Privacy policy

Last updated: 1 November 2026

This policy explains what information Plothold collects when you use plothold.com and app.plothold.com, why, who else handles it, and what you can do about it.

Who we are

Plothold is run by Daniel Dewhurst, an individual in the United Kingdom (“we”, “us”). We are the data controller for the information described here. To contact us about your information, email hello@plothold.com. Our postal address is 6A Marsh Green Road, Sandbach, Cheshire, CW11 3BH, United Kingdom.

What we collect

Your account. Your email address, and when you made the account. If you sign in with Google, also your name, your Google account ID and the address of your profile picture. We do not keep the access tokens that Google sends at sign-in.
Your preferences. Whether you turned on Explain the craft (on the Account page, or in the guided start of a new book), and whether the guided start has offered it to you. We keep them with your account, so that the writing partner follows them on every device. When Explain the craft is on, the writing partner's instructions, which go to the AI host with each chat message, ask it to explain why its suggestions work; they hold nothing else of yours. We delete your preferences when you delete your account.
Your co-writers. If you invite other writers to write one of your books with you, we keep each one's email address, as “If a writer invites you to write a book with them” describes below, and Resend sends them an invitation with your name (your account's name, or your email address if it has none) and the book's title. Your co-writers see your name. In a book with co-writers, each chat message and each version carries the user ID of the writer who sent or saved it, and the writing partner gets the writers' names with each message (a number for a writer whose account has no name, never an email address). The notes from your beta readers and editors are part of the book, so your co-writers see them too, and can ask the writing partner to sort them.
Your writing. Your books: chapters, characters, notes and the other files in them, your chats with the writing partner, and a version history of each book. If you ask the council to review a chapter: its last review of each chapter (the scores, what the AI models said and the points to fix), which is part of that book and its backups, but not of its version history. If you ask the AI readers to read some chapters (Before your readers, on the Readers tab): what each AI reader said about each chapter, as notes in a feedback round of their own, marked as simulated, which are part of that book, its version history and its backups like readers' notes; and the last read as the page shows it, with the summary and the points, which is part of that book and its backups, but not of its version history. If you ask for an editorial letter: the last letter of each book (what it says about the book, the tasks it proposed, the day it was written and which text of the book it read), which is part of that book and its backups, but not of its version history. Your revision plan (its tasks, with their notes and chapters, and which you have ticked done) is part of that book, in its version history and its backups. If you make a book cover: the cover you keep, which is part of the book and its version history, and the drafts that you have not kept. We delete a draft within 25 hours after we make it (we check every hour), or earlier when you keep a cover or remove it. If you put a name on a book (your own or a pen name) and contact lines for a standard manuscript (such as your legal name, postal address, email address and phone number), they are part of that book, in its version history and its backups like the rest of it. The standard manuscript download and the query letter (on the page, copied or downloaded) print the contact lines; the other downloads and a reading link's copy print only the name, and a cover has neither. The pages that you add before and after the story (a dedication, an epigraph, acknowledgements, About the author, Also by and the copyright line) are part of that book in the same way, in its version history and its backups. A reading link's copy has the dedication and the epigraph but none of the other pages (a link started before 30 October 2026 keeps the copy as it was built then). The name goes in the summary of the book that each chat message carries; the writing partner can read the contact lines too, as it reads the rest of the book's details. If you name a version of a book as a draft (such as “Draft 2” or “Sent to my editor”), its name and note are part of that book's version history and its backups; when you take the name off, the version stays. The names of your drafts, but not their notes, go in the summary of the book that each chat message carries, and the writing partner can read a named draft's text, as it was when you named it, also text that you have since deleted from the book. Your voice (a sample of your own prose of up to 600 words, how your sentences, description and dialogue lean, the words you never want, and a few lines that describe it) is part of that book in the same way, in its version history and its backups. The leanings and the words you never want go in the summary that each chat message carries; the writing partner reads the sample and the description as it reads the rest of the book. When you take the sample from a chapter, or save one, Plothold reads the version history of the chapters on our server to say which paragraphs the writing partner wrote; nothing more is sent anywhere.
Your writing. Your books: chapters, characters, notes and the other files in them, your chats with the writing partner, and a version history of each book. If you make a book cover: the cover you keep, which is part of the book and its version history, and the drafts that you have not kept. We delete a draft within 25 hours after we make it (we check every hour), or earlier when you keep a cover or remove it. If you put a name on a book (your own or a pen name) and contact lines for a standard manuscript (such as your legal name, postal address, email address and phone number), they are part of that book, in its version history and its backups like the rest of it. The standard manuscript download and the query letter (on the page, copied or downloaded) print the contact lines; the other downloads and a reading link's copy print only the name, and a cover has neither. The pages that you add before and after the story (a dedication, an epigraph, acknowledgements, About the author, Also by and the copyright line) are part of that book in the same way, in its version history and its backups. A reading link's copy has the dedication and the epigraph but none of the other pages (a link started before 30 October 2026 keeps the copy as it was built then). The name goes in the summary of the book that each chat message carries; the writing partner can read the contact lines too, as it reads the rest of the book's details. If you give a character, place, object or group a picture, or put pictures on a book's mood board, the pictures and their captions are part of that book, in its version history and its backups like the rest of it. Your browser makes each picture smaller and leaves out the details a camera adds (such as where and when a photo was taken) before it sends it, and we do the same again when it arrives. We never send your pictures or their captions to the writing partner, to the AI model or to anyone else, and no download of a book has them; the zip of all your books does. We delete them when you delete the book or your account.
