories and the stories you read, and our mailing list if you join it, as described under Email from us
Run the advertising campaigns you ask us to run, contact you about them, and report their results to you
Respond to inquiries and offer support
Improve products and services
Request user feedback
Improve user experience
Enforce terms and conditions and policies
Protect from abuse and malicious users
Diagnose and fix errors, and keep the Services reliable and secure
Respond to legal requests and prevent harm
Run and operate the Website and Services

Our legal basis for using your information

If you are in the UK or the European Economic Area, we must have a legal basis for each thing we do with your Personal Information. Ours are:

Performance of a contract — running your account, storing and syncing your projects, processing the AI requests you make, carrying out the requests of an app you connect to your account, taking subscription payments, running the advertising campaigns you ask us to run (including contacting you about a campaign we are reviewing, and giving your legal name to the advertising platform where the law requires the platform to publish it), and providing support. Without this information we cannot provide the Services.
Legitimate interests — keeping the Services secure and reliable, diagnosing and fixing errors, investigating security incidents, detecting and preventing fraud and abuse, understanding in aggregate how the Services are used so we can improve them, reporting to writers in aggregate how their advertising campaigns perform, calling writers who advertise with us to help them get more from their campaigns and to tell them about related offers, sending account holders email about the Services and the stories they write and read, including using their reading activity on the Services to decide which of those emails to send and in what form, as described under Email from us, and recovering amounts owed. We balance these against your interests, and you can object at any time using the contact details below. Where the interest is sending you marketing email, your objection always prevails.
Consent — analytics, attribution, and advertising measurement and delivery, as described under Cookies and similar technologies; inclusion in an advertising audience, as described under Disclosure of information; and our mailing list, if you join it. You can withdraw consent at any time, and doing so does not affect anything done before you withdrew it.
Legal obligation — keeping tax and payment records, and responding to lawful requests from authorities.

Email from us

We send email through service providers that send it on our behalf.

Account and service email

If you have an account, we send you the email we need to provide the Services: sign-in and verification codes, password resets, invitations, receipts, payment notices, and other messages about your account, your subscriptions and the security of the Services. These are part of the Services, and you cannot unsubscribe from them while your account is open.

Email about your stories and the Services

We also send account holders email about the Services and the stories on them: tips on using the Services; news about your own stories, such as your first reader or a chapter going live; an email when a story you subscribe to releases a new chapter; and a newsletter built around your stories and the stories you read, which may also feature posts from our blog, new writers and other parts of the Services. We send this email by default, relying on our legitimate interest in keeping you informed about the Services you use, the stories you subscribe to, and similar services we offer. Where the law requires it, we give you a chance to refuse this email when you create your account.

How we decide what to send. To decide which of these emails to send you and in what form, we use information about your activity on the Services, such as which chapters of a story you have read and when you last signed in. For example, if you are several chapters behind in a story, we may send you a version of a new-chapter email that helps you catch up, and if you have stopped reading a story, we may stop sending you its new chapters. We do not use cookies or tracking pixels for this, and we do not track whether you open our emails.

Links and delivery. Links in our emails identify the email they came from, so that we can see which emails lead people to the Services, as described under Automatic collection of information. Our email provider tells us whether each email was delivered and whether it was returned or reported as spam; we use this to stop sending to addresses that cannot receive our email or whose owners have reported it.

Stopping this email. Every such email states who it is from and how to contact us, and lets you stop that kind of email or unsubscribe from all of it; an email about a story also lets you stop email about that story. You can also change these choices in your account settings or by writing to us at the address below. Stopping this email does not affect the account and service email described above.

Your right to object. You have the right to object at any time, without giving a reason, to our use of your information to send you marketing email, including our use of your reading activity to decide what to send. If you object, or unsubscribe, we stop sending you the email concerned.

Our mailing list

You may also join our mailing list without an account, for example from a post in the Archive. We send it only because you asked us to. We use the information you give us when you join to send you the posts and updates you signed up for, and to understand which parts of the Website lead readers to join. We do not disclose your email address to third parties, except to the service providers that send email on our behalf and as described under Disclosure of information and Cookies and similar technologies.

