Privacy
Your stories are yours and private to your account. This page says what we keep about you, why, who handles it for us, and how to have it removed.
Who we are
ProseSpun is a fiction writing app at app.prosespun.com, with this site at prosespun.com. The controller of your personal data is Umut Koseali, Krausenstraße 22, 10117 Berlin, Germany. You can reach us about privacy at info@prosespun.com.
ProseSpun is run by one person, so there is no Data Protection Officer. Write to the address above and it reaches the controller directly.
What we collect and why
This site. prosespun.com has no account, no forms and no analytics. It loads nothing from other companies; even the fonts are served from our own address. The only thing it may store in your browser is the cookie choice you make here.
Your account. To give you an account we keep your email address, your password as a one-way hash (never the password itself), and whether you have confirmed your email. We use the email to sign you in and to send you the messages an account needs: a confirmation link when you sign up, a reset link when you ask for one, and a notice if someone tries to sign up with your address. We send no newsletters or marketing email. Legal basis: performing our contract with you.
Your writing. We store what you write and keep in the app: stories, chapters, scenes, cards, and the notes and summaries the app keeps about your story so it can remember it. Your stories are yours and private to your account. Legal basis: performing our contract with you.
Keeping accounts safe. For each browser you are signed in on, we store a session record with the IP address and browser description (user agent) it signed in from. To stop people guessing passwords, we count requests to our sign-in system (signing in, signing up, password resets) per IP address. A password-reset link is stored until it is used, and works for one hour. Legal basis: our legitimate interest in protecting your account and the service.
Where you came from. If you arrive at sign-up from one of our ads or links, the link can carry a few labels naming the campaign (for exampleutm_source or utm_campaign). When you create your account we store those labels with it, once, so we know which campaigns bring writers. We store nothing else with them: no IP address and no browser description. They are deleted with your account. Legal basis: our legitimate interest in knowing which of our campaigns work. On prosespun.com these labels are only passed along in the link; nothing is stored on your device.
Settings. Which model you have chosen for each writing task.Legal basis: performing our contract with you.
We do not sell your data, we do not use it for advertising, and we do not build profiles of you.
The writing tools
When you select text and ask for a proposal, or when the app reads your story to keep its cards and summaries current, the text it needs is sent to the language model server the app is set up to use. Today ProseSpun sends your writing to no outside AI company. If that changes, we will update this page before it does, and name the provider here.
Cookies and similar technology
On prosespun.com we set no cookies. If you make a cookie choice, we remember it in your browser's local storage under prosespun:consent, along with the date you made it. That is strictly necessary, so it needs no consent.
We ask before we use anything optional. The categories are analytics (counting visits) and marketing (telling an ad platform a visit came from one of our ads). Both are off unless you turn them on, and today we use neither, which is why you have not seen a banner. If we start, we will ask first and list them here.
In the app, at app.prosespun.com, these cookies are used. They are set only on app.prosespun.com and are never sent to this site.
| Name | What it does | Lasts |
|---|---|---|
__Secure-better-auth.session_token | Keeps you signed in. Needed for the app to work. | 30 days, renewed while you use the app |
__Secure-better-auth.session_data | A signed copy of your session, so pages load without a database lookup. Needed. | 5 minutes |
prosespun_pending_email | Shows the address you just signed up with on the "Check your email" page. | 1 hour |
prosespun_last_email | Fills in your email on Sign in right after you sign out. | 10 minutes |
prosespun_sign_in_line | A number that picks which line of text the Sign in page shows. It holds nothing about you. | Until you close your browser |
The app also keeps a few things in your browser's own storage, on your device only: your light or dark theme, whether proposals show changes or clean copy, notes held for a scene, and an unsaved draft of a scene if a save could not finish.
Who processes your data, and where
Cloudflare runs ProseSpun for us. The app runs on Cloudflare Workers, your account and writing are stored in a Cloudflare D1 database located in Western Europe, our emails are sent through Cloudflare Email Sending, and this site is served by Cloudflare.
We use no analytics, advertising, error-tracking or session-recording services.
International transfers
Your stored data is kept in Western Europe. Cloudflare handles each request in the data centre nearest to you, which can be outside the EEA or the UK. Where data leaves the EEA or UK, it is protected by Cloudflare’s Data Processing Addendum, which includes the European Commission’s Standard Contractual Clauses and the UK addendum to them; Cloudflare is also certified under the EU–US Data Privacy Framework.
How long we keep it
- Your account and writing: until you delete your account. In the app, go to Settings → Account → Delete account. It asks for your password and then deletes your account, your sessions, your settings and everything you wrote, at once.
- A sign-in session: it stops working 30 days after you last used it. Signing out deletes it, and so does the next visit after it has run out.
- A password-reset link: deleted when you use it; it stops working after 1 hour.
- Attempt counts per IP address: deleted once 24 hours pass without a request from that address. Unused reset links: deleted once they expire. Sessions on a browser you never came back to: deleted within about a day of expiring. These clean-ups run as the sign-in system is used, so a record can outlive its limit a little while nobody signs in. Attempt counts and reset links are not tied to your account, so deleting your account does not remove them; they go on the same schedule.
- Backups: deleted data can stay in database backups for up to 30 days (the point-in-time recovery window of our database), after which it is gone.
Your rights
Under the GDPR and the UK GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- correct it if it is wrong (your writing you can edit yourself);
- delete it: delete your account in Settings, or ask us;
- restrict how we use it, or object to uses based on our legitimate interests;
- take it with you in a machine-readable form (data portability);
- withdraw consent at any time, for anything that relies on it, as easily as you gave it.
The app has no export or change-of-email feature, so for those, and for anything else above, write to info@prosespun.com. We answer within one month.
You can also complain to a data protection authority: the one where you live or work, or ours: the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit,datenschutz-berlin.de). In the UK that is the Information Commissioner's Office (ico.org.uk).
Children
ProseSpun is not meant for children under 16, and we do not knowingly hold their data. If you believe a child has made an account, write to us and we will delete it.
Changes to this policy
When we change what we collect or who handles it, we update this page and the date at the top first. If we start using something that needs your consent, we ask before it runs.
Contact
Umut Koseali, Krausenstraße 22, 10117 Berlin, Germany. Email info@prosespun.com.