Quillx is operated by The Fifth Division Inc. (“we,” “us”), which is the data controller for the personal data described here. This policy explains what we collect, why, who we share it with, and the rights you have. It goes together with our Terms of Service.
1. What we collect
Account data. Email address, full name, username, password (stored only as a hash by our authentication provider), and optional profile details you add (avatar, bio, location, website, writing focus). When you sign up we record which version of the Terms you agreed to, your age confirmation and the time.
Your content. Manuscripts and project data you create: projects, chapters and scenes, comments and replies, tasks, chat messages with the Quill AI assistant, templates, story maps, book/publishing details, and writing goals and session statistics.
Security data. If you enable two-factor authentication: your phone number (for SMS codes, sent to Twilio) and one-way-hashed backup codes. We also keep a log of security events on your account (sign-in–related actions, 2FA changes, account deletion/recovery) and, when you set a password, we check it against known-breach lists using a privacy-preserving method (only the first five characters of a one-way hash are ever sent — see §5).
Billing data. Your subscription tier and status, Stripe customer and subscription identifiers, and trial usage. For each checkout we record the version of the renewal terms shown to you and whether you said you live in the EU, EEA or UK. If you do, we also record the request to start straight away and the acknowledgement of the withdrawal-right rules you gave, with their exact wording and time, and email you a confirmation. We keep these records as evidence of what you agreed for at least six years after the purchase, also after your account is deleted. We never see or store your card number — payment details go directly to Stripe.
Usage and technical data. Standard server logs (IP address, timestamps, request metadata) kept by our infrastructure providers for security and operations, and metadata-only AI audit records (see §3). We run no third-party advertising or marketing trackers.
Local storage on your device. We store non-sensitive preferences (theme, UI settings, cached settings data, your data-export format choices and reminder timing, a remembered sign-in email if you opt in) in your browser’s local storage. Manuscript content, chat messages, comments, and profiles are deliberately excluded from this preferences cache. Import review drafts can contain manuscript text, structure, and review history in this browser’s IndexedDB so a review can survive a reload. This browser storage is not a cloud backup.
2. Why we process it
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the writing workspace, sync, collaboration | Account data, your content | Contract |
| Processing AI requests you initiate | Prompt + the project context needed for the request | Contract |
| Billing and subscription management | Billing data | Contract; legal obligation (tax/accounting) |
| Transactional email (confirmation, password reset, 2FA codes, security alerts) | Email address | Contract; legitimate interest in account security |
| Notification emails you can toggle | Email address, notification content | Legitimate interest / consent via settings — every email type has an off switch in Notifications → Settings |
| Security (2FA, breach screening, abuse and rate-limit tracing, audit logs) | Security data, usage data | Legitimate interest in protecting accounts; legal obligation where applicable |
| Bot protection at signup/sign-in | hCaptcha challenge data | Legitimate interest in preventing abuse |
We do not sell your personal data, and we do not use it for advertising.
3. AI features and your content
- AI requests are processed server-side; your browser never talks to an AI provider directly, and provider credentials never leave our servers.
- We send an AI provider only the prompt, the selected project context, role instructions, and bounded reference material needed for the specific request you made.
- We use Anthropic and OpenAI through their API platforms, under their commercial terms and data processing addenda. Neither provider uses API content to train its models, and the optional settings that would let them use our traffic for training are switched off in our accounts. Both providers keep requests for a limited time for abuse and safety monitoring: currently up to 30 days, or longer where the law requires it or where a request is flagged for a possible policy violation (Anthropic may then keep it for up to 2 years). Quill memory’s background processing uses Anthropic’s batch service, which keeps a request for up to 29 days unless it is deleted sooner. We do not currently have a zero-data-retention arrangement with either provider.
- AI role reference files you upload are private storage objects readable only by you.
- AI audit logs are metadata-only — entity, operation, counts, and whether content changed. They never store your manuscript text or the before/after content of AI edits, and the database enforces this.
- AI-proposed changes to your manuscript are applied only after you confirm them.
- We do not train models on your content.
- Quill memory. This feature creates stored notes from AI interactions to support later assistance. These notes can contain personal information or writing context. Background memory is off until you explicitly enable it. Memory, project-level and incognito controls are available in the Quill workspace. Saved memories and outstanding provider processing must be considered separately when handling an export or deletion request; removing a local record does not establish immediate provider erasure.
- Ask your book (manuscript search index). This feature creates a search index containing chapter text, chapter/act titles, and mathematical representations called embeddings, computed through an AI API. Indexing requires both the owner’s account consent and approval for the book, separate from memory consent. Quillx funds it within service limits without deducting your AI credits. Turning it off stops new processing and blocks pending results; your manuscript is preserved. The index is derived content and must be included in the scope of data access and deletion handling. Turning the feature off is distinct from deleting its stored data or ending the provider’s retention period.
4. Who can see your content
- Your projects are private to you and the people you (or a project owner) invite, according to per-project roles. Access is enforced by row-level security in the database.
