Your manuscript, your rights

1. What we store

• Your account: your email address and a scrypt hash of your password (never the password itself), plus your preferences.
• Your books: scenes and their versions, story-bible entries and citations, plans, notes, corkboards, maps and images you upload, comments, revision tasks, saved views and book designs.
• Co-authors: if you invite someone to a book, the email address you invited (until the invitation is used, withdrawn or expires), who joined, who has which scene open for the last minute or two, and who saved each version. Invitation emails name you and the book, and carry no manuscript text.
• Readers' comments: what your beta readers write on a reading link, with the display name they choose. Readers don't need an account.
• Activity counts: words added and removed per day and session times, for your stats. Counts only — no text.
• Billing records: what Gumroad tells us about your plan and payments. Gumroad handles your card; we never see the full number.
• How you found us: the campaign tags (utm), referring site and first page of your first visit, saved with your account when you sign up. When measurement is on, Meta's browser and click ids, your browser type and country too (refreshed when you go to checkout).
• Invitations: your personal invite code, and if you joined through a friend's link, that link and whether its reward has been granted. The friend who invited you sees only counts, never your name or email.
• Measurement, unless you opt out (or, where the law requires it, only with your permission): a record of the events we report to Meta, and visits counted by Google Analytics (see cookies and measurement).

2. Where it lives, and what “not end-to-end encrypted” means

Your books are stored in our database on servers we run rented from Hetzner Online GmbH in a data centre in Helsinki, Finland, inside the European Union. Connections to the studio use HTTPS. Backups are encrypted before they leave the server, with a key that isn't kept on it, and stored in Cloudflare R2.

The studio is not end-to-end encrypted. Our servers can read your text — that's how saving, version history, search, exports, stats and checks work. Some services describe themselves as end-to-end encrypted while also analysing your text on their servers; those two things can't both be fully true, and we'd rather be precise.

A copy of each scene is also kept in your browser on your device until the cloud confirms it, so a dropped connection never costs you words. So that books open with no connection, the studio also keeps the parts of your books you've opened on that device — outlines, story bible, plans and the scenes you opened — up to about 50 MB per account. These copies stay on that device, aren't readable by other sites, and are removed when you sign out or someone else signs in there.

3. Who can see your book

• You. Books belong to your account's private workspace; other accounts can't reach them, and we test that on every change.
• Co-authors you invite. A co-author sees only the book you invited them to, and can't export it, create reading links or use your AI allowance. Remove them, or they leave, and their access ends at once.
• People you send a reading link to. They see a frozen copy of the chapters you chose, until you revoke the link or it expires.
• Us, only to keep the service running. We don't read manuscripts. If you ask for help with a specific book, we'll ask your permission before opening it.

4. When anything reaches an AI provider

Writing, planning, the story bible, stats, basic checks, beta readers, book design and exports never send your text to an AI provider. Two features can: the story scan and cited questions. For those:

• They're off for every book until you allow them for that book. You can withdraw permission at any time.
• The permission screen names the provider (today, Anthropic), the purpose, what's sent and a summary of the provider's retention policy, with a link.
• Only the excerpts the task needs are sent, and you see which ones and the most it can use from your allowance before anything runs.
• Scenes you mark private are never sent.
• Requests are one-off calls; we don't store your book in the provider's files, threads or memory features.
• Our provider's commercial terms don't allow training on your content, and we never train models on it ourselves.

Dictation uses your browser's own speech recognition, which some browsers process on their maker's servers. It never passes through our AI provider.

The editor's dictionary, when you choose Define, sends only the single word you selected from our server to a public dictionary service (the Free Dictionary API at dictionaryapi.dev, or Wiktionary when that service is unavailable or doesn't know the word). No other text and nothing about your account goes with it. You can switch the dictionary off in the editor's view options.

5. What we never do

• Train AI on your writing, or allow our provider to.
• Sell or rent your data.
• Use your writing for advertising, or share your writing, titles or studio searches with advertisers.
• Show your book to other users, or make it public.
• Put manuscript text in emails, logs or advertising measurement.
• Claim any rights to your work.

6. Taking your work with you

Export any book at any time as DOCX, TXT, EPUB or a print-ready PDF, or as a complete project archive that can be restored on this or any other account. You can also export everything in your account at once. Exports work on every plan, including after a plan ends. In the desktop app, local backups save a restorable archive of each book to a folder on your own computer; those copies are yours and stay where you put them.

7. Deleting a book or your account

Delete a book or your whole account from the studio's settings. Deletion is scheduled with a seven-day grace period, so you can change your mind or make a final export; after that, the content is purged from our live database. We keep a minimal record that a deletion happened — no content — so it can't be restored by accident.

Encrypted backups are kept on a rolling schedule (seven daily, four weekly and three monthly copies), so deleted material can remain in a backup for up to about three months before it ages out. Backups are only ever used to recover the service.

8. Cookies and measurement

We use one essential cookie to keep you signed in, and one that remembers your cookie choice. Your appearance preferences are stored in your browser.