Your writing. Your books: chapters, characters, notes and the other files in them, your chats with the writing partner, and a version history of each book. If you make a book cover: the cover you keep, which is part of the book and its version history, and the drafts that you have not kept. We delete a draft within 25 hours after we make it (we check every hour), or earlier when you keep a cover or remove it. If you put a name on a book (your own or a pen name) and contact lines for a standard manuscript (such as your legal name, postal address, email address and phone number), they are part of that book, in its version history and its backups like the rest of it. The standard manuscript download and the query letter (on the page, copied or downloaded) print the contact lines; the other downloads and a reading link's copy print only the name, and a cover has neither. The pages that you add before and after the story (a dedication, an epigraph, acknowledgements, About the author, Also by and the copyright line) are part of that book in the same way, in its version history and its backups. A reading link's copy has the dedication and the epigraph but none of the other pages (a link started before 30 October 2026 keeps the copy as it was built then). The name goes in the summary of the book that each chat message carries; the writing partner can read the contact lines too, as it reads the rest of the book's details. If you keep a list of where you sent a book (Submissions, on the Plot tab), it holds the names of the agents, editors, publishers, magazines and contests that you add, the dates, what you sent, their answers and your notes. It is part of that book, in its version history and its backups, and restoring an earlier version of the book leaves it as it is. An entry that you delete stays in the version history until the book is deleted, as other deleted text does. The writing partner cannot read it, and no chat message or summary of the book contains it, so it never goes to OpenRouter or an AI host. Your browser does not keep a copy of it for use with no connection.
What-ifs. If you start a what-if of a book (a copy of it where you try a big change), it is a copy of that book's text, story bible and pictures in your account, beside the book, with its own chat and its own version history. It has none of the book's readers' or editors' notes, its list of submissions, its cover or its goal. The summary of the book that each message in the what-if's chat carries says that it is a what-if, what it tries, and the title of its book; while it is open, the summary that each message in the book's own chat carries says what it tries too. When you keep it, its text, story bible and pictures replace the book's in a new version of the book, which keeps the book as it was in its version history, and the what-if, its chat and its version history are deleted. When you drop it, or delete its book, they are deleted too. While you have it, it is in the backups and in the zip of all your books, as a folder of its own.
Sign-in and security records. For each signed-in session: your IP address, your browser’s user agent, and when the session was last used (we note it at most once an hour). The Account page lists your sessions, with the browser and the kind of device that each user agent names and when each was last used, so that you can sign out of a device that you lost or shared; it never shows the IP address. A session ends 30 days after you sign in, or earlier when you sign out, and we delete its record within an hour after it ends. Counters that limit how often an IP address can try to sign in, deleted after a day. Counters that limit how often an IP address can open a checkout or manage a plan, kept in memory for a minute. A record of the sign-in emails sent to each address, deleted after 24 hours.
Usage counts. How many chat messages you send each day (a council review of a chapter that you ask for under the chapter counts as one; one that you ask the writing partner for in the chat is part of that message; a read by the AI readers counts as one; an editorial letter counts as one for each 20,000 words of the book's text, or part of them), so we can apply the daily limit, and so we can count, as totals only, how many new writers send messages and come back (see “Why we use it”). We delete these counts after 90 days.
Your plan. When your free trial started, and how many messages and how much AI cost it has used. Whether we sent you the email before your trial ends, and when, and the language of Plothold's pages, so that the email is in it. If you pay for the plan: the start and end of the billing month you paid for, how many messages and how much AI cost that month has used, and whether you have paid before. If you buy extra messages: Polar's order number for each pack, the messages and AI cost it gives, when you bought it and whether it was refunded, and how many extra messages and how much AI cost you have used. We never see or keep your card details: Polar keeps them (see below). We delete this record when you delete your account.
The trial record. To give each person one free trial, we keep a code made from your email address, and the date your trial started. We make the code from the address in lower case, without a “+” tag, and for Gmail without dots and with googlemail.com as gmail.com, with a secret key, so that the code does not show the address. This record stays after you delete your account, so that the same address cannot start a second trial. We delete it two years after the trial started.
Server logs. When something fails, our server log keeps the error, so that we can fix it. It can hold your user ID, the short names of your books and of their files (made from titles and names), and what the error itself quotes: a line of your book, a few words of your chat with the writing partner, a reader's name, or your email address in an error from Polar. When too many sign-in emails go to new addresses, it holds the IP address that asked for the last one, so that we can stop a flood. Railway, which hosts Plothold, also logs each request to the server, which can include the address of the page, your IP address and your browser's user agent. Railway keeps both logs for a limited time, as its service sets.
