Novellier
Legal

Privacy policy

Effective 23 October 2026•Last updated 23 October 2026

Your writing lives on your device. This policy explains the personal information we do handle, why, who helps us handle it, and the choices you have.

1. Who is responsible for your data

The data controller is Leon Dean T/A Novellier, a sole trader based in the United Kingdom (“Novellier”, “we”, “us”). This policy covers the novellier.co.uk website, the Novellier desktop app, the web editor at novellier.co.uk/editor, our update service and paid features. For any privacy question or request, email novellierdev@gmail.com.

2. Your writing

Your projects are saved on your own device: as files on your computer in the desktop app, or in your browser's storage in the web editor. We do not keep a copy of your manuscripts on our servers. Your writing only leaves your device when:

  • you turn on Google Drive sync, which saves it to your own Google Drive; or
  • you use an AI feature, which sends the text you select to our AI provider (see section 3).

3. What we collect and why

Visiting the website

The website sets no cookies and runs no analytics or advertising trackers. Like any web server, ours records each request (IP address, browser user agent, page requested and time) in logs that we keep for up to 14 days to keep the site secure and working.

Your account

You can use Novellier without an account. If you create one we hold your email address, your password (stored only as a secure hash by our authentication provider), and anything you add to your profile, such as a username, display name or picture. We also sync some app preferences to your account, such as themes, text-style presets and custom dictionary words.

AI features

When you use an AI feature (for example Inkwell, MuseWeaver, Spindle, Tapestry or reference decanting), the prompt and the project context you select are sent through our server to OpenAI to generate the result. We ask OpenAI not to store these requests, and neither we nor OpenAI use them to train models. We record operation details such as the feature used, credits charged and timing, but not your text. The AI's response is held for up to 15 minutes so it can be delivered to you, then deleted. Anthropic is a standby provider we would switch to only if OpenAI were unavailable. AI processing happens only when you choose to use an AI feature.

Payments

Paid plans are processed by Stripe. Stripe handles your card details; we never see or store them. We keep your Stripe customer and subscription references, your plan and its status, your credit balance and a record of credit transactions.

Google Drive sync (optional)

If you connect Google Drive we receive your Google account email and name, and store the access tokens securely on our server so sync can run. Novellier can only see files it created or that you open with it (Google's drive.file and drive.appdata permissions), not the rest of your Drive. You can disconnect at any time in the app or in your Google account settings.

Product telemetry

The app sends usage events to help us fix problems and decide what to improve: which features are used, whether actions succeed or fail, timings, error codes, app version, platform, a random session ID, and your account ID if you are signed in. It never includes your manuscript text. Telemetry is on by default and you can switch it off at any time in Account > Settings.

Update checks

When the app checks for updates it sends its version, a random install ID and how many times you have postponed the current update, along with your IP address. Postponement counts are held in memory only and are lost when the update server restarts.

Feedback and support

If you send feedback, a bug report or an email, we keep what you send together with your app version and basic browser or system details.

Account emails

Sign-up confirmation and password reset emails are sent through Twilio SendGrid. We do not send marketing emails unless you have opted in.

Look-ups and downloads inside the app

Some tools fetch information from public services. These receive the word or search term and your IP address, but no account details:

  • dictionary and thesaurus look-ups: dictionaryapi.dev and Datamuse;
  • research searches: Semantic Scholar, through our server;
  • spell-check dictionaries: jsDelivr; fonts: Google Fonts;
  • the optional dictation model: Hugging Face. Dictation itself runs entirely on your device.

Discord (optional)

Discord Rich Presence is off by default. If you turn it on, the app shares your writing status with the Discord app on your computer, and you choose whether your project title and session time are included.

4. Our legal bases

  • Contract: running your account, syncing settings, AI features you request, Google Drive sync, payments and credits.
  • Legitimate interests: product telemetry, update checks, server logs, security and preventing abuse. You can switch telemetry off at any time.
  • Consent: marketing emails and optional integrations such as Discord Rich Presence. You can withdraw consent at any time.
  • Legal obligation: keeping billing records for tax purposes and responding to lawful requests.

5. Who we share data with

We do not sell or rent your personal information. We use these service providers, each under a contract that limits how they may use your data:

  • Supabase: accounts, database and server functions, hosted in the EU.
  • OpenAI: AI features. Anthropic: standby AI provider.
  • Stripe: payments and billing.
  • Google: Google Drive sync.
  • Twilio SendGrid: account emails.
  • DigitalOcean: hosting for this website and the update service.

We may also disclose information when the law requires it, or to protect the rights and safety of our users. If the business is ever transferred to a new owner, your information would move with it under the same protections, and we would tell you first.

6. International transfers

Your account data is stored in the EU. OpenAI, Anthropic, Stripe, Google and Twilio SendGrid may process data in the United States. Where that happens, the transfer is protected by UK-approved safeguards: the UK–US Data Bridge where the provider is certified, or the UK International Data Transfer Addendum to the standard contractual clauses.

7. How long we keep data

  • Account data: while your account is open.
  • Product telemetry: 12 months, then deleted.
  • AI responses: up to 15 minutes.
  • Server logs: up to 14 days.
  • Feedback and support messages: 2 years.
  • Billing records: 6 years after the end of the tax year they relate to, as UK tax law requires.

When you delete your account, your personal data is removed within 30 days and from backups within 90 days. Telemetry events you generated stay only in anonymous form: your account ID is removed from them.

8. Your rights

Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Much of this you can do yourself in the app: Account > Settings has data export and account deletion. Your manuscripts are already on your device, so the account export covers account data rather than chapter text. For anything else, email novellierdev@gmail.com. We will reply within one month. We do not make automated decisions that have legal or similarly significant effects on you.

9. Children

Novellier is for people aged 13 and over. If you are under 18, you need a parent or guardian's permission to create an account or buy a plan. If we learn that an account belongs to someone under 13 we will delete it. Parents and guardians can contact us to review or remove a child's data.

10. Cookies and storage on your device

This website does not use cookies. The web editor stores your projects and your sign-in on your own device using browser storage; this is essential for it to work and is never used for tracking. Stripe and Google may set their own cookies while you check out or sign in with them, under their own policies.

11. Security

All connections are encrypted with HTTPS. Passwords are stored only as secure hashes, Google tokens are kept server-side with restricted access, and administrative access to our systems is limited and protected. If a breach puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.

12. Changes to this policy

We will update this page when our practices change and show the new date at the top. If a change is significant, we will also tell you in the app or by email.

13. Complaints

Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Who we are

Novellier is a trading name of Leon Dean, a sole trader in the United Kingdom. You can contact us at novellierdev@gmail.com, or through the feedback option inside the app.