Privacy Policy

StoryHelm ("StoryHelm", "we", "us") provides the StoryHelm manuscript-intelligence service and is the controller of the personal data described in this policy.

You can reach our privacy team at [email protected]. Our registered mailing address is PO Box 352, Grantsville, UT 84029.

We collect the following categories of information.

• Account and authentication. Your Google sign-in identifier and the authentication metadata that comes with it (such as the timestamps and tokens that keep you signed in securely).
• Sign-up bot check. When you sign up with an email and password and our bot check is turned on, Cloudflare Turnstile receives your IP address and browser and connection signals (such as your browser's User-Agent) to confirm that a person, not a bot, is signing up. Google sign-up is not checked.
• Profile. The name, email address, and any optional details you add to your StoryHelm profile.
• Manuscript content and derived insight. The prose, notes, and project files you upload or write in the built-in editor, together with the findings, canon, scene data, and other analysis StoryHelm derives from them.
• Collaboration data. The email addresses of collaborators you invite and the shared canon and comments produced when you work together.
• Usage and analytics. Information about how you use the product, such as pages visited, features used, and device and browser details. Product analytics and session replay are consent-gated and off by default.
• Billing. Your Stripe customer and subscription identifiers and the credit and LLM-spend ledger that tracks the analysis you run. Card numbers are handled by Stripe; we do not store full card numbers. Where a purchase is sold through Link, Stripe's reseller service, Link is the seller and receives the billing and transaction details it needs to sell, invoice, and collect tax on that purchase (see Section 7).
• Translation jobs. When you use Translation Studio, the source text, the language pairs you select, and the resulting translation records.
• Support communications. The messages, attachments, and context you send when you contact us for help.
• Cookies and device data. Identifiers and settings stored on your device. See our Cookie Policy for the full list.

We use your information for the purposes below. Where the GDPR or UK GDPR applies, the lawful basis for each purpose is shown.

• Performance of our contract with you. Creating and securing your account, delivering the analysis, findings, canon, and translations you request, enabling collaboration, and processing your subscription. We cannot provide the service without this.
• Our legitimate interests. Keeping the service safe and reliable (fraud prevention, abuse detection, security monitoring) and improving the product. We balance these interests against your rights, use de-identified or aggregated signals wherever we can, and never use your manuscript prose to train models. You can object to processing based on legitimate interests at any time.
• Your consent. Non-essential cookies, product analytics and session replay, and marketing communications. These are off until you opt in, and you can withdraw consent at any time without affecting the lawfulness of earlier processing.
• Legal obligations. Meeting tax, accounting, and other legal requirements, for example retaining billing records.

We believe authors deserve a clear answer about what happens to their words, so here it is in plain language.

When you run an analysis or a translation, the relevant manuscript text and the context derived from it are sent from your browser to our servers, which are hosted on DigitalOcean, and from there to Anthropic, PBC's Claude API. StoryHelm is the multi-agent system that produces your read: a 61-pass analysis across 7 workflows, powered by Claude. Your prose does not stay only on your device, and we will never tell you that it does.

Grammar checking. When you run a grammar check in the editor, the text you are checking is sent from our servers to LanguageTool, run by Learneo, Inc. in the United States, along with the language and the rule settings you chose. It carries no name, email or account identifier, and nothing is sent unless you press Check. We use LanguageTool's public service, which has no separate data processing agreement with us. LanguageTool states that it does not use inputs to train its models; we do not control how long it keeps them.

Training. Neither StoryHelm nor Anthropic, PBC trains any model on your manuscripts. Under Anthropic's commercial terms, the Claude API does not train on inputs or outputs by default.

Retention at the provider. Training and retention are different things. By default, Anthropic automatically deletes API inputs and outputs within 30 days of receiving or generating them. Some of our analysis runs through Anthropic's Message Batches API, which stores a batch's requests and results for up to 29 days after the batch is created. Prompt caching adds no stored copy of its own: Anthropic holds a temporary cache of repeated context in memory for five minutes, or up to one hour, and then deletes it. Anthropic may keep data longer where the law requires it, and if its automated safety systems flag content as violating its Usage Policy, it may keep those inputs and outputs for up to 2 years. We do not currently operate under a Zero-Data-Retention agreement, so we describe this honestly rather than claiming your text is never stored.