Turn records. For each chat message, each council review of a chapter, each read by the AI readers and each editorial letter: when you sent it, which book it was for, the AI model (for a council review or the AI readers, the models), the version of Plothold that answered, where the message came from (you typed it, or it was a reply that the writing partner suggested, one of Plothold's own suggestions, a button in the book, the questions that start a new book, a council review, or Fix this feedback after one, a read by the AI readers, Send to your partner after one, an editorial letter, Work on this with the partner, for a task of your revision plan, or a question to a character in an interview), what the reply cost us, how long it took, whether it finished, and, if it stopped early or failed, which limit stopped it or what kind of error it was, how many files of your book it changed, and whether you undid its change, all of it or a part. For each request to the AI model in that reply: OpenRouter's ID for the request, the model and the AI host that answered, how many tokens (pieces of words) went in and out, what it cost, how long it took, and how many characters of earlier work in a long reply we cut from the request. For each tool that the writing partner used in that reply, such as the one that reads a file of your book: the tool's name, how many times it used it, how many of those failed, and how long they took, and for the story check and the writing guides (Story Skills and Better Writing), which command or guide. OpenRouter tells us some of these figures a few minutes after the request, when we ask it with that ID. They do not hold what you or the writing partner wrote, or the names of your files. We use them to set limits that match what Plothold costs to run, to count how many writers use Plothold, and to make the writing partner better. The owner sees them only as summary figures (totals, averages, spreads and highest values, how many writers wrote each day, how many writers used Plothold in a period and today, and these figures for each version of Plothold and each tool), never with your name, email or book titles. We delete them after 90 days, or when you delete the book or your account.
Daily totals. A day after each day ends, we add up that day's turn records and cover records, except the owner's, into totals for the whole day: how many writers used Plothold, how many chat messages there were and how many of them failed, stopped early, reached a limit, changed a book, were undone or came from a suggested reply, how many requests to the AI model, tokens and tool calls there were and how many tool calls failed, how many covers there were, and what it all cost. The totals hold no user ID, name, email or book, and nothing in them links them to your account, though on a day when few writers used Plothold a total can describe one writer's day. The owner sees them by month. We keep them after the records they come from are deleted, to see how Plothold changes over time.
Uses of Plothold's parts. When you use a part of Plothold from a fixed list on a day (open a book, open a tab of the book's panel, show the chapters as a board, open a chapter's scenes, Search, Read the book, First and last lines, Read through, focus mode, a writing sprint, set a goal, save your voice, change the style sheet, the book cover, Submissions, start a readers' link, start an editor's link, invite a co-writer, bring in a draft, explore the sample book, name a draft, a what-if, a comparison of drafts, a download, the paperback interior, the audiobook kit, or interview a character), the page tells our own server which part it was, and nothing more: never which book, your words or the address of the page. It tells us each part at most once a day, and nothing at all when you are offline. We keep your user ID with each part that you used that day, only so that we count you once a day, and we leave these records out of backups. Within an hour after the day ends (UTC), we add them up into a count of writers for each part on that day, which holds no user ID, name, email or book, and we delete the records with your user ID. The owner's own use is not counted. The owner sees the counts for a period, and we keep them, to see which parts of Plothold writers use. On a day when few writers used Plothold, a count can describe one writer's day.
Cover records. For each book cover that you make: when you made it, the trial or billing month it counts in, and what it cost us. They do not hold the picture or what you asked for. We use them to apply the cover limits, to see what covers cost us, and to count how many writers use Plothold. The owner sees them only as summary figures (how many covers were made, what they cost and how many writers made them, in all and for each day), never with your name, email or book titles. We delete them after 90 days, or when you delete your account.
Your feedback. When you use the Feedback button: your message, the mood you choose, the kind of page you sent it from (your books, a book or your account, but never which book), the language of Plothold's pages, and when you sent it. We keep your user ID with it, so that we can delete it with your account. We see your email address with it only if you tick the box that says we can reply. Your books are not sent with it. We delete it after one year, or earlier when you delete your account. We also get each one by email, with your email address only if you ticked the box. That copy stays in our mailbox, and in the sent-email log of Resend (see below) for the time its service sets. We delete our copy when you ask us to, as “Your rights” describes.
The link that brought you. Some links to Plothold carry a short name, such as “story-skills” for the link in the Story Skills guide. We choose the names in our own links, but a link from anyone can carry one, and we count it the same way. When you open Plothold from such a link, the page tells our own server that name, and nothing more, and we add one to that day’s count of visits with that name. The count holds no user ID, IP address or anything else about you. The page keeps the name in that browser tab only, until you close the tab, and sends it with your sign-in. If you then make an account, we keep the name with your account: only one, the first in that tab, and only for a new account. When you ask for a sign-in email to an address that has no account yet, we hold the name with that address for up to a day, until the link in the email makes the account, and we leave it out of backups; a later email to that address replaces it, or drops it if it has no name. We count visits from each IP address for an hour, in memory, to stop floods. We use the name to count, as totals only, how many visits each link brings and how far the writers who joined after one get. If few writers joined from a link, these counts can describe one writer. We delete the name with your account, and keep the daily counts of visits.
Error reports. When something fails in Plothold's pages in your browser, the page sends a short report to our own server, and to no one else: the error's message, cut to 200 characters, with web and email addresses, IDs (a book's is made from its title), long numbers and quoted text taken out (a single word in lower case can stay in quotes, because names in code look the same); where in Plothold's code it happened (the names of its functions and files, and the line numbers); whether the page crashed or an error went uncaught; the kind of page (your books, a book, your account, the sign-in page or the usage page), never which book; the version of Plothold; and the language of Plothold's pages. Our server adds the name and version of your browser and the kind of system it runs on (such as “Chrome 131 on Android”), from its user agent. A report does not hold your user ID, your email address or which book you had open, and we do not send your chapters, chats or titles with it. We keep each distinct error once, with how many times it was reported, the hour when it was first and last reported, and how many reports came from each kind of page, browser and language. We do not link it to your account. To limit how many reports can arrive, we count them in memory for an hour: for a signed-in session by your user ID, and without one by IP address. We use them to find and fix faults. The owner sees them on the usage page, and gets an email that says only that a new error was reported. We delete an error's record 90 days after it was last reported.