Every email we send to the list states who it is from and how to contact us, and includes a way to unsubscribe. You can also leave the list at any time by writing to us at the address below. Leaving the list does not change the email you receive as an account holder, which you manage as described above.

Advertising your work

If your plan includes it, you can ask us to advertise a story you have published. We run these campaigns on our own accounts with advertising platforms — Meta (Facebook and Instagram) and, where we make it available, TikTok — as described in our Terms.

What we collect, and why. When you submit a campaign, we collect a phone number. Our team reviews every campaign before it goes live, and we use the number to contact you about your campaign — while we review it, and afterwards to help you get the most out of it, which may include telling you about offers relating to the Services. For a campaign shown in the European Economic Area, we also collect your legal name. Giving us the phone number, and your legal name where it applies, is a requirement of submitting a campaign; without them we cannot run it. You can tell us at any time that you do not want calls about offers, and we will stop making them.

Who receives it. Our team sees both. The advertisement itself — built from your story's cover, its public details and a line of text — goes to the platform that runs it. For a campaign shown in the European Economic Area, we also give the platform your legal name as the person on whose behalf the advertisement is presented, because the EU Digital Services Act requires the platform to disclose that person. The platform makes the name available to people who see the advertisement and publishes it in its public library of advertisements for as long as the law requires. The platform's use of what it receives is governed by its own privacy policy. We do not give the platform your phone number.

What you see. We show you each campaign's delivery and how many readers it brought to your story and how far they went, as totals. See Disclosure of information for what readers are told about this.

Where your information goes

We are based in the United States, and our hosting, payment, email, analytics, and AI model providers, and the advertising platforms we use, are located there and in other countries. If you use the Services from the UK or the European Economic Area, your information is transferred outside your country.

Where we make such a transfer, we rely on an appropriate safeguard permitted by data protection law, which for our providers is the European Commission's Standard Contractual Clauses together with the UK Addendum, or the provider's certification under the EU-US Data Privacy Framework where they hold one. You can ask us which safeguard applies to a particular provider by writing to the address below.

AI features and model providers

The Services include AI features, including features that generate images and video. When you use one, we transmit the relevant part of your project — the text concerned, any passages or notes it references, your instructions and, where the feature works from them, images or video from the project — to a third-party model provider, which generates a result and returns it to us.

The providers that receive this content are OpenAI, Anthropic, xAI and Google. For text, you select which model processes each request, and the provider of that model is the recipient for that request. Images are generated by OpenAI and video by Google. We will update this list before we make a further provider available.

We do not use your writing to train AI models and we do not permit the providers to do so. Each provider we make available is bound not to use content submitted through its interface to train its models. A provider may retain that content, and what it generates, for a limited period under its own terms — for example, to complete a request that takes time to process, and to monitor for security and abuse. We do not sell, license, or otherwise disclose your writing to any person for the purpose of training a model.

For each AI request we keep a record of its use — the project concerned, the model used, the amount consumed and its cost, and whether it succeeded. That record does not contain your prompt or the generated text. Generated text is stored in your project and you may edit or delete it as you may any other content. A generated image or video is stored with your project together with the description and instructions it was generated from, so that you can review and reuse them; how long we keep them is described under Retention of information. An image or video you place in a published story is shown only to the readers who can read that part of the story.

AI output is produced by a statistical model and can be inaccurate. It is a suggestion for you to accept, revise, or discard. These features make no automated decision that produces a legal effect for you or similarly significantly affects you.

Apps you connect to your account

You can connect an outside AI app to your account: an assistant such as Claude, provided by Anthropic, or ChatGPT, provided by OpenAI, which you approve by signing in to writefolio from that app; or a developer tool you set up with a personal API key you create in Settings › API keys. A connected app acts on your behalf, and it can reach only what your own account can reach.

What a connected app can do. A connected app can read and search the projects in which you can write — your own, and those other people have shared with you as a co-author or editor — including their chapters, notes, knowledge documents and story facts. It can create and rename projects, documents, chapters and plugins; save story facts; accept or reject suggestions; and run plugins, which use our AI features as described above and consume your credits as if you had run them yourself. It cannot run plugins that generate images or video. An app you approve by signing in also receives your account details, such as your name and email address. You decide what to ask a connected app to do.

