Legal
Privacy Policy
Effective [effective date]
Who we are
Pilcrow is made by Project LDB Ltd, a company registered in England and Wales (company number 16997534) at 20 Wenlock Road, London, England, N1 7GU. We are the data controller for the personal data described in this policy.
Questions, requests and complaints go to help@writepilcrow.com. We answer within 30 days.
This policy covers the Pilcrow app on iOS, Android, the web and desktop, and the Pilcrow website. It applies from [effective date].
What we will never do
- Build generative AI into Pilcrow. Nothing in the app writes, rewrites or suggests prose for you.
- Read your writing, except when you ask us to help with a specific problem or the law requires it.
- Use your writing to train or improve machine-learning or AI models, or let anyone else do so.
- Sell or rent your personal data, or share your writing with anyone for their own purposes.
- Show advertising, or use advertising or cross-site tracking cookies.
- Lock your writing behind a payment. Export works on every plan.
What we collect
We collect only what the app needs to work, bill you, and improve. We never sell personal data and we never show advertising.
| Category | What it is | Where it comes from |
|---|---|---|
| Account | Your email address, the name your sign-in provider shares, a provider account id, and an account id we create | Google or Apple sign-in. We have no passwords. |
| Your writing | Projects, documents, drafts and version history, notes, comments, characters and other entities, your lexicon, timelines, plotlines, and any cover or portrait images you add | Typed or imported by you, including Scrivener imports |
| Settings | Timezone, spelling dialect, sort order, analytics choice | Set by you or detected from your device |
| Billing | Plan, subscription status, payment amounts and dates, invoices, any credit you have built up | Paddle, our payment provider. We never see your card number. |
| Usage analytics | Which features and screens you use, when, on what platform and app version, as counts and categories | Collected by the app and sent to PostHog, unless you turn it off |
| Error reports | Stack traces, device model, operating system, app version, and the screen you were on when something broke | Sent to Sentry when the app hits an error |
| Device | A per-device marker of which account last signed in, kept only on the device | Created by the app |
Usage analytics never include your writing. The app strips titles, names, text and anything typed by you before an event leaves the device, and it sends categories such as "Spelling" rather than the word you corrected. Error reports are scrubbed the same way, and we do not record sessions or screens. Spelling and grammar checking runs entirely on your device; no text is sent anywhere for it.
How we use it
| Purpose | Data used | Legal basis (EU and UK) |
|---|---|---|
| Sign you in and keep your account | Account | Performing our contract with you |
| Store, sync and back up your writing across your devices | Your writing, settings | Performing our contract with you |
| Bill you, apply your credit, and send receipts | Account, billing | Performing our contract; legal obligations for tax and accounting records |
| Fix crashes and bugs | Error reports | Our legitimate interest in a working product |
| Understand which features are used so we can decide what to build | Usage analytics | Your consent, which you can withdraw in Settings at any time |
| Answer your support requests | Account, and whatever you send us | Our legitimate interest in supporting you |
| Tell you about changes to the service, these terms, or your subscription | Account | Performing our contract; legal obligations |
We do not read your writing. Our staff can technically access the database that stores it, and we do so only when you ask us to help with a specific problem, or when the law requires it. We do not use your writing to train machine-learning models, and we do not share it with anyone who does.
We do not make automated decisions about you that have legal or similarly significant effects.
Who we share it with
We share personal data only with the providers below, each under a contract that limits them to processing it for us. None of them may use your data for their own purposes.
| Provider | What they do for us | What they hold | Where |
|---|---|---|---|
| Supabase | Database, sign-in, image storage and server functions | Account, your writing, settings, billing records | European Union (EU West) |
| PowerSync | Syncs your writing between your devices and our database | Your writing and settings, in transit and in a short-lived replica | European Union (EU West) |
| Vercel | Hosts the web app and the website | Server logs with your IP address and browser | United States and edge locations |
| Paddle | Sells our subscriptions as merchant of record, handles payment, tax and invoices | Email, billing address, payment details, purchase history | United Kingdom and United States |
| PostHog | Usage analytics | Usage events, an anonymous device id, your account id, platform and app version | European Union |
| Sentry | Error reporting | Error reports as described above | United States |
| Google and Apple | Sign-in | Governed by their own privacy policies when you sign in with them | Their regions |
We also share data when the law requires it, to protect our rights or someone's safety, or with a buyer if the business changes hands. In that last case we would tell you before your data moved.
