Privacy Policy (writerer)

Last updated: October 3, 2026

This Privacy Policy explains how NerdHonest LLC ("NerdHonest", "we", "us") handles information when you use the writerer app and related services (the "Service").

Operated by: NerdHonest LLC (Georgia, USA)
Email: writerer@nerdhonest.com
Mailing address: 8735 Dunwoody Place, Ste R, Atlanta, GA 30350

Summary (Plain English)

• writerer is local-first: your writing is stored on your device first.
• Cloud sync is on by default when you sign in, and you can turn it off in Settings. While it is on, your content is stored in our cloud backend so it can sync across devices.
• Some features send content to third parties only when you use them, such as grammar/style checking and web clipping.
• Share-for-feedback links are bearer-token links: anyone with the link may be able to access the shared content.
• We aim to minimize data collection. During beta, an account may be required. At public launch, you can use writerer without an account for a limited local-only experience (currently 2 projects). Creating a free account adds a project and is required for cloud sync (included on every account, free or paid) and Pro features.

Definitions

• Local data: Data stored only on your device (for example in a local SQLite database, app preferences, or OS secure storage).
• Cloud data: Data stored in our cloud backend (for example in Supabase/Postgres) when you use cloud features, including cloud sync, which is on by default when you are signed in.
• User Content: Text and other material you create or import into writerer (manuscripts, notes, research, comments, etc.).

Data Map (What We Handle)

This table is a high-level map of data categories in writerer. It is not exhaustive, but it is meant to be practical and transparent.

What We Collect and When

Local-first content storage

writerer stores your User Content on your device first. When you are signed in, cloud sync is on by default and uploads your manuscripts and notes to our servers so they sync across your devices; you can turn it off in Settings.

Cloud sync (on by default) and cloud features

When cloud sync or other cloud-backed features are in use (such as sharing links for feedback), copies of your content and related metadata are stored in our cloud backend so those features can work. Cloud sync is enabled by default when you sign in to an account, on every plan, free or paid; you can disable it in Settings. In current versions of the app, while it is off no new content or images are uploaded and they stay on your device; share links you create and feedback (with any attachments) you choose to send are the exception. Images you add while sync is off or while your cloud storage quota is full are kept on your device and uploaded later, once sync is on and you are under your quota.

When cloud sync is enabled, the following may be synced: projects, documents (full content), binder structure, characters, relationships, locations, world elements, plotlines/plot points, templates applied, Design themes and page layouts, Design asset metadata and private asset blobs, export presets and export history, share links, external comments, tracked changes, notifications, writing layout presets, user profile data, referral actions, writing-session statistics, and any AI chat history from earlier app versions. Synced data is deleted with your account. Design asset bytes use the existing private user-assets storage path; PowerSync rows carry metadata and the private object reference, not raw blob bytes.

The following are not synced and stay local-only: app settings/preferences, API keys and license codes, and grammar check results.

Accounts and authentication (Supabase Auth)

If you create an account, your account identifiers (such as email address) are stored with our authentication provider (Supabase). Password handling and session management are performed by Supabase's SDK and backend.

Cross-app account linking (Age of Aeternus)

You can optionally link your writerer account with an Age of Aeternus (AoA) account, another NerdHonest product, using a one-time linking code. When you do, we store the AoA account's internal identifier, a link identifier, the link's status and timestamps, and a record of each link and unlink action (the action, the version of the consent text you accepted, where the action started, and when). No email address, name, plan, payment information, or writing is exchanged between the apps, and linking grants no features or benefits in either product.

The legal basis is your consent. You can unlink at any time in either app.

When you unlink, or when you delete your account, we send AoA an unlink notice. Until AoA confirms it, we keep the writerer account identifier, the AoA account identifier and the link identifier so the notice can be delivered. Confirmed notices are deleted 30 days later; notices that cannot be delivered are deleted after 90 days. The link and the link/unlink records are deleted with your account. If you unlink or delete your account in AoA, AoA sends writerer an unlink notice and the link is removed here.

Research web clipper

When you clip/import a web page by URL, writerer fetches that page directly from your device. The website you fetch from will receive your request (which typically includes your IP address and standard HTTP headers). writerer then extracts content and stores the extracted result locally in your project.

Grammar and style checking

• LanguageTool: When grammar checking runs, the relevant text is sent from your device to the LanguageTool API.
• ProWritingAid: When you request a ProWritingAid analysis, the relevant text is sent from your device to ProWritingAid.

LanguageTool grammar checking runs automatically (with a short debounce) only if you enable grammar checking. It is disabled by default.

ProWritingAid analysis is user-initiated only (you must click a check/analyze button). It does not run automatically.

Crash reporting (Sentry, opt-in)

writerer does not collect crash reports by default. Crash reporting uses Sentry and is OFF until you turn it on in Settings. You can turn it on or off at any time; the change takes effect the next time the app starts.

