Privacy policy

Novilot is a writing app for novelists. Your manuscript is the most personal thing you could put into a piece of software, and this page explains exactly what happens to it and to the rest of your data. The short version: your writing stays yours, we use it only to run the features you ask for, we never sell data, and we never use your words to train AI models.

What we collect

• Account data. Your email address and a hashed version of your password (hashed with bcrypt; we cannot see the password itself).
• Your writing. Projects, chapters, story bible entries, outlines, notes, chapter versions, and anything else you create in the app. This is stored so the app can show it back to you. It is never made public unless you explicitly share it (for example, a beta reader link you create).
• AI working data. To power features like autocomplete, continuity checking, and voice matching, we store material derived from your manuscript: summaries, style profiles, continuity observations, and text embeddings. These exist only inside your account and are deleted with it.
• Usage data. Which features you use and basic product events (for example, that an analysis was run), plus the credit usage that powers fair billing. We also count words written for your own goals and streaks.
• Billing data. Payments are handled by Stripe. We never see or store your card number; we store only your subscription status and a Stripe customer reference.
• Messages you send us. Feedback you submit in the app and emails you send us.

How AI features use your manuscript

When you use an AI feature, the relevant part of your manuscript is sent to Anthropic (the company behind the Claude models) to generate the result, over an encrypted connection, under commercial API terms that do not permit training on your content.

• We never use your writing to train AI models, and neither does our AI provider.
• Your text is sent only when you use a feature that needs it, and only the part needed.
• AI results (suggestions, analyses) are stored in your account so you do not pay to regenerate them.

Analytics

We use Google Analytics and PostHog to understand how the product is used so we can improve it. PostHog includes session replay, and it is configured to mask all text and all inputs: recordings show the shape of the interface, never your words. We do not run ads and no advertising network receives your data.

Cookies

• nc_session: an essential cookie that keeps you signed in. The app cannot work without it.
• Analytics cookies from Google Analytics and PostHog, used only for the purposes above.

Where your data lives and who processes it

Your data is stored in a managed Postgres database and served through Vercel. We share data only with the service providers needed to run Novilot, and only for that purpose:

• Vercel (hosting)
• Prisma Postgres (database)
• Anthropic (AI features)
• Stripe (payments)
• Resend (transactional email)
• Google Analytics and PostHog (analytics)

We never sell your data, and we never share your manuscript with anyone else.

Retention and deletion

• Deleting a chapter or project permanently removes it and all derived AI data for it.
• To delete your entire account, contact us (see below). Account deletion removes your writing, AI working data, usage history, and profile from our database.
• You can export your manuscript at any time from the app (DOCX, EPUB, HTML, Markdown, or PDF).

Your rights

Depending on where you live (for example, under GDPR or CCPA), you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. Contact us and we will honor these requests for everyone, regardless of location.

Children

Novilot is not directed at children under 13, and we do not knowingly collect their data.

Changes

If we change this policy, we will update this page and the date at the top. If a change meaningfully affects how your manuscript is handled, we will tell you in the app or by email before it takes effect.

Contact

Email support@novilot.com, or use the "Send feedback" button inside the app. Privacy requests are answered by a human.