Whether we ask first depends on where you are. In the European Economic Area, the UK, Switzerland and other countries whose laws require permission first (including Brazil, South Korea, China, India, Turkey, South Africa and Saudi Arabia), measurement is off until you choose “Accept measurement cookies” on your first visit. Elsewhere, including the United States, measurement is on by default and you can opt out at any time. We work out the country from your IP address (through our hosting provider, Cloudflare) and don't store it beyond the measurement events below. When measurement is on, the Meta Pixel runs on our public pages (home, features, pricing, guides, the Academy and blog) and our servers send matching events to Meta. This tells us which of our ads lead to sign-ups and purchases, so we can spend less on the ones that don't. Google Analytics also runs on our public pages, which shows us how many people visit, where they come from and which pages they read. If you reject, or your browser sends Global Privacy Control and you haven't said otherwise, none of this happens.

When measurement is on, Google Analytics receives:

• the address and title of the public page you're on, the site that sent you there, and campaign tags in the address;
• your IP address (Google Analytics doesn't store it) and browser type, and Google Analytics' own cookies (_ga), which tell repeat visits apart;
• a handful of steps: reaching the sign-up page, registering, clicking through to checkout, downloading the desktop app, and searches you make in our public glossary, Academy or blog.

Google Analytics sends nothing from inside the studio, never receives your email or account id, and we've turned off Google signals, ad personalisation and automatic event collection for it.

When measurement is on, Meta receives:

• your email address and account id, both scrambled (hashed) before they leave our server;
• your IP address, country and browser type, and Meta's own cookies (_fbp, and _fbc after you click one of our ads), which our server keeps up to date so they last;
• event names such as “viewed the pricing page”, “registered”, “started a trial”, “saved a first scene”, “created a book” or “purchased”, with the plan and price for purchases;
• the address of the page, with book and scene ids removed for pages inside the studio; searches you make in our public glossary, Academy or blog.

Meta never receives your writing, book, chapter or scene titles, character names, notes, or anything you search for inside the studio. The pixel itself never runs inside the studio; studio page views are reported by our server only, as addresses with the ids removed. We don't use Meta's automatic form or button scanning.

You can change your choice any time with Privacy choices at the bottom of every public page. Choosing “Reject” stops measurement and removes Meta's and Google Analytics' cookies from this site. Sharing data with Meta for advertising measurement can count as “selling” or “sharing” personal information under some US state laws (such as California's); “Reject” is how you opt out of that, and we treat Global Privacy Control the same way. When you're signed in, your choice (or your country's default, if you haven't chosen) is saved to your account, and events that happen without a browser (such as a purchase confirmed by Gumroad) follow that saved choice.

We send only the email the service needs — verification, account recovery, billing — and never include manuscript text. No marketing email without your separate consent.

9. If your editor uses Lore & Lilac

Some freelance editors read client manuscripts in the studio. If yours does, there's a short note written for you: what it means for your book.

10. The services we rely on

A few companies process data for us, each only for the job below and under a data-processing agreement:

• Hetzner: the server in Finland that the studio and its database run on.
• Cloudflare: our domain, protection against attacks, and storage for encrypted backups and uploaded images.
• Resend: delivering account emails. It receives your email address and the message, never manuscript text.
• Gumroad: selling plans and reading packs. It acts as the seller, handles your card and taxes, and tells us which plan or pack you bought.
• Anthropic: the AI provider, and only for books where you've switched AI on (see above).
• Meta: measuring our advertising, unless you opt out (or only with your permission where the law requires it; see cookies and measurement). It never receives manuscript content.
• Google: Google Analytics, counting visits to our public pages, on the same terms (see cookies and measurement). It never receives manuscript content.

Some of these companies are based in the United States. Where your data leaves the UK or EU, it's protected by the European Commission's standard contractual clauses or an equivalent safeguard.

11. Why we're allowed to use your data

• To provide the service you signed up for (performing our contract with you): storing and showing your books, saving versions, exports, reading links and account emails.
• Your consent: AI processing for a specific book. You can withdraw it at any time, and that stops future requests straight away.
• Legitimate interests: keeping accounts secure, preventing abuse and keeping the service running. These never override your rights to your writing.
• Legal obligations: keeping billing records for as long as tax law requires.

12. Your rights

Wherever you live, you can ask us to:

• show you the personal data we hold about you, and give you a copy;
• correct anything that's wrong;
• delete your data (most of this you can do yourself in settings);
• hand your data over in a portable format (the project archive and full-account export do this);
• stop or limit a particular use of your data, or withdraw a consent you gave.

Email us and we'll reply within 30 days. We may need to confirm the request comes from the account's owner. If you're unhappy with how we've handled your data, you can also complain to the data-protection authority where you live.

The studio is for adults: you must be 18 or older to create an account. We don't knowingly collect data from children; if you think we have, tell us and we'll delete it.

13. Who we are, questions and changes

Lore & Lilac is an independent studio run by its founder, who is responsible for your data. Ask us anything about this page at [email protected]. When we change it, we'll update the date at the top, describe what changed, and email you first if the change matters to how your books are handled.