If you opt in, crash reporting collects:

• Stack traces and error messages
• Device type/model, OS version, and app version
• Navigation breadcrumbs (high-level screens/actions; share-link tokens are removed)
• Performance traces for a sample of about one in five app sessions or operations (which screens and operations ran and how long they took)

Crash reporting does not intentionally collect:

• Manuscript content or user-typed text
• Project/file names
• API keys
• Screenshots

Crash reports and performance traces are retained for up to 90 days.

Analytics / telemetry (opt-in, future)

writerer does not collect external analytics at launch. If we add anonymous analytics later, it will be opt-in (default off) and limited to high-level usage events (for example which screens are used, export formats used, and upgrade funnel events). We will not collect manuscript content, Design asset bytes, page-layout text, generated export contents, file names, AI prompts, or document-specific word counts.

Payments and subscriptions

If you purchase a subscription, your payment information is processed by Stripe, our payment processor. We receive limited information needed to confirm purchase status and manage entitlements (for example plan, renewal status, and transaction identifiers). We do not store full payment card details.

Marketing preferences

Marketing preferences. You may opt in to receive product updates and launch news, either from the waitlist screen when you sign up or at any time from Settings → Account → Product Updates. This preference is stored with your account, and you can turn it off from the same place; opting out also removes you from our marketing email provider. Opting out does not affect service emails such as password resets and access notifications, which we always send.

Cookies and local storage (web)

At launch, we do not use tracking cookies for advertising or analytics.

On the web, writerer may store small functional values in your browser storage (for example localStorage), such as:

• A flag like writerer_launched to skip a landing screen for returning users.
• external_commenter_display_name to remember an external commenter's display name on shared pages.

These are used for basic functionality and are not used for targeted advertising.

AI Features

AI-assisted writing features are not offered in the current release of writerer, and writerer does not send your writing to AI providers. If we offer AI features in the future, we will update this Privacy Policy before they become available to you.

Sharing and Public Links (Share-for-Feedback)

writerer can generate share-for-feedback links. These links are designed as bearer tokens (a random token in the URL). If someone has the link, they may be able to access the shared content.

What may be exposed

Depending on the link settings you choose, a share link may allow an external viewer to:

• View a shared document or a set of documents from a project
• See basic document/project titles necessary for navigation
• Add comments if you enabled commenting (and provide an optional display name)

Your responsibilities

• Treat share links like passwords. Only send them to people you trust.
• Do not share confidential or sensitive information you are not comfortable exposing via a link.
• If you believe a link has been forwarded or discovered, revoke it immediately.

Revocation and expiration

Share links can be revoked by you. Links may also expire if you set an expiration time. Revoked or expired links should stop working, but recipients may still have previously-viewed content cached locally (for example in their browser).

Search engine indexing

We do not intend share links to be indexed by search engines, and we take reasonable steps to discourage indexing (for example noindex/nofollow directives on shared pages). However, we cannot guarantee that third parties will not copy, repost, or index shared content if they have access to it.

Logging stance

For invite-only links, we store the email addresses you invite and record when each invited reader last opened the link. An invited reader who has no writerer account gets one when we email a one-time code to the invited address. When an invited reader comments, the comment shows you their name and the email address they were invited with. If an invited reader deletes their writerer account, their email address stays on the invitation list of the author who invited them. Invitation emails are delivered by Resend.

We do not keep share-link access logs of IP addresses or user agents. To prevent abuse (for example spam or automated attacks on public endpoints), we process a hashed form of the requester's IP address for rate limiting; those records are deleted about a day after their last use.

We may add a simple view count that does not store personal data (for example an aggregate counter) in a future version.

How We Use Information

We use information to:

• Provide and operate writerer (local storage, editing, export, organization)
• Provide cloud services (auth; sync, which is on by default when you are signed in; sharing; notifications)
• Provide optional integrations you enable (grammar/style checking, web clipping)
• Maintain security, prevent abuse, and debug reliability issues
• Communicate with you about your account or support requests

We send transactional emails for account-related events (waitlist confirmation, access notifications, password resets). Marketing emails (product updates, launch news) are only sent if you explicitly opt in, and you can unsubscribe at any time via the link in those emails.

Waitlist and access notifications. If you sign up during our beta period, we send transactional emails to confirm your waitlist status and notify you when access is granted. These are service emails sent under our legitimate interest in providing the service you signed up for, not marketing.

How We Share Information

We do not sell your personal information.

We do not run ads in writerer and we do not sell your data.

We share information only in limited ways:

• With service providers that help us run the Service (see below)
• With third parties you choose (for example, recipients you send share links to)
• For legal reasons if required by law or to protect rights and safety

Third-Party Services

writerer relies on third parties to provide optional features. Your use of these third parties is governed by their own terms and privacy policies.

