Privacy Policy

Effective and last updated: October 28, 2026

1. Who we are and what this covers

This policy explains how ScribeLoom (“we,” “us”) collects, uses, and shares personal information when you use our website, iOS app, and related services (the “Service”). We are responsible for your information (the “controller”). Questions or requests: support@scribeloom.com. The Service is for people 18 and older, and it’s run from the United States.

2. Information we collect

You give us

• Account: your email address and password (the password goes to our sign-in provider, Auth0; we never see it).
• Profile: the author name you choose to show on public books (optional).
• What you ask for: book topics, story choices (such as genre, characters, tone, and things to avoid), and chat messages. Please don’t include sensitive personal information about yourself or others in requests.
• Settings: book visibility, narration voice, and books you save to your library.
• Payments: when you subscribe, you enter your name, card, and billing address directly with Stripe.
• Messages to us: what you send to support, including reports about books.
• Your privacy choices: whether you agreed to or turned off usage measurement and sharing with advertising platforms (section 8).

We create for you

• Books, outlines, chapter drafts and revision history, story planning notes, read-aloud audio, and book covers (an AI-drawn image of each book with a one-sentence description of it for screen readers).
• Your plan, subscription status, book credit history, and records of which versions of our Terms and this policy you accepted (including your confirmation that you’re 18 or older).

Collected automatically

• Usage and reading activity: pages you visit on our website, buttons and links you use, how far you read each chapter and for how long, how far you scroll our home page and book pages, which parts of them you see, and for how long, when you use read-aloud, when you sign in and out, when you send a chat message (not what it says), steps you take when creating a book, and what you search for: the search words (with email addresses, web addresses, and long numbers removed), the filters you choose, how many results come back, and which result you open. On our website we link this to a random ID stored in a cookie and, when you’re signed in, to a separate random analytics ID for your account. Apart from search words, these records don’t contain your name, email address, the text of books, or what you type. Our iOS app doesn’t collect this yet.
• How you found us: the ad, email, or website that sent you to ScribeLoom, from the link you followed (campaign tags such as utm_source, the referring website, and the click IDs that ad platforms add to their links, such as gclid, fbclid, and ttclid).
• Device and approximate location: browser, operating system, and device type, and the country we work out from your IP address (IP geolocation by DB-IP). We don’t keep your IP address in these usage records.
• Logs: IP address, browser or device type, pages and features used, request IDs, timings, and error and crash reports from the website and app, linked to your account ID and, in the app, to a random ID for that installation. Our application logs don’t contain your requests, book text, email address, or passwords. Our load balancer’s access logs record the web addresses you visit, which can include search words you type into ScribeLoom search.
• Cookies and device storage: see section 7.

From others

• Auth0 tells us whether your email is verified. Stripe tells us about your subscription and payments (not your card number).

3. How we use it

• To provide the Service: write, store, show, and read aloud your books; run chat; show public books and search.
• To manage your account, trial, subscription, and book credits, and to send service messages (for example, verification emails, an email when a book you created is ready, receipts, and notices about changes to our Terms or prices).
• To keep the Service secure and fair: prevent abuse, fraud, and free-trial misuse; enforce our Terms.
• To fix problems and improve quality, cost, and reliability, using logs and AI request traces.
• To give support and fix problems with a book: authorized ScribeLoom staff can view a book and repair it (for example, replace a cover that failed or correct a chapter). This access is limited to the people who need it and every change is logged.
• To understand how people use and read the Service so we can improve it and write books people enjoy: for example, which chapters readers finish, where they stop, and whether they come back.
• To measure and improve our marketing: which ads, emails, and websites bring people to ScribeLoom, and whether those visits lead to sign-ups and subscriptions. To do this we tell advertising platforms about some sign-ups and subscriptions (section 5), so they can report how our ads performed and show our ads to people more likely to be interested.
• To comply with the law and respond to lawful requests.

We don’t sell or rent personal information, show ads in the Service, or use your content to train AI models. We do “share” limited information with advertising platforms for cross-context behavioral advertising, as California law defines that term (section 5), and you can opt out (section 8). Your reading activity can include romance and other mature books, which could say something personal about you. We use it only to run and improve the Service and our books. We never use it to infer things about you, and we never send it to advertising platforms. We don’t make decisions with legal or similarly significant effects about you based only on automated processing.

4. How AI processing works

To write your books and chat replies, and to compare two versions of a revised chapter, we send your requests and the relevant book text to AI models from OpenAI (GPT), xAI (Grok), and Anthropic (Claude) through Amazon Bedrock in the United States. Which model handles a request depends on the task and the book. Under Amazon’s terms for Bedrock, these requests aren’t used to train the models and aren’t shared with the model providers. To read chapters aloud, we send chapter text to Amazon Polly. We keep traces of AI requests in Langfuse for 30 days to monitor quality and cost.

To draw each book’s cover, our AI first writes a short art description from the book’s details (its title, genre, story choices, and chapter summaries), and we send that description to OpenAI’s image model through OpenAI’s own service. We never send that service your chapters, chat messages, email address, or account ID. OpenAI doesn’t use requests to its API to train its models, and keeps them for up to 30 days to detect abuse (longer only if the law requires it or to prevent harm). Covers are stored with your book and deleted with it.