We do not use analytics, advertising or tracking tools from other companies, and nothing follows you to other sites. The counts above come only from our own records, on our own server. Two of them note what you do on Plothold's pages: the uses of Plothold's parts, above, which keeps your user ID only until the day is added up, and the link that brought you, which the page keeps in the browser tab, not in a cookie. Plothold sets a cookie for your sign-in session, and a short-lived cookie while you sign in with Google. Both are necessary for the service to work, so we do not ask for consent for them.

If you choose a language for Plothold's pages, your browser keeps that choice on your device. It sends us the language of the pages (your choice, or else your browser's) only with your feedback and error reports, when you ask for a sign-in email (so that the email is in that language), when Plothold opens (so that the email before your free trial ends is in that language), and when you subscribe or buy extra messages (for Polar's checkout). Without a choice, Plothold uses the language that your browser asks for. When you bring in a draft, you tell us the draft's language, and we keep it with that book. If you choose how the chapter text looks (its size, font, line width and line spacing), your browser keeps that choice on your device too, and never sends it to us. So do a choice to turn off the ? key that opens the list of keyboard shortcuts, a choice of a light or dark look for Plothold, and the choice of a soft sound at the end of a writing sprint. A writing sprint itself (its length, when it started, its pauses, the number of words you wrote in it and how it ended, never the words themselves) stays in that browser tab, so a reload keeps it, until you close it, sign out, or close the tab (a browser that reopens a closed tab, or copies a tab, can bring it back with the tab). We never receive it, and no history of sprints is kept. If you hide where a book is on its way, in its Chapters tab, your browser keeps that choice for that book on your device, never sends it to us, and forgets it when you sign out or delete the book. To show you where you left off when you come back to a book after a while, your browser also keeps, for each book, when you last had it open on that device and the chapter you last opened in it. It never sends this to us, and forgets it when you sign out or delete the book. A choice to turn that off for every book stays on your device too. When you read a whole book in Plothold, your browser keeps where you stopped reading in it on that device, so that you can go on from there. It never sends this to us either, and forgets it when you sign out or delete the book.