Where your content goes. What a connected app reads from the Services goes to the company that provides the app, which handles it under its own terms and privacy policy, not this Policy. We do not control what that company does with it, including how long it keeps it or whether it uses it to train models. The commitments above about our model providers apply to the AI features we run; they do not apply to an app you connect, even where the app comes from one of those providers. A shared project may contain other people's work, and a connected app can read it as you can.

What we keep. Changes a connected app makes are saved to your project like your own, and the notes it gives us about what it did are kept with the project. We record each request it makes as activity on your account — which app made it, what it asked to do, and whether it succeeded — and keep that record as usage information, as described under Retention of information. We receive only the requests the app sends us, not your conversation with the app. We keep a record of each app you approve and of when you revoke it.

Disconnecting. You can revoke an app's access at any time in Settings › API keys › Connected apps. You can stop a developer tool by replacing your API key there, which stops the old key from working. Closing your account ends every connection. Revoking access stops the app's further access to your account; it does not recall what the app has already received, which you can ask its provider to delete.

Disclosure of information

Depending on the requested Services or as necessary to complete any transaction or provide any service you have requested, we share your information with the trusted third parties, affiliates and subsidiaries we rely on to operate the Website and Services. These are the service providers that process information on our behalf — the model providers described above, our hosting, payment, and email providers, and, where the analytics category is enabled, the analytics provider described under Cookies and similar technologies, which acts on our behalf except as described under Google advertising features. Beyond them, the advertising platforms described under Cookies and similar technologies (including Google, for the advertising features described there) and Advertising your work, the apps you direct us to give access to, as described under Apps you connect to your account, and the recipients described below, we do not share Personal Information with unaffiliated third parties, and we do not sell it for money. Some US state laws give "sell" and "share" a wider meaning; see Advertising choices in the United States.

Advertising audiences. We may include a hashed version of your email address in an advertising audience provided to Meta (Facebook and Instagram) or TikTok, to help writers on the Services reach readers like you. We do not provide any such audience yet. When we begin, the platforms will use it only to find other people who resemble the group; you will not be shown the advertisement; your name and what you read will never be included; and no audience will be provided until it contains at least one hundred people.

Whether your account is included depends on where you create it:

In the UK or the European Economic Area, your account is included only if you choose it — by ticking Help writers find readers like you on the sign-up form, or by turning it on later in Settings → Privacy. Where we cannot determine where you are, we apply this rule.
Elsewhere, a new account is included by default, unless, when you create it, your browser sends a Global Privacy Control signal or you have declined advertising in our cookie settings.

You can turn this off at any time in Settings → Privacy. Turning it off removes you from every audience within a day, and closing your account removes you immediately.

What a writer can see about their readers. A writer can see the email address of anyone who subscribes to their project, or whom they have given access to. This is the same information a writer would have if you subscribed to them anywhere else, and it is visible only to people who can manage that project.

Advertising campaigns run by writers. If you reach a story through an advertisement its writer runs through the Services, we record which campaign brought you. The writer sees that campaign's results as totals — how many readers it brought to the story, how far they read, and how many followed or subscribed — not which readers they were. Writers do not receive the information we send to advertising platforms, described under Cookies and similar technologies.

Reader lists a writer brings with them. A writer can upload a list of their existing readers — typically exported from another publishing platform — so those readers keep their access here without paying twice. We receive only each reader's email address and name; nothing else in such a list, such as a postal address or phone number, is collected. We never send email to an address on one of these lists: they are used only to match a reader who signs up here of their own accord.

If you participate in our affiliate program, we share your PayPal email address and your payout amount with PayPal in order to deliver your monthly commission payout. Where the law requires us to report affiliate income (for example, issuing a US 1099 form), we may share the details required for that reporting with a tax-compliance provider.

We will disclose any Personal Information we collect, use or receive if required or permitted by law, such as to comply with a subpoena, or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Cookies and similar technologies

We store information on your device and access information stored on it. Some of this is strictly necessary to provide the Services you have requested: your authenticated session, the security tokens protecting it, your interface preferences, and the device identifier described below. These cannot be declined while you use the Services.

