Privacy Policy
The short version
- We only collect what WriteForge needs to work: your account and what you write.
- We don't sell your data, show ads, or use analytics or tracking cookies.
- A few services help run it: Resend sends emails, Discord tells the operator about sign-ups, bug reports and abuse, and a hosting provider stores the data.
- To see, fix or delete your data, write to [email protected].
1.What we store
- Your account: name, email address and password. The password is kept only as a one-way hash; nobody can read it back.
- What you create: documents, tables, boards, diagrams, images, folders and the trash, plus the workspaces you belong to, their members and the invitations sent by email.
- Your preferences: theme, language and editor settings.
- Access you hand out: API tokens and share links. Only a hash of each is stored, with its last few characters so you can tell them apart.
- Sessions: when you sign in, a session lasts up to 30 days. Only a hash of its token is stored.
2.Cookies and local storage
- wf_session keeps you signed in. It can't be read by scripts and lasts up to 30 days.
- wf_theme and wf_lang remember your theme and language so pages show them right away.
- wf_last_workspace remembers the last workspace you opened, so WriteForge opens it next time.
- The browser's local storage keeps a few conveniences, such as the editor's zoom.
- There are no advertising, analytics or third-party tracking cookies.
3.Technical data
Your IP address is used for a short time to protect against abuse (for example, limiting failed sign-ins). These counters live in the server's memory, not in the database. The hosting provider may keep standard server logs.
4.Who else sees your data
- Resend sends the activation emails: it receives your email address, your name and the activation link.
- Discord, in a private channel only the operator reads: the name and email of each new account; the bug reports you send (your name, email, the page, your browser, your text and screenshots); and alerts when someone hits a rate limit (their IP address, or a partly hidden email).
- The hosting and file storage providers keep the database and the uploaded images on their servers.
- The people you share with: members of your workspaces, anyone holding a share link you created, and the scripts or AI agents you give an API token to.
- Authorities, only when the law requires it.
5.How long we keep it
Your account and content stay while your account exists. Items you delete go to the trash and are deleted for good after 30 days. Expired sessions, expired share links and unanswered invitations are removed automatically.
If you ask for your account to be deleted, your account and the workspaces you own are deleted. Copies in backups, if any, disappear as backups are replaced.
6.Security
Connections use HTTPS, and passwords and tokens are stored only as hashes. No system is perfectly secure, so keep your own copies of anything important.
7.Your choices
- See and change your name, password and preferences in Settings.
- Copy or export your documents at any time (Markdown, CSV and PDF).
- Ask for a copy of your data, a correction or the deletion of your account by writing to [email protected].
8.Children
WriteForge is not meant for children under 13, and we don't knowingly collect their data.
9.Changes to this policy
This policy may change. The date at the top says when it last did, and significant changes will be pointed out on the site.
10.Contact
Questions or requests about your data: [email protected].