A message to your writing partner that you have started but not sent, changes to a chapter that you have not saved, a chapter that you saved while offline or on a connection too weak to save it at once, and a chapter that you added while offline, stay in your browser on your device, so a reload, a closed tab or a lost connection does not lose them. They stay until you send them or they reach your book, until you sign out, or until another person signs in to Plothold in the same browser. They also stay when your session ends, so that you have them when you sign in again. They reach us only when you send or save them. If you ask for a message to go when you are back online, your browser keeps that choice with the message and sends it then, as if you pressed Send. In browsers that can send in the background (such as Chrome and Edge), your browser also keeps the saved chapters that wait in a second place on your device, so that it can send them to your book when the connection comes back, also after you close Plothold; they go only to Plothold, only while you are the one signed in, and are deleted at the same times. For a chapter sent this way, your browser keeps only a code made from its text, never the text, until Plothold next opens. Plothold asks your browser to keep all of this on your device, and not to delete it to make room.

So that Plothold works with a weak connection or none, your browser also keeps the app's own files and its fonts, which hold nothing of yours. It keeps a copy of what Plothold last showed you: your account details (your name, your email address, your plan and your preferences), the list of your books, and the last 5 books that you opened, with their chapters, their panel and your chat with the writing partner. These copies stay only on your device, and we never receive them from it. Your browser deletes these copies when you sign out, also with no connection, and when another person signs in to Plothold in the same browser. When your session reaches its end date, Plothold deletes them the next time it opens, also with no connection. When you sign out on another device, sign this device out from the Account page on another one, or delete your account elsewhere, it deletes them the next time it opens in this browser with a connection. The messages, changes and chapters that have not reached your book stay on that device, as when a session ends, and so do the pictures of your covers, until someone signs in or out in that browser. It deletes a book's copy when the book is deleted or is no longer one of the last 5 that you opened. Anyone who can use your browser on that device can see them, so sign out on a computer that other people use. Plothold added to the home screen of an iPhone or iPad keeps its own copies, apart from Safari's, so sign out in each of them. If you sign out with no connection, your session ends the next time this browser opens Plothold with a connection. Your browser also keeps the pictures of your book covers, and the pictures you gave your books, that Plothold showed you, for up to one year. It deletes them when a sign-out or a sign-in in this browser reaches us, and when you delete your account. A tab that shows a book is titled with the book, so your browser's history keeps that title, as it keeps the titles of other sites you visit.

Read through, in the chapter editor, runs in your browser alone: it sends your chapter to no one, us included. Read aloud gives the text to your browser's own speech, and Plothold sends it to no one. It asks only for a voice that your browser says is on your device, because some browsers also offer online voices, which send the text to the browser's maker. Where speech is made in the end is up to your browser and your device: on some phones, the speech service chosen in the device's settings can use its maker's servers.

