Privacy Policy

Quillfire (“we”, “us”) runs the service at quillfire.ink and controls the personal data described here. For any privacy question or request, email privacy@quillfire.ink.

• Account data — your email address, an optional display name, and your password stored as a one-way bcrypt hash (we never see the password itself). We also record when your account was created and approved.
• Your creative work — projects, manuscripts, outlines, characters, style guides and the writing samples you give them, research runs, and generated covers, portraits, audio, translations and exports.
• Usage records — for each AI operation: the provider, model, operation type, token count, estimated cost and time. These records never contain your text. We use them to run the service and control costs.
• Security data — your IP address is used briefly to rate-limit sign-in, sign-up and password-reset attempts. It is held in memory for a few minutes at most and is never added to your account. Password-reset links are stored only as a hash and expire.

We don't collect payment details, your location, device fingerprints, contacts, or browsing activity. There are no analytics, advertising pixels, social-media widgets or third-party embeds. Fonts and images are served from our own domain, so loading a page doesn't notify anyone else.

• To provide the service you signed up for (contract): creating your account, storing your work, and running the generation, editing, narration and export tools you ask for.
• To keep the service secure and working (legitimate interests): rate limiting, preventing abuse, approving new accounts, monitoring costs, and fixing problems.
• To send essential account emails (contract): approval notices and password resets. We don't send marketing email.
• To meet legal obligations, where they apply.

Some features rely on other companies. They act as our processors, receive only what the task you ran needs, and may use it only to provide their service to us:

We use the AI providers through their commercial APIs and have not opted in to letting them train models on your content. The standard free narration voices run on our own servers, so that text never leaves Quillfire.

Some of these providers are based in the United States, so your data may be processed outside your country. Where the law requires it, these transfers rely on the providers' standard contractual safeguards.

The Quillfire administrator can see account email addresses to approve sign-ups. To fix a problem, they can also view the app as you see it. This is used only for support and security. Every use is logged and is never used to read or copy your work for any other reason.

• Account data and creative work: for as long as your account exists.
• Deleting a project removes its content and files straight away.
• Deleting your account (Settings → Delete account) permanently removes your account, projects, and every file you created. Usage records are kept for cost reporting, with any link to you removed.
• Rate-limit counters: minutes. Password-reset links: until they expire or are used.
• Hosting backups or server logs may keep leftover copies for a limited time before they are overwritten.

Depending on where you live (for example under the UK/EU GDPR or California's CCPA), you have the right to access, correct, delete, or receive a portable copy of your personal data. You can also object to or restrict certain processing.

Many of these you can do yourself: export your books from each project's Export page, and delete your account in Settings. For anything else, email privacy@quillfire.ink. We'll reply within one month. You can also complain to your local data-protection authority.

We don't sell or “share” personal information for targeted advertising.

We only use the cookies needed to keep you signed in and to protect the sign-in form. See the Cookie Policy for the full list.

All traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. Every request for a project or file checks that it belongs to your account. Expensive and sensitive actions are rate-limited. No system is perfectly secure, so please use a strong password you don't use anywhere else.

Quillfire is for adults only (18+) because it supports mature fiction. We don't knowingly collect data from anyone under 18. If we find an account belongs to a minor, we delete it.

If this policy changes, we'll update the date at the top. If a change materially affects how your data is used, we'll tell account holders by email before it takes effect.