Privacy notice

DRAFT: needs review before publication. Everything factual here was written against the code and is accurate as of this commit. What it cannot know is who is running the service: anything in [SQUARE BRACKETS] is a placeholder only the operator can fill in. Have a lawyer check it, particularly the legal bases and the international-transfer section, which depend on where you and your hosting sit. If you change what the app collects, change this too. The docs/gdpr/ files next to it exist so that's a mechanical job rather than an archaeology one. Who runs the service, its contact address and the date at the top are filled in from the server's settings (README, "Policies for your deployment"), and paragraphs about optional features appear only when those features are switched on. Anything still in [SQUARE BRACKETS] is highlighted on the page and listed on the administrators' launch page. Fill it in here.

Last updated: 20261025

Who runs this service: Charles Dyer, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA

How to contact us about privacy: [TBD](mailto:TBD)

[OPERATOR: if Article 37 of the UK GDPR requires you to have a data protection officer, add a line here naming them and how to reach them. Otherwise delete this note.]

The short version

wrisp is a writing tool. It keeps your drafts and, because that's the whole point of it, the full history of how they were written, keystroke by keystroke.

We don't use analytics. We don't track you. We don't advertise, and we don't sell or share your writing with anyone. There is no third-party tracking code in this application at all.

You can download everything we hold about you, and delete your account outright, from your account page at any time.

What we collect, and why

Your account

Your username, email address, a hash of your password (never the password itself) and, if you turn on two-factor authentication, the secret your authenticator app uses.

We need these to give you an account and let you sign back into it. We use your email address to confirm it when you sign up, to send password resets, to confirm an email change, and to tell you when someone proposes a merge into a project you can approve for. If someone tries to sign up with an address that already has an account, we email that address to say so, rather than telling the person on the sign-up page.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

If you signed up by following a link with a tag on the end, such as ?from=reddit, we keep that tag with your account. It tells us which places people find us from, and we only ever look at it as totals: how many people came from each place, and how many of them kept writing. The tag travels in the link itself: nothing is stored on your device to do this.

Legal basis: our legitimate interest in knowing which of our posts and links are worth making (Art. 6(1)(f)).

Your writing

The documents you write, and their complete editing history: every insertion and deletion, with timestamps. This history is not a by-product; it's the feature. It's what powers replay, branching, comparing versions, and named versions.

We also store snapshots of documents at intervals. These are purely a performance optimisation so replay doesn't have to re-run your whole history from scratch; they contain nothing you haven't already written.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

How fast you type (only if you switch it on)

If you turn on typing rhythm capture, we record how long each key is held and the gap between keys, in milliseconds.

We never record which key you pressed. The data cannot reconstruct what you wrote, and cannot capture something typed into another window, such as a password.

This is behavioural biometric data, which is why it's off unless you choose to turn it on, and why turning it off deletes the timings already collected, not just future ones. Writing works exactly the same either way; the only thing it powers is the "typing rhythm" view, which is evidence a document was typed by a person rather than pasted in.

Who can see it. On a document you share with other people, your typing rhythm is shown only to you and to the owner of the project it lives in. Your collaborators see their own, not yours. They are told that someone else has also typed in the document (otherwise the provenance view would be misleading), but not what your timings look like.

The statistics are also calculated per person rather than pooled across the document. Averaging two people's rhythms together would describe neither of them, and would mean deriving figures about you from data your collaborators never agreed to see.

Legal basis: your explicit consent (Art. 9(2)(a)), which you can withdraw at any time from your account page.

Things you create around your writing

Goals you set, templates you save, named versions you create, comments you write on proposed merges, and notifications we send you about activity on projects you're part of.

Bookmarks you add while writing: the point in the document's history and an optional note. They're only ever shown to you, not to collaborators, the project's owner or anyone with a share link. Notes are kept the same way as your writing (encrypted in the browser, if you've turned that on).

If you join a writing challenge, such as the November one: that you joined, your target, what counts towards it, and your time zone's offset from UTC, so your days start at your midnight. Your progress is worked out from your writing's word counts, not stored separately. If you choose to make your progress public, anyone with the link can see the name you chose to show (your username unless you pick another), your word count and which days you wrote, never the writing. Switching it off ends the link.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

Technical data

Your IP address is processed transiently to apply rate limits: the protection that stops someone brute-forcing passwords or hammering the service. It's held in a short-lived cache keyed to the rate-limit window, not in a log of your activity.

Our hosting provider (below) also records requests to the service, including your IP address, in its own logs, to run and secure its platform. How long it keeps them is set by its own policies.

Legal basis: our legitimate interest in keeping the service secure and available (Art. 6(1)(f)).