If a writer shares a book with you

A writer can send beta readers a link to a read-only copy of their book. If you read through such a link:

What we keep. The name you type and the notes you send. They go into that writer's book, where the writer reads them, and so do the other Plothold writers whom the writer invited to write that book with them (co-writers). If the writer or a co-writer asks the writing partner to sort the notes, your name and notes go to the AI model through OpenRouter, as this policy describes for the writer's own text, to hosts that keep no copy of them. Notes stay in the book's version history until the writer deletes the book or their account, even if the writer deletes them from the book. Until a note is written into the book, which is usually at once, it waits in our database. We set no cookies on these pages. We count notes from each IP address for an hour, in memory, to stop floods. If something fails while a note goes into the book, the server log can hold your name with the error, as the section on server logs above says.
Why. To pass your notes to the writer who asked for them. Our lawful basis is our legitimate interest, and the writer's, in feedback that you chose to send.
Your rights. You have the same rights as a writer. You have no account, so to use them, email hello@plothold.com with the link you used, the name you gave, and a few words of one of your notes, so that we can find them.

If a writer invites you to write a book with them

A writer can invite you, by your email address, to write one of their books with them as a co-writer.

The invitation. We keep your email address with the book and when the writer invited you, and Resend sends you one email with the writer's name (their account's name, or their email address) and the book's title. Only an account with that address, signed in, can see or take the invitation. We delete it when you answer it, when the writer takes it back, or after 30 days with no answer.
When you join. We keep that your account writes that book, and when you joined. The book's owner sees your name and email address; the book's other co-writers see your name (your account's name, or your email address if it has none). While you have the book open, the others see that you are in it and which chapter you have open; we keep that in memory only, and forget it when you close the book. The messages you send in the book's chat and the versions you save carry your user ID, so that each writer sees who wrote what, and with each message the writing partner gets the writers' names and which of them sent it, as part of the text that goes to the AI model through OpenRouter: your account's name, or a number such as "Writer 2" if it has none, never your email address. What you write in the book is in the owner's book, its version history and its backups, as the owner's own writing is.
When it ends. When you leave the book, the owner removes you, or the owner deletes the book or their account, we delete the record that you write it. What you wrote stays in the book until the owner deletes the book or their account, with your user ID on your messages and versions, also after you delete your account; with no account, it names no one. When you delete your account, you leave every book shared with you, and the invitations to your address go.

If a writer asks you to edit a book

A writer can send an editor or a critique partner a private link to their book's chapters. The link shows the chapters' text as it is when you open a page, never the writer's chat, their notes on the story (the story bible), their notes to themselves, or their other books. If you edit through such a link:

What we keep. Your name, as the writer typed it when they made the link, and each comment or change that you suggest: the words you chose, a little of the text around them (so that the note finds its words after small edits), your new words and your comment, and when you sent it. They go into that writer's book, in a file of your notes, where the writer (and anyone they invited to write the book with them) reads them beside the words and keeps, rejects or answers each one; the writer's answers go into the same file, and this page shows them to you. Like the rest of the book, they are in its version history and its backups, and they stay until the writer deletes the book or their account, even if the writer deletes them from the book. If the writer or a co-writer asks the writing partner to read or sort your notes, your name and notes go to the AI model through OpenRouter, as this policy describes for the writer's own text, to hosts that keep no copy of them. Until a note is written into the book, which is usually at once, it waits in our database; a day after that, we delete the rest of its record there. Our database also keeps the link itself with your name, its dates and how many notes it sent, so that the writer can see and stop it, until the writer deletes the book or their account. We set no cookies on these pages, and we count notes from each IP address for an hour, in memory, to stop floods. If something fails while a note goes into the book, the server log can hold your name with the error, as the section on server logs above says.
Why. To pass your notes to the writer who asked for them. Our lawful basis is our legitimate interest, and the writer's, in edits that you chose to send.
Your rights. You have the same rights as a writer. You have no account, so to use them, email hello@plothold.com with the link you used and a few words of one of your notes, so that we can find them.

