Privacy

What is collected

• Usage analytics (first party). Page views and a small set of feature events (for example "narrative opened"). Each visit is identified by a salted hash of IP address, device class and date. The salt never leaves the server and the hash changes every day, so visitors cannot be followed across days. Raw IP addresses and full user agents are not stored. The referring website (domain only), device class (desktop, mobile, tablet) and, where the hosting provider supplies it, a two-letter country code are recorded.
• Do Not Track and Global Privacy Control are honoured. With either enabled, no analytics event is sent or stored.
• Feedback. The category, the message, the page and, only if you provide it, your email address.
• Accounts and the brief (optional). Your email, a scrypt password hash (or Google sign-in) and your subscription status. Session tokens are stored hashed and expire after 30 days.
• Google Analytics loads only if the operator configures it, with IP anonymisation.

What is not collected

No advertising trackers, no sale of data, no cross-site tracking cookies. Analytics sets no cookies.

Retention and deletion

Delete your account from the account page. This removes the login, the brief subscription and sessions, and erases your email from any feedback. For other requests use the feedback page with your email.

Processors

Email delivery uses Brevo or SMTP when configured. Database backups may be stored in a private Hugging Face dataset when configured.