The remainder is optional and falls into three categories:

Analytics — information about use of the Services, collected by us and by Google Analytics, a service provided by Google. Google Analytics runs only on our public marketing pages, not on the pages where you read stories or work in your account. Where this category is enabled, Google receives the address of the page requested, including any campaign tags and advertising click identifiers it carries, the approximate location derived from your IP address, and your browser and device type. When you register with us, the first time you tell us that you are a professional or aspiring professional writer (a "qualified sign-up"), or when you begin or complete a purchase from us, we also send Google a record of it — for a purchase, its amount, currency and our reference for the transaction — together with the pseudonymous identifiers Google Analytics has assigned to your browser and visit, so that it can be counted with that visit. The record of a qualified sign-up states only that one occurred; it does not include your answer or anything else you tell us when you set up your account. We do not disclose to Google your name, your email address, or the content of your work. Where the Advertising category is also enabled, Google uses this information for the advertising features described under Google advertising features. Where it is not, we indicate to Google that you have not consented to the use of this information for advertising, and Google uses it for analytics only. Google's use of the information it receives is governed by its own privacy policy.
Attribution — the campaign and referral tags described below, used to determine which campaigns — ours, and those writers run through the Services — and which affiliates bring people to us.
Advertising — measurement of whether an advertisement, including one a writer runs through the Services to promote a story, led to a visit, a registration, reading or a purchase, and helping the advertising platforms we use, Meta and TikTok, show such advertisements to people likely to respond to them. Where this category is enabled, their tags may run on our marketing pages, where they receive the address of the page, including any campaign tags and any click identifier an advertising platform, Google included, added to the link you followed, and place their own cookies; we do not use their tags on the pages where you read stories. When you register, make a qualified sign-up, or begin or complete a purchase, we send them a record of it together with identifiers: a hashed version of your email address, pseudonymous identifiers for your account and browser, your IP address, the country it indicates and your browser type, the identifiers held in the platforms' own cookies, and the click identifier the platform appended to a link you followed. When you read stories on the Services, whether or not you are signed in, we also send them a record when you view a story, begin reading it, reach a later chapter, follow it, or subscribe to it — for a subscription, with its price and currency. That record carries the same identifiers, except that the hashed email address and account identifier are included only if you are signed in. It identifies the story by a reference number and describes it only by its genre and general themes; it does not include the story's title, the address of the page, or the story's content warnings, and we send no such record for a story rated for adults or written for children. A click identifier stays on your device for at most seven days, and we keep it for up to one hundred and eighty days, after which it is deleted. Each platform's use of what it receives is governed by its own privacy policy. This category also governs Google's use of Google Analytics information to advertise writefolio, described under Google advertising features. We do not display advertising within the Services. Inclusion in an advertising audience is a separate, account-level choice described under Disclosure of information, and is never implied by this category.

If you are in the UK or the European Economic Area, we obtain your consent before storing or accessing information in these three categories, and none is stored or accessed until you give it. Elsewhere, these categories are enabled by default and you may disable them at any time.

You may give, refuse, or withdraw consent at any time through the Cookies link in the footer of each page. Withdrawal takes effect immediately and does not affect processing carried out before it. Where your browser transmits a Global Privacy Control signal, we treat the Advertising category as refused, even if you enabled it earlier, unless you enable it in our cookie settings while the signal is on. If you have not made a choice in our cookie settings, we treat all three optional categories as refused and do not request consent.

Google advertising features

Our Google Analytics account is linked to our Google Ads account, and we use the following Google Analytics advertising features. They apply only where you have enabled both the Analytics and the Advertising categories.

Advertising and measurement through Google Ads. Google uses the information Google Analytics collects on our marketing pages to show writefolio's own advertisements to people who have visited those pages, and to measure which of our advertisements led to a registration, a qualified sign-up or a purchase.
Google Signals. If you are signed in to a Google account that allows ads personalization, Google associates the information Google Analytics collects with that account. This lets us see, in aggregate, how people use our pages across their devices, and lets our advertisements reach people who have visited our pages on their other devices.