Sharing and collaboration

If you share a project with someone, they can read and edit every document in it, and they'll see your username. If you create a public share link, anyone holding that link can read that project or document without an account. You can see every link you've created, and revoke any of them, from a project's settings page.

Notifications we send to other people about your activity will name you, for example telling a project owner that you've proposed a merge.

Reports about shared links

Anyone who opens a share link can report it to us. A report holds the reason chosen, anything the reporter writes, a copy of what the link showed at that moment and, only if they give it, the reporter's email address, so we can tell them what we decided. The person who shared the link isn't told who reported it.

If the link was end-to-end encrypted, the report also holds the key from the reporter's link, so we can read what was reported: that link only, and nothing else of yours.

When we've decided, the copy and the key are deleted, unless the content may be illegal and we need to keep it as evidence; the reporter's email address is deleted once we've told them the outcome. The decision and our note about it are kept, so we can show how reports are handled.

Who else processes your data

We use the following providers. Each is contractually bound to process data only on our instructions.

The typefaces are served from our own server, not a font service, so visiting a page doesn't tell anyone else you did.

Your account and writing are stored in Frankfurt, in the EU, which UK law recognises as protecting personal data adequately. Render is a US company, so its staff may access the service from the US to run and support it. That transfer is covered by the UK Extension to the EU–US Data Privacy Framework, under which Render is certified.

[OPERATOR: if your email provider is outside the UK or EEA, say which safeguard applies, such as the UK Extension to the Data Privacy Framework or the UK's international data transfer agreement. Otherwise delete this note.]

How long we keep things

Deleting your account removes your account details, every project you own and all of its writing history, your goals, templates and notifications, and any typing timings we hold for you.

Two things deliberately survive, and it's worth being straight about why. Writing you contributed to someone else's project stays with that project. Edits do record who made them (that's what lets a replay show who wrote what), but removing yours from a document you don't own would corrupt it: every later edit's position depends on text that would no longer be there. Your edits stay, shown as made by "a deleted user". Named versions you created on other people's documents also stay, shown as created by "a deleted user".

Your rights

You can exercise most of these yourself, immediately, without asking us:

• Get a copy of your data: "Download all your data" on your account

page produces a zip of everything, including your full writing history and anything else we hold about you.

• Delete your account: at the bottom of your account page.

Immediate and irreversible.

• Correct your details: change your username, email or password

from the same page.

• Withdraw consent for typing rhythm capture: the toggle on your

account page, which also deletes what was already collected.

You also have the right to object to processing, to ask us to restrict it, and to complain to a supervisory authority. In the UK that's the ICO (ico.org.uk); in the EU it's the authority for the country you live in.

For anything you can't do yourself, write to [TBD](mailto:TBD) and we'll respond within one month.

Cookies and browser storage

We use one cookie: the session cookie that keeps you signed in. It's strictly necessary (without it you can't have an account), so it doesn't require consent.

We also store some display preferences in your browser's local storage: your light/dark theme choice, and whether you've collapsed certain panels. These never leave your browser and identify nobody.

We set no advertising, analytics or tracking cookies of any kind.

See docs/gdpr/cookies-and-storage.md for the full itemised list.

Security

Passwords are hashed, never stored. Sessions can be revoked from every device at once. Two-factor authentication is available. Everything you write is sent over HTTPS.

How your writing is stored

Your documents, their editing history, your saved templates, your comments and, if you've enabled it, your typing timings are encrypted before they're written to the database. Each value is encrypted individually with AES-256-GCM, and the key is held by the application, never in the database itself.

What that protects against: a stolen or leaked copy of the database, a backup ending up somewhere it shouldn't, or anyone who obtains access to the database without also obtaining our servers. To them the contents are meaningless.

End-to-end encryption, if you turn it on. In Account settings you can have your writing encrypted in your browser before it's sent to us, with a key only your password (or the recovery code you're given) can unlock. We then store text we can't read: not us, and not anyone who breaks into our servers. Nearly everything keeps working, because your browser does the work instead; the exception is giving another account access to your projects. What we can still see: the names of your projects and documents, and when and how much you edited. If you forget your password and lose your recovery code, nobody can recover your writing, including us.

Unless you turn it on, we can read what you write. We have to be able to: it's what makes search, replay, comparing drafts and sharing work on our servers.

Some things are deliberately not encrypted, because the database needs to sort and compare them: the names of your projects and documents, who they're shared with, and when they were edited. Bear that in mind when naming something sensitive.

Changes to this notice

If we change what we collect or why, we'll update this page and change the date at the top. For anything significant we'll tell you directly.

Complaints

If you think we've handled your data badly, please tell us at [TBD](mailto:TBD) first, but you're entitled to go straight to a supervisory authority, and nothing here takes that away.