Privacy Policy
Last updated: September 29, 2026
This policy explains what personal data NovelStarter (novelstarter.com and Writer Web at app.novelstarter.com) handles, why, and your rights. The controller of your data is NovelStarter, an independent business run by a sole proprietor. Contact for anything about your data: contact@novelstarter.com.
We collect as little as we can: no advertising, no tracking pixels, no analytics in Writer Web, and we never sell your data.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: your email address and a password stored only as a one-way hash | To sign you in and to send account emails (such as a password reset) | Performance of our contract with you |
| Your projects: the outlines you import and everything you write, including the record of AI conversations kept in each project | To provide Writer Web to you | Contract |
| AI usage amounts: how much of your monthly allowance each AI request used (amounts only, not the content) | To show your usage and apply your plan's allowance | Contract |
| Subscription status received from Paddle: a customer and subscription reference, status and billing period. We never receive your card details | To give subscribers what they paid for | Contract |
| Server logs: the address, time and type of each request, kept briefly. They do not contain your stories, prompts, AI answers or passwords | Security and fixing problems | Legitimate interest |
| Newsletter (if you join the list on our blog): your email | To send the updates you asked for; unsubscribe at any time | Consent |
Who processes it for us
We use a small number of service providers, each only for its task:
- DigitalOcean (United States) hosts Writer Web and your projects.
- OpenRouter (United States) routes AI requests to the AI model that answers them. Writer Web uses Anthropic's Claude models. An AI request contains only the context that task needs (for example, one character's knowledge at a point in the story and the conversation so far; a Story Audit reads the whole working story). We do not use your stories to train models, and we choose provider settings that do not allow AI providers to train on them.
- Paddle (United Kingdom) is the Merchant of Record for subscriptions and Extra AI: it processes payments and receives the billing details you give at checkout under its own privacy notice.
- Payhip sells and delivers catalogue outlines and worlds under its own privacy policy.
- HostGator (United States) hosts novelstarter.com and our email.
- WordPress / Jetpack (Automattic) runs our blog and its newsletter list.
Your data may be processed in countries other than yours, mainly the United States. Where data is transferred internationally, it is under the providers' contractual safeguards (such as standard contractual clauses).
How long we keep it
- Your account and projects: while your account exists. When you delete your account, we delete them within 30 days, and backup copies expire within a further 30 days.
- AI usage amounts and subscription records: while your account exists, and longer only where tax or accounting law requires it.
- Server logs: up to 30 days.
Cookies
Writer Web uses one essential cookie that keeps you signed in. It is not used for tracking and does not need consent. When you open the checkout, Paddle's payment window may set its own cookies to process the payment securely. novelstarter.com itself sets no tracking cookies; the blog may set the cookies WordPress needs to work.
Your rights
Under data protection laws such as the European and UK GDPR, Brazil's LGPD and California's CCPA, you can ask us to confirm what we hold about you, give you a copy, correct it, delete it, restrict or object to its use, and move it elsewhere (you can also download any project yourself: Project overview → Download project backup). Write to contact@novelstarter.com from your account email; we answer within 15 days. You can also complain to the data protection authority where you live.
Security
Passwords are stored only as salted hashes; the connection is always encrypted (HTTPS); each account's projects are stored separately and every request is checked against the account that owns it; access to the servers is limited to the operator.
Children
NovelStarter is not directed at children under 13, and subscriptions are for adults.
Changes
If we change this policy in a way that matters, we will email account holders before the change takes effect.