Privacy Policy

1. Information We Collect

When you use CoWriter, we collect information you provide directly, including your name, email address, and payment information. We also collect content you create through the platform, including book ideas, outlines, and generated text.

2. How We Use Your Information

We use your information to:

• Provide and maintain the CoWriter service
• Process your subscription and credit transactions
• Generate AI-powered content based on your inputs
• Improve our service quality and user experience
• Send you important service updates and notifications
• Provide customer support

3. AI Processing

Your book content and inputs are processed by third-party AI providers — OpenAI (text and image generation) and Google AI (image generation) — to generate text, analyze markets, and create book covers. These providers process your data according to their own privacy policies and data processing agreements. We do not use your book content to train AI models. For details on which AI models we use and our approach to responsible AI, see our Ethics & AI Disclosure page.

4. Data Storage & Security

Your data is stored securely using industry-standard encryption. We use PostgreSQL databases and encrypted file storage on our own servers hosted in the European Union (Contabo GmbH, Germany), with encrypted connections and appropriate access controls. We implement reasonable security measures to protect your personal information.

5. Data Retention

We retain your account data and book content for as long as your account is active. Books may be archived but are never permanently deleted. If you request account deletion, we will remove your personal information within 30 days, though anonymized usage data may be retained for analytics. YouTube API data follows the separate deletion periods described under Connected Social Accounts below.

6. Payment Information

Payment processing is handled by Stripe. We do not store your full credit card details on our servers. Stripe processes your payment information in accordance with PCI DSS standards. We store only a reference to your Stripe customer ID for subscription management.

7. Cookies

We use essential cookies to maintain your session and authentication state, keep a signup attempt attached to the browser that started it, and enforce free-trial eligibility. We do not use these cookies for advertising or cross-site tracking.

8. Device Fingerprinting for Fraud Prevention

To prevent signup-email abuse, we keep a limited signup-request log for up to 90 days, containing the requested email and name, the request outcome, and cryptographic one-way hashes derived from the network location and, when available, browser/device characteristics. To enforce the rule that a device, mailbox, or location receives only one free trial, we retain a separate permanent ledger of keyed or one-way identity claims. It does not store the raw IP address, device cookie, or browser configuration, and purchasing a plan does not erase a spent trial. We use these signals only for account-email protection and trial eligibility, never for advertising or cross-site tracking. An unverified request does not create a customer account.

9. Third-Party Services

We use the following third-party services that may process your data:

• OpenAI (AI text generation, translation, and image generation)
• ElevenLabs (narration when you generate narrated Social Studio content)
• Meta (Facebook and Instagram account connections and uploads you approve in Social Studio)
• Google and YouTube (channel connections and video uploads you approve)
• TikTok and X (account connections and video uploads you approve)
• Google AI (AI image generation for book covers)
• Stripe (payment processing)
• Resend (transactional account email delivery)
• Cloudflare Turnstile (automated signup-abuse prevention)
• Contabo GmbH (server infrastructure, EU)
• Vercel (domain registration and DNS)
• Plausible Analytics (privacy-focused, cookieless website analytics)

10. Your Rights

You have the right to:

• Access and export your personal data and book content
• Correct inaccurate personal information
• Request deletion of your account and personal data
• Object to processing of your personal data
• Withdraw consent at any time

11. Children's Privacy

CoWriter is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

13. Connected Social Accounts

When you connect Instagram, Facebook, YouTube, TikTok or X, we receive the account and, where applicable, Page identifiers, usernames, display names, granted permissions, and authorization tokens needed to identify and access the account you select. Tokens are encrypted on our server and are not included in the browser's account list. We use this information to provide the connection you request. Connecting an account does not publish a post. When you approve an upload, we send the selected video and supported post details to that platform. We retain the approved destination, caption, schedule, upload status and returned post identifier to show your publishing history and prevent duplicate sends.

For Instagram, Facebook, TikTok and X, disconnecting removes that studio's stored connection and access or refresh tokens. You can also revoke the app's access in the platform's settings. Your manuscript, generated media, publishing history and existing posts remain separate from those connections. For removal of stored social-account information, follow our social-account data deletion instructions.

YouTube API Services

Social Studio uses YouTube API Services. Google handles your sign-in and permission grant; we do not receive your Google password. We access and store the authorized channel's identifier, handle, display name and authorization tokens. For uploads you approve, we send your video, title, description and chosen visibility to YouTube, and receive upload identifiers, links, processing status and actual visibility. We use this data to identify your selected channel, carry out approved uploads and display their results. It is processed by our servers and Google for these purposes, not sold or used to train AI models. Google's handling of this information is described in the Google Privacy Policy.

Disconnecting YouTube asks Google to revoke CoWriter's access before removing the stored connection and tokens for that channel across your book studios. Revocation can also affect other YouTube channels authorized through the same Google app. Channel identities, returned video identifiers and links, provider status and other YouTube API data are removed from the affected publishing records. Your books, original generated media and the titles and descriptions you wrote remain in CoWriter. Videos already uploaded remain on YouTube; use YouTube to delete them. An upload already in progress may have reached YouTube before you disconnected.

You can also revoke access through Google's security settings. We periodically check authorization and remove associated YouTube API data when revocation is confirmed. YouTube API data is deleted from our active systems as soon as possible, within seven calendar days of a deletion request or revocation through CoWriter, and within 30 calendar days of revocation through Google. A failed disconnect is shown as an error so you can retry or contact privacy@cowriter.net for help with deletion or any question about our privacy practices.

Backup copies are handled separately. Our server keeps the 14 most recent successful daily database backups, and owner-managed offsite backups may retain earlier copies for longer. Disconnecting an account or deleting data from active systems does not immediately rewrite those backups. We cannot currently guarantee that every backup copy of YouTube API data is removed within seven days.

14. Contact Us

For questions about this Privacy Policy or to exercise your data rights, please contact us at privacy@cowriter.net.