For these features Google does not act only on our behalf: it combines this information with information it holds about you and uses it under its own privacy policy. Google explains how it does so at How Google uses information from sites or apps that use our services. We use these features only to advertise writefolio; campaigns that writers run through the Services do not use them.

You can refuse or withdraw them at any time by refusing the Advertising category through the Cookies link in the footer of each page. You can also control the advertisements Google shows you, including turning off ads personalization, in Google's ad settings, and stop Google Analytics from collecting information in your browser with Google's opt-out browser add-on.

Device identifier

When you first sign in from a browser we set a persistent cookie so that we can recognise that browser on subsequent sign-ins. We keep a record of that browser, including when you first and most recently signed in from it and the preferences you have set on it.

We use this identifier to retain your per-device preferences across sign-ins and to detect abusive multi-account activity. We rely on our legitimate interests for this purpose. Where the Advertising category is enabled, we also include it, in pseudonymous form, in the advertising measurement described above.

A device record that has not been used for 12 months is deleted, along with the preferences stored against it. Preferences tied to your account are deleted when you close your account. The device record itself is retained after account closure for the fraud-detection purpose above, without your name or email address.

Information stored in your browser

We store the following in your browser: your interface preferences, your session state, the documents you had open, and your reading position in published work. Where you reach the Services through a marketing campaign or an affiliate referral link, we also store the tags carried by that link.

Two of these are identifiers rather than preferences:

A browser identifier — a random value generated in your browser. It is not associated with your name or email address unless you give us one, for example by creating an account or joining our mailing list. We use it to distinguish repeated activity by the same browser from separate activity and to detect manipulation of reading statistics. If you create an account, it is recorded as a device record as described above.
A referral tag, stored only where you reach the Services through an affiliate referral link. It identifies the referring affiliate for up to 60 days on a rolling basis, so that an account confirmed within that period is attributed to them. A later referral link supersedes an earlier one.

You may remove all of these at any time by clearing your browsing data. We receive the browser identifier with the usage information described under Automatic collection of information and when you register or join our mailing list, and we receive the referral tag when you register or confirm your email address. We do not disclose the referral tag to third parties. Where the Advertising category is enabled, we disclose the browser identifier in pseudonymous form for the advertising measurement described above, whether or not you have an account; we do not otherwise disclose it.

Retention of information

We will retain and use your Personal Information for the period necessary to comply with our legal obligations, resolve disputes, and enforce our agreements unless a longer retention period is required or permitted by law. We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally. Once the retention period expires, Personal Information shall be deleted.

How long we keep the main categories:

Account records — on closure, your name, email address and sign-in credentials are replaced with placeholders. The account record is retained without those details for as long as necessary to maintain the integrity of the work and payment records associated with it.
Your projects and the work in them — until you delete them or, following closure of your account, for a further six months, which we retain for the resolution of any dispute concerning the account. A project that no other person can open ceases to be published on closure and is deleted at the end of that period. A project anyone else can reach — a co-author, an editor, a reader or a beta reader — is neither unpublished nor deleted. Subscribers do not count for this purpose. Published content may remain in third-party caches for a period after it ceases to be published.
Passages you save from stories — while your account is open. A passage you remove is deleted at once, unless you have quoted it in a comment, in which case we keep it so that the quote still shows. We delete all of them when you close your account, and a story's saved passages are deleted with the story.
Images and video generated for you — one you generate but do not keep is deleted within a few days, unless it is an image you save to your project's collection. One you keep stays with your project, with the description and instructions it was generated from, until you remove it or the project is deleted. Once removed, it is deleted — in some cases after a grace period of about thirty days, so that the removal can be undone. We also keep a record of each video we generate for you, including the instructions it was generated from, for as long as the project exists, for billing and to investigate misuse.
Usage information — for a limited period that depends on the kind of activity recorded, after which it is deleted. We may keep a de-identified record of how the Services are used indefinitely, so that we can understand how they are used over time. A de-identified record cannot be traced back to you.
Diagnostic traces — thirty days, after which they are deleted automatically, as described under Automatic collection of information.
AI request records (the metadata described above, not your prompts or the generated text) — kept for billing and abuse investigation. Records belonging to a project are deleted when that project is; where a project outlives your account, so do they.
Connected apps — an app keeps its access until you revoke it or close your account, unless the access lapses sooner, in which case the app must be connected again. The credentials we issue to an app expire and are replaced regularly, and are deleted when you revoke the app or close your account; your API key lasts until you replace it or close your account. The record of which apps you approved, and when you revoked them, is kept with your account record. The notes a connected app gives us are kept with the project they concern until it is deleted. What the app's provider has received is kept under its own policy.
Payment and tax records — seven years, because tax law requires it.
Affiliate records — if you join our affiliate program, your affiliate record and the record of your commissions are kept for seven years, because tax law requires us to retain payment records for that long. The link between a referred account and the affiliate who referred it is kept for the lifetime of that account.
Device records — twelve months after last use, as described under Device identifier.
Mailing list — until you unsubscribe or ask us to remove you, or until we close the list.
Email delivery information: what our email provider tells us about delivery to your address is deleted when you close your account.
Advertising campaigns — the record of a campaign and what it spent is kept with our payment records. The phone number and legal name you gave for it are removed when you close your account. A platform keeps what it received under its own policy and the law that applies to it, as described under Advertising your work.
Reader lists a writer brings — an address on such a list that never matches a reader who signs up here is deleted after twelve months. Closing your account removes your address from every such list immediately.
Referral tags — sixty days in your browser, as described under Information stored in your browser.