Where your data lives and how long we keep it
Pilcrow is local-first. Your writing lives in an encrypted database on each device you sign in on, and a copy syncs to our servers so your other devices and your backups stay current. You can write offline; changes sync when you reconnect.
| Data | Kept for |
|---|---|
| Your writing | While your account exists. Deleted projects stay in the trash for 90 days, then go for good. Document version history is kept for 7 days on Free and 30 days on Standard. |
| Local copy on a device | Until you sign out. Signing out wipes the local database on that device. |
| Account and settings | While your account exists, then deleted when you delete your account |
| Billing records | 7 years after the transaction, as tax law requires. Held by Paddle and in our records. |
| Usage analytics | Up to 12 months, then deleted or aggregated so it no longer identifies you |
| Error reports | Up to 90 days |
| Server logs | Up to 30 days |
Backups of our database may hold a copy of deleted data for up to 30 days after deletion.
Your choices and rights
- Turn analytics off. Settings, then Privacy, then switch off "Share anonymous usage data". The choice is saved to your account and applies on every device you sign in on. The app sends nothing to PostHog while it is off. Error reports continue, because we need them to keep the app working.
- Export your writing. Compile any project to DOCX at any time, or to EPUB and PDF on Standard. Your lexicon exports as a file too. You never need our permission to leave.
- Delete your account. In the app, go to Settings, then Account, and delete your account, or email help@writepilcrow.com from the address on your account. We cancel any subscription, then delete your account, your writing and your settings, keeping only the billing records the law makes us keep. Deleting your account also deletes any credit toward owning Standard.
- See, correct or move your data. Ask us at the same address. We will send a copy of the personal data we hold about you in a common format within 30 days.
- Object or restrict. Where we rely on a legitimate interest, you can object. Where we rely on consent, you can withdraw it.
Marketing email. We send product news only if you opt in, and every such email has an unsubscribe link. Emails about your account, your billing or changes to these terms are service messages, not marketing, and continue while you have an account.
If you are in the EU, the UK or another place with a data protection regulator, you can also complain to that regulator. In the UK, that is the Information Commissioner's Office (ico.org.uk). If you are in California, you have the rights above under the CCPA, and we do not sell or share personal data for advertising.
Security, children, transfers and changes
Security. Your writing is encrypted on your device and encrypted in transit and at rest on our servers. Sign-in goes through Google or Apple, so we hold no passwords. Access to our systems is limited to the people who run Pilcrow and is logged. No system is perfectly secure; if a breach affects your data, we will tell you and any regulator the law requires, without undue delay.
Children. Pilcrow is not for anyone under 13, or under the age of digital consent where they live if that is higher. We do not knowingly collect data from children; if you think we have, email us and we will delete it.
International transfers. Our providers process data in the places listed above. Where data leaves the EU or UK, we rely on the provider's standard contractual clauses or an adequacy decision. You can ask us for details.
Website. Our website, writepilcrow.com, sets no cookies of its own, has no advertising, and serves its fonts from our own host. It counts visits with Vercel Web Analytics, which uses no cookies and does not identify you or follow you across other sites: it records the page, where you came from, and your country, browser and device type, in aggregate. The pricing page loads Paddle.js from Paddle to show prices in your currency, which shares your IP address with Paddle under Paddle's privacy policy. Vercel hosts the website and keeps server logs as described above.
Changes. We will post changes here and, for anything that affects your rights or how we use your data, email you at least 14 days before they take effect. The date at the top is the version in force.