Why we use it

To provide Plothold: to store your books, run the writing partner and keep you signed in. Our lawful basis is that this is necessary for our agreement with you (the terms).
To send you sign-in emails, and one email before your free trial ends. Same basis.
To give you the free trial and the plan you pay for, with their limits, and to work with Polar, which sells the plan. Same basis.
To keep Plothold secure and fair: to stop abuse, limit sign-in attempts, apply daily limits, set those limits from what turns and covers cost, and give each person only one free trial. Our lawful basis is our legitimate interest in running a safe service.
To keep backups, so that a fault does not lose your work. Same basis.
To make the writing partner better: to see, as totals only, how its replies go for each version of Plothold, such as how often writers undo a change or send a reply that it suggested, and which tools it uses and how often they fail. We make these figures from the turn records and the daily totals, never with your name, email or book titles. Our lawful basis is our legitimate interest in a writing partner that works well.
To count, as totals only, how many writers have an account, how many joined in a period and on each day, how many used Plothold in a period and today, and how many are on a free trial or pay for the plan; of the writers who joined in a period, how many by now started a book of their own (not the sample book), sent a message, sent messages on 2 days or more, and pay for the plan; of the writers who joined in each of the last 12 weeks, how many sent a message or made a cover in each week after; and how many writers used each part of Plothold on each day; and, for each link with a name, how many visits it brought, and how many of the writers who joined after one reached each of those steps. We make these counts from the records above, never with your name, email or book titles. When few writers joined in a period or a week, these counts can describe one writer. Our lawful basis is our legitimate interest in knowing how many people use and pay for Plothold.
To find and fix faults in Plothold's pages, from the error reports. Our lawful basis is our legitimate interest in a service that works.
To read your feedback, improve Plothold, and reply when you ask us to. Our lawful basis is our legitimate interest in a better service, which you choose to help with when you send feedback.

We do not sell your information, and we do not use your writing to train AI models.

Who else handles it

We use these service providers to run Plothold. Apart from Polar, they process information only to provide their service to us. Polar sells the plan to you itself, so it also uses your information for that sale, under its own policy.

Railway hosts the app, the database and the backups, on servers in the Netherlands.
OpenRouter passes your chats to the AI model that runs the writing partner. A chat request contains your message, a short summary of your book (with the name that you put on it, if any, and the names of its drafts, but not its contact lines or the notes on its drafts), the parts of your book that the writing partner reads to answer (which can include the name and the contact lines that you put on the book, the text of a draft that you named, the pages before and after the story (the summary says only which of those pages you have added, not their text), and your voice: its leanings and the words you never want in the summary, and its sample and description when the partner reads them), and the recent conversation with the partner, which can include parts of your book from earlier messages. It never contains your list of submissions. We send requests only to model hosts that OpenRouter lists as keeping no copy of them and not training on them. We ask OpenRouter to try Together AI first, and other hosts that meet the same rules when Together does not answer. When you ask the council to review a chapter (under the chapter, or by asking the writing partner for it in the chat, which it never does on its own), OpenRouter passes the text of that chapter, its title and point of view, and your book's genre, premise and notes on tone, to three AI models from different makers (GLM from Z.ai, MiniMax and Claude Haiku from Anthropic). Then it passes their scores and notes to the first of them, which joins them into one review. These requests do not contain the name or contact lines on your book. We send them only to model hosts that OpenRouter lists as keeping no copy of them and not training on them. When you ask the AI readers to read some chapters (Before your readers, on the Readers tab, at most 20,000 words at a time), OpenRouter passes the text of those chapters (without your notes to self), their titles, and your book's title and genre, to the same three AI models, each playing a reader. Then it passes what they said to the first of them, which joins it into a summary. These requests do not contain the name or contact lines on your book, its premise or its synopsis. We send them only to model hosts that OpenRouter lists as keeping no copy of them and not training on them. When you ask for an editorial letter, OpenRouter passes the text of every chapter (without your notes to self), with each chapter's title and point of view, and your book's title, genre, premise, synopsis and notes on tone, to the AI model that runs the writing partner, on the same hosts as your chats: those that OpenRouter lists as keeping no copy and not training on them, Together AI first. This request does not contain the name or contact lines on your book. When you make a book cover, OpenRouter passes the request to Microsoft's image model on Azure. A cover request contains your book's genre, setting, themes, premise, synopsis and notes on tone, and the words that you type for the cover. When you change a cover, it also contains that cover's picture. It does not contain your title, your chapters, or the name or contact lines on your book. We send cover requests only to Azure, which OpenRouter lists as keeping no copy of them and not training on them.
Resend sends the sign-in emails, the email before your trial ends and the invitations to write a book with another writer, so it receives your email address, or the address of the person you invite. It also brings your feedback to us by email, with your email address only if you tick the box that says we can reply.
Polar (Polar Software, Inc., in the United States) sells the plan to you, as the merchant of record. When you choose to subscribe or to buy extra messages, we send Polar your email address, your Plothold user ID and the language of Plothold's pages, and Polar's checkout asks you for your payment details and billing address. Polar handles those under its own privacy policy. Each time we look up your plan (when you open your plan's page on Polar, come back from Polar's checkout, or Polar tells us your plan changed), we send Polar your user ID. Polar's answers and notices hold your customer details there, such as your name and email address; we use only your plan's status and dates and your orders for extra messages, and keep only what “Your plan” lists. When you delete your account, we send Polar your user ID, to end any plan and delete your customer record there. Polar keeps the records of each sale that the law requires.
Google, only if you choose to sign in with Google.