See our Subprocessors page for the full list of providers and the role each one plays.

You retain 100% of the copyright and all other rights in your manuscripts. To provide the service, you grant us a limited license to host, process, and transmit your content to the subprocessors that make analysis, collaboration, and translation work. That license exists only to run StoryHelm for you and ends when you delete the content or close your account.

We never sell your work, and we never use it to train AI models. StoryHelm reads and analyzes; it does not write your prose. Every word of your manuscript remains yours and human-authored. The one exception is a translated edition produced in Translation Studio, where the translated text is machine generated rather than yours, so label and disclose that edition accordingly.

We rely on a small set of trusted service providers to host the platform, run analysis, process payments, authenticate sign-in, protect sign-up from bots, and measure consent-gated analytics. Each one acts on our instructions under a written agreement and is bound by appropriate data-protection terms. Stripe processes payments. Where a purchase is sold through Link, Stripe's reseller service, Link is the seller of that purchase, not only our processor: for the billing and transaction details it needs to sell, invoice, and collect tax, it is an independent controller. When the sign-up bot check is on, Cloudflare processes its signals for us to tell people from bots, and is an independent controller when it uses them to improve Turnstile's bot detection.

The complete, current list, including each provider's purpose, the data it handles, and its processing location, is maintained on our Subprocessors page.

We do not sell your personal information. We share it only in these limited circumstances.

• Subprocessors. The service providers described above, acting on our behalf to deliver the service.
• Payment reseller. Where a purchase is sold through Link, Stripe's reseller service, Link receives the billing and transaction details it needs to sell, invoice, and collect tax on that purchase, as the seller and an independent controller for them, not only our processor.
• Sign-up bot check. When the sign-up bot check is on, Cloudflare uses the signals it receives from the password sign-up form to improve Turnstile's bot detection, as an independent controller for that use.
• Legal process. When we are required to do so by law, regulation, legal process, or enforceable governmental request, or to protect the rights, safety, and security of our users, the public, or StoryHelm.
• Business transfer. In connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy and will notify you of any change in control of your data.

StoryHelm is operated from, and your data is hosted in, the United States, in DigitalOcean's New York (NYC3) region. If you access the service from the European Economic Area, the United Kingdom, or another region, your information is transferred to the United States and to our subprocessors there. When the sign-up bot check is on, Cloudflare may handle it anywhere on its global network.

Where required, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with appropriate technical and organizational safeguards, to protect those transfers.

We keep personal data only as long as we need it for the purposes described in this policy, then delete or anonymize it. Our standard retention periods are below; we may keep data longer where the law requires it or to resolve disputes and enforce our agreements.

We protect your data with encryption in transit (TLS 1.2 or higher) and at rest, role-based access controls, and the principle of least privilege for access to production systems. We monitor for abuse and review our controls regularly.

We are working toward SOC 2 Type II as our security program matures. No method of transmission or storage is perfectly secure, so we encourage you to use a strong, unique sign-in and to report any concern to [email protected]. You can learn more on our Security page.

Depending on where you live, you have rights over your personal data. We honor these rights regardless of where you are based.

If you are in the EEA or the UK (GDPR / UK GDPR), you have the right to:

• be informed about how we process your data;
• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• erase your data (the right to be forgotten);
• restrict processing in certain circumstances;
• data portability, to receive your data in a portable format;
• object to processing based on our legitimate interests or to direct marketing; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

You can download an export of your account data yourself from Settings under Data & export. It holds your profile, your books and what you wrote in them, your settings, your usage and purchases, and your review records. It leaves out StoryHelm's own analyses of your books and its machine translations, and it lists the files you uploaded rather than attaching them. For a copy of anything it leaves out, or to exercise any other right, including deleting your data, email [email protected]. We may need to verify your identity before acting, and we aim to respond within about 30 days. You also have the right to lodge a complaint with your local supervisory authority, though we ask that you contact us first so we can try to resolve the issue. For more detail, see our GDPR & UK GDPR page.

If you are a California resident (CCPA / CPRA), you have the right to:

• know what personal information we collect and how we use and share it;
• delete the personal information we hold about you;
• correct inaccurate personal information; and
• opt out of any sale or sharing of personal information. We do not sell or share your personal information in this sense.

We will not discriminate against you for exercising any of your privacy rights.