Supabase Inc. (Auth, Database, Realtime, Edge Functions)

If you use cloud features, writerer uses Supabase for authentication and backend services. Cloud data you sync or share will be stored and processed in Supabase. Our Supabase instance is hosted in US East (Ohio) (us-east-2).

Vercel (Web Hosting)

The writerer web app and our web pages (including the legal pages) are hosted by Vercel Inc. Vercel processes the requests your browser makes, including your IP address, browser user agent, the page requested and the time, and keeps request logs for a limited period to deliver and secure the site.

Google (Web App Assets)

When you open the writerer web app, your browser downloads parts of its rendering engine directly from Google's content delivery network (www.gstatic.com). Google receives your IP address and standard request headers for those downloads, under Google's own privacy policy.

Google and Apple (Sign-In)

If you choose "Continue with Google" or "Continue with Apple", Google or Apple confirms your identity and sends us (through Supabase Auth) your email address (Apple may give a private relay address) and, where the provider shares them, your name and profile picture. Google and Apple handle that sign-in under their own privacy policies. We do not receive your Google or Apple password.

PowerSync (Sync Engine)

If cloud sync is enabled (the default for signed-in accounts, unless you turn it off), writerer uses PowerSync to synchronize data between your local database and the cloud backend.

Grammar / Style Providers

• LanguageTool (LanguageTooler GmbH) (grammar/style checking)
• ProWritingAid (ProWritingAid Ltd.) (fiction-aware style analysis, premium)

Resend (Transactional Email)

Resend (resend.com) — Transactional email delivery (waitlist confirmation, access notifications, share-link invitations).

EmailOctopus (Marketing Email, opt-in only)

EmailOctopus (emailoctopus.com) — Marketing email delivery and list management (only if you opt in to product updates).

GitHub (Feedback Tracking)

When you send in-app feedback, we open an issue in our private GitHub issue tracker that contains only the feedback's id and category. Your message, screenshot, device information, and logs stay in Supabase. The issue holds nothing else about you and may remain after your feedback is deleted with your account.

Sentry (Crash Reporting, optional)

If you opt in to crash reporting, we use Sentry (Functional Software, Inc.) to process crash reports and performance traces (as described above).

Payments and Subscriptions (if applicable)

If you purchase a subscription, we use:

• Stripe (payments and subscription billing). Purchases are not currently offered through Apple or Google in-app billing.

Your Choices and Controls

• Local-first writing: your writing is stored on your device first, whether or not you have an account. Without an account, it stays on your device.
• Turn cloud sync off or on (on by default when signed in): while it is on, your content is stored in the cloud for syncing.
• Revoke share links: stop access to shared content by revoking the link.
• Manage your ProWritingAid license code in Settings.
• Delete local data: delete projects/documents in-app, or uninstall the app / clear app storage.

Your Privacy Rights

Depending on where you live, you may have rights related to your personal information, such as the right to:

• Request access to personal information we hold about you (for example account identifiers stored in the cloud, if you use cloud features)
• Request deletion of personal information (including deletion of your account, if you have one)
• Request correction of inaccurate personal information
• Object to or restrict certain processing in some jurisdictions

Because writerer is local-first, much of your information may be stored only on your device. For cloud data, you can contact us using the information in the "Contact Us" section.

writerer is offered worldwide. The sections below add the details required for users in the European Economic Area (EEA), the United Kingdom, and some US states.

EEA and UK Users (GDPR and UK GDPR)

Who is responsible

NerdHonest LLC, 8735 Dunwoody Place, Ste R, Atlanta, GA 30350, USA (writerer@nerdhonest.com) is the controller of the personal data described in this policy. The service providers listed under "Third-Party Services" process data for us under our instructions, except where this policy says a provider uses data under its own policy.

EU and UK representative. We have not currently appointed a representative in the EU or the UK under Article 27 of the GDPR or the UK GDPR. Given the Service's current small scale, we believe the exemption for occasional, low-risk processing applies. We will review this before public launch, and if a representative is needed we will appoint one and name them here. You can always contact us directly at writerer@nerdhonest.com.

Why we use your data (legal bases) and how long we keep it

Where we rely on consent, you can withdraw it at any time (for example by unlinking Age of Aeternus, turning off crash reporting, or unsubscribing); this does not affect processing before you withdrew. Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds that override your interests or need the data for legal claims.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Where your data comes from

Most data comes from you. We also receive data from: Google or Apple when you sign in with them (see above); an author who invites you to read their work (your email address); Stripe (payment and subscription status); and Age of Aeternus when you link the accounts (the AoA account's internal identifier and link identifier).

