Privacy notice · last updated 27 October 2026

Privacy

This notice covers onwarder.com, including the writing app at onwarder.com/app, the dashboard at onwarder.com/dashboard, Onwarder for Mac and Windows, Onwarder on your phone (in your phone's browser at onwarder.com/app now, and in the phone apps, including the iPhone and Android betas) and the MCP server at mcp.onwarder.com. It is written plainly on purpose. Where something is not decided yet, it says so instead of guessing.

Who we are

Onwarder is a product of Quezzies Ltd, registered in England and Wales, company number 16590159. Registered office: 11 Mercer Avenue, Ebbsfleet Valley, Swanscombe, DA10 1BG. The person answerable for this data is reachable atsupport@onwarder.com and answers in person.

What we store

• Your world. Books, characters, stat blocks, locations, maps, items, factions, scenes, and the event log that records how each of them changed. This is the product. It exists because you put it there. An AI you connect can read the books you allow but cannot change them: the connection is read-only.
• Not your free library. Books you write with no account stay in your browser or on your computer. We do not receive them unless you copy them to your account.
• Your account. Email address, name and avatar if you set one, and which sign-in method you used. This comes from Clerk, our authentication provider.
• Your connections. Which MCP clients you have authorised, so you can see them and revoke them.
• Changes a connected app suggests or makes, in a book that allows it. A suggestion, including any text it proposes, is stored until you accept, edit or decline it, or for 30 days. The list of what connected apps suggested and changed, and what you decided, is kept for 90 days after its last change. A scene suggestion's text is deleted when it expires or with that list. These periods apply to anything already stored even if we later switch the feature off.
• How each book was written. A record, without the text itself, of the book's AI settings, of the changes connected apps suggested and whether you accepted or declined them, of saves made through a connected app, and of writing brought in from elsewhere. It is kept with the book for as long as the book exists, so you can export how it was written, and it is erased with your account.
• Your payments. Whether you have an active subscription, which plan, and the Stripe identifier for it. Card numbers go to Stripe and never touch our servers.
• Operational logs. Requests hitting our Workers, with IP address and user agent, kept short term so we can debug faults and block abuse.
• Usage analytics. Which pages are opened and left, with book, character, scene and map ids taken out of the address, and a short list of named product events: creating, writing, importing, publishing and exporting a book, creating and sharing a character, uploading a map, viewing a connected AI client, recording a pronunciation, and reaching a trial or storage limit. These carry counts, yes-or-no flags and formats, never your words or the names you invent. They are not linked to your account: each page load gets a new random identifier that is never stored on your device, and no profile of you is kept. Like any web request, each one reaches PostHog with your IP address and browser details; PostHog discards the IP address, so events are stored without it and without any identity, which also means there is nothing in analytics to erase when you delete your account. There is no autocapture of clicks or typing, no session recording, and nothing at all from private reading links or the page shown after an account is deleted.
• Error reports. To understand when the app fails, we send PostHog a general error category and which part of Onwarder failed. We remove the error message, stack trace and all attached information before sending. Reports never include your writing, book or character names, your name, email address, account identifier or file paths. Each report gets a new random identifier that is not stored on your device. There are no recordings, screenshots or person profiles. Your IP address reaches PostHog as part of the request, and PostHog is set to discard it; reports request no location enrichment. We honour your browser's Do Not Track and Global Privacy Control settings. In the desktop and phone apps, reports are off unless you turn them on in Settings, and you can turn them off again at any time. We do not send native crash dumps.

Files are stored as you wrote or uploaded them: scene text with its saved versions and alternative drafts, saved-writing snapshots, map images, the Word and text manuscripts you import, library copies you send from your browser, and the copies behind private reading links. Each save also records a random identifier for the device or browser that made it, used only to tell your devices apart in history. Nothing else is collected. There is no advertising pixel and no cross-site tracker on any page of this site.

Signing in with Google

If you choose Google sign-in, Google tells us your name, email address, profile picture and Google account identifier. That is the whole of it. We do not request access to Gmail, Drive, Calendar, Contacts or any other Google service, and we could not read them if we tried. Google account information is used to create your account, sign you in and email you about your account. It is never sold, never shared with advertisers, and never used to train any model. Revoke our access at any time in your Google account settings; that signs you out and leaves your world data untouched until you delete it.

