Privacy Policy

Your account

Stored against an account: your handle, your display name, an optional bio, your email address, a password hash, the public keys of your passkeys, your sessions (with the IP address and browser that opened them), and the moment you accepted these terms and this policy.

Your password is never stored as text — Better Auth keeps a hash of it and never the password itself. A passkey is stored as its public half only.

Your address is used for three account messages: verifying the address, a password reset you asked for, and a notice that a recovery code was used. There is no marketing mail and no notification stream.

While you are signed in, your browser holds the session cookie that names the session on the server; clearing your cookies signs you out.

What you read and write

Stored against your account: the stories you write and their chapters, the comments and likes you leave, the works you save, where you left off reading, and the works and authors you follow.

Contest entries and their results are stored too, together with the quote a winning entry is shown with.

An author's pitches are stored against the account. Payments are switched off, so there is no purchase, payout note or payout receipt on a launch database.

A copyright report filed through the public form stores the reporter's name, email address, the work they name and their description. The form needs no account.

In your browser

Reader preferences — the theme and the prose scale — live in your browser's localStorage, so they survive a chapter change, a reload and the next visit. The site-wide light/dark/system choice is kept there the same way.

A cover's remembered colour and the hero's one-time hint live in sessionStorage for the current tab, and clearing your browser storage removes all of it.

Copyright reports

A copyright report is a public write, and it is kept as the reporter filed it: name, email, the named work, the original work and the description.

A weekly job asks Cloudflare's Workers AI model `typesafe/jev` whether a pending report describes a specific, credible claim, and stores that verdict, its probability and the review time. The report text is the input to that request.

Who processes it

Cloudflare hosts the application, runs its database (D1) and provides Workers AI for the copyright review. The webfonts are served by Google Fonts, whose servers receive the request's IP address. There is no payment processor on a launch database, because payments are switched off.

This application ships no advertising, no third-party analytics and no tracking scripts. Reading counts, which the rankings rise on, come from this server's own rows.

Removing your account

Settings → Your data downloads a JSON copy of your profile, works and chapters, comments, likes, saves, reading positions, follows, contest entries and pitches.

The same band deletes the account and everything that hangs off it, after you type your handle back. That includes the works you wrote and your comments; it cannot be undone.

If you lose every passkey, a one-time recovery code generated in Settings gets you back in and lets you enrol a new one; an operator can clear the registered passkeys as a last resort.