Your rights

You have the right to:

• Access the personal data we hold about you and get a copy
• Have inaccurate data corrected
• Have your data erased
• Restrict how we use your data
• Receive data you gave us in a portable format (much of your writing can also be exported from the app at any time)
• Object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent at any time
• Complain to a supervisory authority: in the EEA, the data protection authority where you live, work, or where you think the problem happened; in the UK, the Information Commissioner's Office (ICO, ico.org.uk)

To use these rights, email writerer@nerdhonest.com from your account email address. We may ask you to verify your identity. We reply within 30 days. If a request is complex and the law allows more time, we will tell you within those 30 days why we need it.

International transfers

We are based in the United States, and our cloud backend runs in the United States (US East, Ohio). Our service providers (hosting, database and sync: Supabase, PowerSync, Vercel; email: Resend, EmailOctopus; crash reporting: Sentry; payments: Stripe; issue tracking: GitHub) process data in the United States and possibly other countries. When we transfer personal data from the EEA or the UK, we rely, where applicable, on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum included in our providers' data processing terms, or on the EU-US Data Privacy Framework (and its UK Extension) for providers certified under it. You can ask us for more information about these safeguards.

Data breaches

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to put you at high risk, we will also tell you without undue delay.

Age

You must be at least 16 to use writerer. We do not knowingly collect personal data from anyone under 16; if you believe a child under 16 has given us personal data, contact us and we will delete it.

US State Privacy Rights

Some US states, such as California, give residents rights over their personal information. Whether or not those laws apply to us, we offer the following to every user: you can ask to know and access the personal information we hold about you, correct it, and delete it, using the contact details in "Contact Us". We do not sell personal information, we do not share it for cross-context behavioral (targeted) advertising, and we do not run ads. We will not treat you differently for using these rights.

Account Deletion and Data Deletion

Local deletion

You can delete local content by deleting projects/documents in the app. You can also remove local data by uninstalling the app or using your device's "clear storage" option.

Cloud deletion (Supabase)

If you used cloud features, data exists in our cloud backend. You can:

• Turn off cloud sync. This stops syncing from then on; it does not delete data already in the cloud.
• Delete projects and documents in the app. A deleted project goes to Recently Deleted, where you can restore it for 7 days before it is removed for good (or delete it permanently sooner); a deleted document goes to its project's Trash until you delete it permanently. Permanently deleted items are removed from your device and, if sync is on, from the cloud.
• Delete your account.

You can delete your account in the app (Settings → Account → "Delete My Account"). You may be asked to confirm the request or sign in again. If you cannot use the app, email writerer@nerdhonest.com from your registered email address; we may ask for verification to protect your account.

When you delete your account in the app, deletion runs straight away, in this order:

1. Billing. An active subscription is cancelled and refunded as described below. If this step fails, nothing is deleted and the app tells you so.
2. Age of Aeternus link. Any link is removed and AoA is sent an unlink notice (see "Cross-app account linking").
3. Marketing list. You are removed from our marketing email provider.
4. Cloud data. Your projects and everything in them, synced content, share links and their invitations, comments on your projects, folders, worlds, series, goals, notifications, referral records, writing statistics, feedback, the record of the legal documents you accepted, the AoA link records, tracked changes (suggested edits) you made in another author's project, and your profile are deleted from our database. We delete the files you uploaded (such as Design images and feedback screenshots) from our file storage; if a file cannot be removed automatically, we remove it by hand. Contact writerer@nerdhonest.com if you believe a file remains.
5. Sign-in account. Your account is deleted from Supabase Auth.

We complete the deletion of cloud account data within 30 days of a verified deletion request (in-app deletion normally completes immediately; we handle an emailed request ourselves).

Cloud backups may retain deleted data for up to 90 days, after which it is permanently removed.

If you have an active Stripe subscription when you delete your account, we cancel it immediately and refund the unused part of the current billing period (pro rata) to your original payment method (if we can't refund it there, we'll refund you another way), and we delete the Stripe customer record linked to your account. Stripe and we keep invoices and payment records where tax or accounting rules require it. If the cancellation cannot be completed, the account is not deleted and the app tells you so. One-time (Lifetime) purchases are not refunded when you delete your account.

Deleting your account also removes the writerer data stored on the device you delete it from. Export anything you want to keep first. On any other device where you used the account, remove the app's data there (for example by uninstalling the app).

International Users

If you use cloud features, your data is processed in the United States (US East, Ohio) and may be processed in other countries depending on where our service providers operate. For transfers from the EEA and the UK, see "International transfers" above.

Children's Privacy

writerer is not intended for use by anyone under the age of 16. If you are under 16, do not use the Service.

If you create an account, we may ask you to confirm that you are at least 16 years old.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you (for example, by displaying a notice in the app or updating the "Last updated" date above).

Contact Us

Questions about privacy can be sent to:

• Email: writerer@nerdhonest.com
• Address: 8735 Dunwoody Place, Ste R, Atlanta, GA 30350