Signing in with Apple

The iPhone app offers Sign in with Apple. The first time you use it, Apple tells us an identifier for your Apple Account that only Onwarder receives, an email address and, if you choose to share it, your name. That is the whole of it. The email address is either your own or, if you choose Hide My Email, a private relay address that Apple forwards to you. We keep the address and name as your account's email and name, and the identifier to recognise you when you sign in again. We use this only to create your account, sign you in and email you about your account, on the same terms as Google sign-in above. You can stop using Sign in with Apple for Onwarder in your Apple Account settings; if you used Hide My Email, our emails then stop reaching you, and your world data stays untouched until you delete it.

Your prose, and the model you connect

Onwarder's servers do not call an AI model. Not for you, not for us. The intelligence in the product is a model you choose, running on your own account with that provider, under that provider's terms and privacy policy. It reaches your work in one of two ways: a model you connect through MCP, or, in the Onwarder desktop app, Codex running on your own computer under your own ChatGPT sign-in. A feature that lets you ask your desktop for help from the browser or your phone is being built and is switched off. When it is on, we hold your request until your desktop collects it, and your desktop then asks your model.

When your model asks Onwarder for a character or a scene, we answer with your data. What that model then does with the answer is between you and the provider you chose. If you paste a draft scene into a tool that extracts state changes, the extraction happens in your model, not here. This is the single most important thing to understand about the product, so it is worth being blunt about: we are storage, search and rules. Our servers send your book only where you tell them to: to an AI app you connected and allowed into that book, to readers you invite, or to a page you publish. The next section says what each of those shares.

What never happens

• We do not train models on your work. Not our models, not anyone else's. There is no exception for anonymised, aggregated or sampled use.
• We do not sell your data or share it with data brokers.
• We do not read your world data except when you ask us to help with a fault, and then only what is needed to fix it.
• We do not publish anything you have not published yourself.

What you choose to share

Everything below happens only when you do it, and you can undo each one.

• An AI app you connect. It receives what it asks for from the books you allow: scenes, story notes and the facts you recorded. What it does with them is governed by that provider's terms. Turn a book's AI access off, or remove the app on the Connect page, and it gets nothing more.
• Private reading links. A reader you invite sees the copy of the book you sent, and can leave comments on it that you read. Revoke the link and it stops opening; it also pauses while Cloud has ended for your account. It cannot recall what a reader has already read or copied. Readers' comments are erased with the book.
• A public book page at onwarder.com/books/. It shows the title, subtitle, author, series, blurb, formats with their ISBNs and prices, the retailer links you add, your author bio, your other books, your uploaded JPEG cover if there is one, and a sample passage only if you choose one. It is a copy made when you publish, not your live book. When you take it down, it can still be served from a cache for up to a minute.
• A character card at onwarder.com/s/. It shows that character's name, role, status, description, voice, goals, fears, capabilities, possessions and stat block to anyone with the link. Secrets, knowledge and relationships are deliberately withheld, because that is where spoilers live.
• A tier list at onwarder.com/t/. It shows its books and its title.

Unpublishing a character card or a tier list takes its page down at once. Its preview image, the picture a link shows when it is shared, can stay in Cloudflare's cache for up to a day. Nothing can recall a copy somebody already saved or a screenshot they took, and sites where a link was shared may keep their own preview, so publish accordingly.

Where your data lives

The application runs on Cloudflare: Workers for the application, D1 for the database, R2 for uploaded files and backups, Durable Objects for live state and KV for AI connection sign-ins. Our configuration sets no data-location or jurisdiction restriction for any of them, so we do not promise that your data is stored in a particular country or region. Where Cloudflare stores it is Cloudflare's choice; by default a database or a live-state object is placed near where it was first created or first used. Requests are served from the Cloudflare location nearest you.

Four other companies hold a slice. Clerk handles authentication and stores your sign-in details. Stripe handles payment and stores your billing details. PostHog holds the anonymous usage analytics and error reports above, in its EU region, which is the only location set in our configuration. Resend sends our emails, so it handles your email address, your first name and, for the weekly chronicle email, your writing statistics such as word counts. The chronicle email is sent only while your account has Cloud or its trial. Resend also sends the reminders before your Cloud copy is deleted after Cloud ends. All four are processors acting on our instructions, and each says in its own privacy policy where it stores data. Because of all this, your data may be stored and processed outside the UK.