Data protection rights under GDPR

If you are in the UK or the European Economic Area (EEA), you have certain data protection rights. In certain circumstances, you have the following data protection rights:

The right to request access to your Personal Information that we store.
The right to request that we correct any Personal Information you believe is inaccurate.
The right to request the erasure of your Personal Information under certain conditions.
The right to object to our processing of your Personal Information, and, at any time and without giving a reason, to its use for marketing email, as described under Email from us.
The right to seek restrictions on the processing of your Personal Information.
The right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.
The right to withdraw your consent at any time.
The right to lodge a complaint with a supervisory authority. If you are in the EEA this is the data protection authority of the country you live or work in; in the UK it is the Information Commissioner's Office. We would rather you came to us first, but you do not have to.

To exercise any of these rights, write to hi@writefol.io. We will respond within one month. We may ask you to confirm who you are before we act, so that we do not disclose your information to someone else.

If you signed in with Facebook, you can also start the deletion request from Facebook itself: in your Facebook settings, open Apps and Websites, choose Writefolio, and follow the instructions there — which direct you to write to us at the address above. We handle the request through the same closure process we use for a request you make to us directly, regardless of which channel you used to reach us.

Advertising choices in the United States

Some US state privacy laws, including California's, treat disclosing personal information to an advertising platform so that it can advertise across other businesses' services as "sharing" or as processing for "targeted advertising", whether or not money changes hands. Three of our practices may fall within those terms: the advertising measurement and delivery described under Cookies and similar technologies; the Google advertising features described under Google advertising features; and the advertising audiences described under Disclosure of information. The information concerned is identifiers (a hashed email address, pseudonymous account and browser identifiers, your IP address, and the identifiers carried by the platforms' own cookies and advertising links) and information about your activity on the Services, such as the marketing pages you visit and the campaign that brought you to them, a registration, a qualified sign-up, a purchase, or the stories you view, read, follow or subscribe to. The recipients are Meta, TikTok and Google. The Services are for adults, and we do not knowingly sell or share the Personal Information of anyone under 16.

You have the right to opt out of this sharing and targeted advertising. You can:

turn off advertising audiences at any time in Settings → Privacy;
refuse or withdraw the Advertising category at any time through the Cookies link in the footer of each page; and
set your browser to send a Global Privacy Control signal. We treat it as an opt-out as described under Cookies and similar technologies, and an account created from a browser that sends it is not included in advertising audiences.

Opting out does not change the price or quality of the Services.

Information security

We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. We maintain reasonable administrative, technical, and physical safeguards in an effort to protect against unauthorized access, use, modification, and disclosure of Personal Information in its control and custody. However, no data transmission over the Internet or wireless network can be guaranteed.

Contacting us

If you would like to contact us to understand more about this Policy or wish to contact us concerning any matter relating to individual rights and your Personal Information, you may send an email to hi@writefol.io.