5. How we share it

• Service providers that process information for us under contract (table below).
• Advertising platforms: when you sign up, start your free trial, or start a paid subscription, and you haven’t opted out (section 8), our servers send that event to the advertising platform whose ad brought you to ScribeLoom, and to the others we advertise on so they can match it. We send: what happened (for example, “sign-up” or “subscription”) and when, the subscription price, the click ID from their ad if you arrived from one, a one-way hash of your email address (so they can match it to an account you have with them), your IP address and browser type, and a random event ID. We never send which books you read or write, your book topics, or anything you type. We don’t put advertising platforms’ tracking code (such as pixels) on our website or app. These platforms use the information under their own privacy policies, including to measure ads and to choose who sees ads, and they may combine it with other information they have about you (table below).
• Public books: if you make a book public, its title, description, chapters, and your author name and author ID can be seen by anyone and found in ScribeLoom search. We currently ask search engines not to index book pages, but we can’t control copies other people make. We also keep a copy of public books’ titles, categories, and chapter counts in our usage records, to report which books people read.
• Legal and safety: when required by law or a valid legal process, or to protect the rights, safety, or property of users, us, or others (for example, reporting child sexual abuse material as the law requires).
• Business transfers: in a merger, acquisition, or sale of assets, subject to this policy.
• With your direction, or as you choose in the Service.

Stripe also uses payment information for its own purposes, such as fraud prevention, under the Stripe Privacy Policy. We work out your country from your IP address on our own servers, with a downloaded database; nothing is sent to its provider.

6. How long we keep it

When you delete a book, it’s removed from the Service right away, including its audio. When you delete your account, we delete your Stripe customer record (which cancels your subscription; Stripe keeps records of past payments as the law requires), delete your books and account data, and delete your sign-in account. Copies in backups and logs, consent records, the trial hash, de-identified usage records, and information already sent to advertising platforms are kept only as described above.

7. Cookies and device storage

We use cookies and storage in your browser for two reasons: to make the Service work, and (where you allow it) to measure how the Service and our ads are used. We don’t load analytics or advertising code from other companies on our website, such as Google Analytics or ad pixels; all measurement goes through our own servers, and only the sharing described in section 5 reaches advertising platforms.

Browser storage (not cookies): where you stopped listening, unfinished story choices, notices you dismissed, your confirmation that you’re 18 or older for adult books, whether measurement is allowed in the current tab, and a random ID that groups error reports from one tab.

In the EU, UK, and Switzerland (and when we can’t tell where you are), we don’t set measurement cookies until you agree. Elsewhere they’re on unless you turn them off in Your Privacy Choices. We don’t respond to “Do Not Track” signals, because there’s no agreed standard for them. We honor Global Privacy Control: if your browser sends it, we treat it as a request to opt out of sharing with advertising platforms, and we save that on your account when you’re signed in.

8. Your choices and rights

• Your Privacy Choices: a link in the footer of every page and in Settings lets you turn off usage measurement and sharing with advertising platforms. In the EU, UK, and Switzerland both are off unless you agree, and you can withdraw your agreement there at any time. When you’re signed in, your choice is saved to your account, so it applies on all your devices and to events our servers send for you (such as when a subscription starts). When you’re not signed in, it applies to the browser you set it in.
• In the Service: change your author name, make books private (paid plans) or public, delete books, download your books as Markdown files, cancel your plan, and delete your account in Settings.
• By request: email support@scribeloom.com from your account email to ask for a copy of your information, to correct it, to delete it, or to object to or restrict how we use it. We’ll verify your request and answer within 30 days (we may extend this where the law allows and will tell you why). You won’t be treated differently for using these rights. If we decline, you can appeal by replying to our answer.
• Authorized agents: someone you authorize may make a request for you; we’ll ask for proof.

These rights are available to everyone, wherever you live. Residents of California and other U.S. states with privacy laws, and people in the European Economic Area, the United Kingdom, and Switzerland, have these rights under their local laws.

9. Users outside the United States

We process and store information in the United States, where privacy laws may differ from yours. Where the GDPR or UK GDPR applies, our legal bases are: contract (to provide the Service and your subscription); legitimate interests (security, abuse prevention, fixing and improving the Service, which we balance against your rights); legal obligation (tax and accounting records, legal requests); and consent for measurement cookies and usage measurement, sharing with advertising platforms, and anywhere else we ask for it. You can withdraw consent at any time in Your Privacy Choices; that doesn’t affect what we did before. Transfers to the United States rely on our providers’ safeguards, such as the EU Standard Contractual Clauses or the Data Privacy Framework, where they apply. You can complain to your local data protection authority, though we’d appreciate the chance to help first.

10. Security

We encrypt information in transit (HTTPS) and at rest, limit access to the people and systems that need it, and never store card numbers. No system is perfectly secure; if a breach affects your information, we’ll tell you and the authorities as the law requires.

11. Children

The Service isn’t for anyone under 18, and we don’t knowingly collect information from children. If you believe a child has given us information, email support@scribeloom.com and we’ll delete it.

12. California notice

In the past 12 months we collected these categories of personal information: identifiers (email, account ID, analytics and cookie IDs, IP address, ad click IDs); commercial information (plan and purchase history); internet or other electronic network activity (logs and usage of the Service, reading activity, how you found us); approximate geolocation (country from your IP address; not precise location); inferences (none); and content you provide (requests and messages). We collect them from you, your device, and the providers above, for the purposes in section 3, and disclose them to the service providers in section 5.

Selling and sharing. We don’t sell personal information. We “share” these categories with advertising platforms (Meta, Google, TikTok) for cross-context behavioral advertising: identifiers (a one-way hash of your email, ad click IDs, IP address), internet activity (that you signed up, started a trial, or subscribed), and commercial information (the subscription price). To opt out, use Your Privacy Choices or turn on Global Privacy Control. We don’t knowingly sell or share the personal information of anyone under 16 (the Service is for adults). We don’t use or disclose sensitive personal information to infer characteristics about you. See section 8 to exercise your rights.

13. Changes to this policy

If we make material changes, we’ll tell you at least 30 days in advance by email or in the Service and ask you to review the new policy. The date at the top shows when it last changed. See also our Terms of Service.

Contact

Privacy questions and requests: support@scribeloom.com.