OpenRouter, the model hosts, Resend, Polar and Google may process information in the United States or other countries outside the UK. When they do, we rely on the safeguards that UK law accepts for international transfers, such as the UK's addendum to the standard contractual clauses, or the UK–US data bridge for companies certified under it.

How long we keep it

Your account, your preferences, your books and their version history stay until you delete them, or ask us to. Text that you delete from a book stays in its version history until the book is deleted.
We keep the 30 most recent daily backups, so a copy of deleted information can stay in a backup for about 30 days after we delete it, and a little longer if a backup fails. Backups do not include sessions or sign-in records.
Sessions, sign-in records, rate-limit counters, usage counts, the day's uses of Plothold's parts, the name of the link that brought you, turn records, cover records and cover drafts, your plan, your feedback, error reports and the trial record are deleted as described in “What we collect”.
We keep the daily totals, the counts of writers for each part of Plothold, and the daily counts of visits from each link, as described in “What we collect”.
The copy of a book that a reading link shows is deleted when the writer stops sharing it, or when the link expires after 90 days.
An editor's link stops working when the writer stops it, or after 90 days. The editor's name and notes stay in the book, as above.
An invitation to write a book is deleted when it is answered or taken back, or after 30 days. A co-writer's place in a book goes when they leave, the owner removes them, or the book or either account is deleted; what they wrote stays in the book, as above.

Your rights

Under UK data protection law, you can ask us to give you a copy of your information, correct it, delete it, or send it to you in a format that you can reuse. You can also object to, or ask us to limit, how we use it. To do any of these, email hello@plothold.com from the address on your account. We answer within one month.

To get a copy of your books yourself, at any time and without a plan, go to Account in Plothold and choose Download all my books. You get one zip file, with a folder for each book: the whole book as Markdown and as a Word file, your chat with the writing partner, the cover you kept, the names and notes of its named drafts, the pictures you gave the book with their captions, your list of submissions as a spreadsheet (CSV), and the book's chapters and notes as plain text files that you can reuse. A what-if that you have open is a folder of its own.

To delete a book or your whole account, go to Account in Plothold. The deletion happens at once and cannot be undone. Deleting your account also deletes its sessions, its Google sign-in link, its usage counts, its uses of Plothold's parts that day, the name of the link that brought you, its turn records, its cover records, its plan, its feedback and its sign-in records, ends your plan with Polar, and asks Polar to delete your customer record. The trial record stays for its two years, as described above, because it is how we give each person one free trial; of the records that hold your user ID or your email address, it is the one that a deletion or an objection does not remove. The daily totals and the error reports also stay, because they hold neither, and nothing else that links them to you. If you cannot sign in, email us and we delete them within 30 days, with the same steps at Polar. In both cases, the backups that hold them expire about 30 days later.

If you are not happy with how we handle your information, you can complain to the Information Commissioner’s Office at ico.org.uk. We would like the chance to fix the problem first, so please contact us.

Children

You must be 18 or older to use Plothold, as a writer, as a reader of a shared book or as an editor of one. We do not knowingly collect information about anyone under 18. If you think someone under 18 has an account, email us and we will delete it, as “Your rights” describes. If someone under 18 sent notes on a shared book, or as an editor, email us and we will ask the writer to delete them.

Security

Plothold uses HTTPS for every connection. Each writer can reach only their own books. Sign-in links work once and expire after 15 minutes, and sessions end after 30 days. On the Account page, you can see where you are signed in and sign out of your other devices. No system is completely secure, so please tell us at once if you think your account was used by someone else.

Changes to this policy

If we change this policy, we update the date at the top. If a change is important, we also email you before it takes effect.