Privacy Policy

Last updated: 2026-08-27

NovelForge is operated by an individual developer based in the Czech Republic. This policy explains what we collect, how we use it, and the choices you have. For any data requests, see §7.

1. What we collect

• Account: email, display name, hashed password, device metadata (name, platform, last seen).
• Your writing: manuscripts, Codex entries, and project metadata you choose to sync.
• Operational: request logs and an audit log of security-relevant actions. We do not collect usage telemetry.
• Local storage: session token, UI preferences (theme, language), and crash metadata stored in your browser or device. No third-party advertising cookies are used.
• Auto-updates: on desktop, the app checks for new releases each launch – this contacts our update server (no manuscript content is sent).

2. How we use it

To provide cross-device sync and backup, authenticate you, secure the service, and (with consent) improve the product. We do not sell your data. We do not use your manuscripts to train AI models — see §9.

3. Storage & security

Your manuscripts are stored with server-side encryption at rest (R2/B2 bucket-level) and transferred over TLS. By default, to provide sync, backup, and real-time collaboration, our infrastructure can process project content – the same operational model as collaborative writing tools like Google Docs or Notion. Access is restricted to automated systems and a single account maintainer; no third party has access. You can also enable client-side end-to-end encryption in the app: cloud sync blobs are then locked with your passphrase (and recovery code), so even we cannot read them.

4. Sub-processors

5. Retention

Auth logs ~90 days, audit log ~1 year, backups ~35 days, deletion tombstones ~90 days. You can request export or deletion of your account data at any time.

6. Your rights

You can access, export, correct, or delete your data. Account deletion is available in-app and on the web (delete-account.html) – a soft-delete with a 30-day grace period, then permanent purge (cascading to backups within 90 days). For other requests, email §7 and we will respond in a reasonable timeframe. EU users may also contact their local data protection authority.

7. Contact

Questions or requests: privacy@novelforge.cc.

7b. Breach notification

If a security breach affecting your personal data occurs, we will notify the relevant data protection authority within 72 hours of becoming aware of it where required by law (GDPR Article 33), and notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34).

8. Children

NovelForge is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has registered, contact us at §7 and we will delete the account.

9. AI training

This is the same promise as in the licence, written here so it is easy to find.

• No AI training. The Author does not use Your Content — manuscripts, notes, comments, Codex entries, or other writing you store in NovelForge — to train AI models.
• Your key, your provider. AI features are opt-in and use a key you supply (or a local model you run). Text you choose to send goes to that provider under their terms. We do not take a copy of that prompt to train anything of our own. Turn AI off and nothing is sent.
• Encryption, not a policy on trust. Sync and backups can be locked with your passphrase so even we cannot read the writing. That is stronger than a “we promise not to look” clause.
• You own the writing. We claim no licence to publish it. The limited hosting licence in the EULA exists only to run the features you turned on, and ends when you delete the content or the account.