How long we keep it

Your library in Cloud, with its history and files, stays until you delete it, or until Cloud has ended for your account for at least 90 days. Cloud ends when the free trial is spent without a subscription, or when a subscription ends with no trial days left. Sync then pauses, every book stays on your devices, and we email you reminders before your Cloud copy is deleted. Then it is deleted from Cloud, and erased from database backups within the backup period below. Subscribing again before then keeps it. Deleting a book or an entry takes it out of your library straight away; the stored copy is marked deleted rather than erased at once, and it is erased with the rest of your account. When you delete your account, access to your cloud writing stops as soon as the request is accepted, and your books, history, files and account details are erased within 30 days of that. This includes readers' comments on your books and the copies you sent to readers. Books saved on your own devices, and files you saved, are not touched: we have no access to them. We keep a deletion record indefinitely, as proof that the erasure happened and so that it stays in force. It holds only internal identifiers for your account, books, files and erased records, with a one-way fingerprint of each erased record rather than its text; the dates your account was created and deleted; the request's reference, its dates and the choices you confirmed; and a log of each erasure step. It holds no email address, name, writing or IP address. If you ever started a checkout with us, we also keep the Stripe reference numbers for your customer record, subscriptions, checkouts, invoices and payment events, with the prices and dates they recorded, because UK tax law requires payment records to be kept for six years. We delete them six years after your last billing event, which we count as the day your erasure finished or, if later, the last checkout, subscription or invoice event Stripe sent us about your account after your request. Operational logs roll off inside 30 days. Stripe keeps its own payment records as the law requires of it.

Library backups are copies of your whole library that Onwarder Cloud makes automatically, on every device you write on; they are separate from your Cloud copy. A writing trial includes 1 GB of backup space; a paid Cloud subscription includes 10 GB. Making or opening a backup needs Cloud or an active trial. After Cloud ends, we keep your backups for up to 12 months, then erase them. You can delete them sooner, and deleting your account erases them with the rest of your account. The books on your devices and the files you saved are not touched.

Your data is also in backups of the database. We keep private copies of it for no more than 35 days each, and use them only to restore the service after a fault and to test that such a restore works. Cloudflare, which hosts the database, keeps its own history of changes for up to 30 days. So a deleted account can remain in a backup for up to 35 days after it is erased. If we ever restore from a backup, deleted accounts are erased from the restored copy again before the service reopens.

Export and delete, whenever you like

Every book exports whole, at any time, on any plan, for as long as it is kept. When Cloud ends, every book stays on your devices, so it exports for as long as you keep it. That is a deliberate design commitment rather than a feature we might reprioritise: a story bible you cannot take with you is a hostage. Account deletion has its own page in the dashboard, and it means deletion. Email us and we will help you use it, or, if it is not open yet, tell you when it opens and confirm when your request is accepted.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, and object to processing. The export button answers the first without asking anyone. The delete page in the dashboard answers the third; email us and we will help you use it, or, if it is not open yet, tell you when it opens and confirm when your request is accepted. For any of these, email support@onwarder.com and a human replies. If we get it wrong you can complain to your local data protection authority.

Cookies

Sign-in cookies from Clerk, so you stay signed in, and any security cookies that sign-in needs. When you connect an AI client, a cookie carries that sign-in to the consent screen and expires after two minutes. We set no other cookies. The dashboard also keeps things in your browser that it needs to do what you ask: unsaved writing and recovery copies, so a dropped connection does not cost you words, and display choices such as paper mode. Analytics stores nothing on your device at all, neither a cookie nor anything in browser storage. No advertising cookies, no cross-site tracking, no consent banner to click through, because nothing is stored that you did not ask for.

Onwarder on your phone keeps more on your device, because it is built to keep working without a connection. In your browser's storage for onwarder.com, or in the phone app's own storage, it keeps writing you have not sent yet, the books you download to it, the ideas you capture, your notes and, once asking your desktop is switched on, the questions you send it. Each of these is stored under the account that made it. It also keeps a few display choices, such as which prompts you have dismissed. Signing out does not clear any of it, so writing you have not sent is still there when you sign back in. Clearing this site's data in your browser settings removes it, and so does uninstalling the phone app. Removing it from a home screen may not, depending on the browser. Onwarder on your phone sends no usage analytics. If you choose to turn on error reports, it sends only the limited diagnostic information described above. Reporting stores no identifier or queued reports on your device; the app keeps your reporting preference so it can honour your choice.

Children

Onwarder is not built for children and is not intended for anyone under 16.

Changes

When this notice changes, the date at the top changes with it. If a change actually affects you rather than tidying wording, we email you before it takes effect.

Asking us things

support@onwarder.com. A person reads it.

How to delete your account and data, including what is erased and which records remain.