- Our staff does not read your content except as needed to operate the Service (for example, investigating an incident or a support request you raise), or where the law requires.
5. Processors and recipients
We share personal data only with the processors that run the Service:
| Processor | What they do | What they receive |
|---|---|---|
| Supabase | Database, authentication, file storage, server functions | All service data |
| Vercel | Web hosting / CDN | Technical/usage data (server logs) |
| Stripe | Payment processing as merchant of record (Stripe Managed Payments), sales tax, payment receipts and billing administration | Name, email, billing address, payment details (directly), purchase history |
| Resend | Sending email (2FA codes, security alerts, notification digests) | Email address, email content |
| Twilio | SMS delivery for phone-based 2FA | Phone number |
| Anthropic / OpenAI | AI processing of requests you initiate | The prompt and context described in §3 |
| PostHog Logs (PostHog, Inc.) | Error monitoring, when enabled | A content-free error record (no account identity, page content or manuscript text). Browser error reports are sent directly from your device, so PostHog also receives your IP address and browser user agent with each report and may keep them under its own retention terms. |
| Sentry (Functional Software, Inc.) | Error monitoring in versions of Quillx before this policy update; it no longer receives data from Quillx | Technical error reports from our server functions and app, which can include request metadata such as IP address. Reports already sent are deleted under Sentry’s retention schedule. |
| Backblaze | Off-site storage of nightly database and uploaded-file backups (encrypted before upload with a key held only by us; immutable for 30 days; deleted after 90 days) | All service data, in encrypted form only |
| hCaptcha (Intuition Machines) | Bot protection on signup/sign-in/reset | Challenge interaction data, IP |
| Have I Been Pwned (k-anonymity API) | Password breach screening | Only the first 5 characters of a SHA-1 hash of a candidate password — never the password, never your identity |
Data may be processed in the United States and other countries; where GDPR applies, transfers rely on Standard Contractual Clauses or an adequacy decision.
We disclose data if required by law, or to protect the rights, safety, or property of Quillx or others, and in a merger or acquisition (with notice).
6. Retention
- Account and content data: kept while your account exists.
- Account deletion: delete your account in Settings → Danger Zone, or email support@quillx.co from the address you sign in with. We keep your account and everything in it for 30 days, in case you change your mind (sign in to restore it), then permanently delete your account, writing, files and settings. Export your work first. The same address handles any other export or erasure request under your data-protection rights. We keep a record of each deletion request (the date, how it was made and when it was completed, not its content) for at least 24 months, and records of your agreement to a subscription’s renewal terms with our billing records, which the law requires us to keep.
- Backups: our infrastructure provider (Supabase) keeps daily backups of our database for 7 days. We also keep nightly encrypted copies of the database and of uploaded files (such as avatars and images) off-site for up to 90 days. Data you delete (including a deleted account) may therefore persist in encrypted backups for up to 90 days after deletion before it is gone everywhere. Backups are used only to restore the Service after a failure, never to bring back data you chose to delete.
- Security events / AI audit logs: retained for security, abuse prevention, and accountability. The security-event log of your account is kept for 12 months, then deleted. Operational records, security records, and evidence of completed controls have different purposes and retention schedules; a single 12-month period does not describe all of them.
- Billing records: kept as long as tax and accounting law requires.
- Email/2FA challenge codes: short-lived (codes expire in about 10 minutes; stale challenges are purged automatically).
7. Your rights
Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you have the right to access, correct, export, delete, restrict, or object to the processing of your personal data, and the right to complain to a supervisory authority.
Available account controls and support routes include:
- Access/portability: Settings → Account & Security → “Download my data”, plus per-project manuscript exports. The data export is a ZIP file built in your browser and saved straight to your device: your manuscripts in the formats you choose (Word, Markdown, PDF, plain text or EPUB), a machine-readable data file (JSON) of your account’s records, and your uploaded images and reference files. It is not sent to us or anyone else. Some records are not in it yet (earlier versions of your manuscripts, billing and credit records, and security logs); email support to request them. Quillx asks you to make this export every week and reminds you in the app; we keep only the time of your last export, in your settings, so the reminder works on all your devices. Contact support if an export fails or does not contain work you expect. Export your work before requesting account closure.
- Correction: edit your profile and settings in-app.
- Deletion: Settings → Danger Zone → Delete Account, or email support@quillx.co from the address you sign in with. See the account-deletion and retention information above.
- Email opt-outs: Notifications → Settings (per-type toggles).
For anything else: support@quillx.co. We respond within 30 days. We do not discriminate against you for exercising your rights.
8. Children and teens
Quillx is a general-audience writing tool. It is not directed at children under 13 (under 16 in the EEA or UK), and everyone confirms their age when they sign up. We comply with the U.S. Children’s Online Privacy Protection Act (COPPA): we do not knowingly collect personal information from children under 13, and if we learn that we have, we close the account and delete that information. If you believe a child under 13 has an account, email support@quillx.co and we will act on it.
Writers aged 13 to 17 may use Quillx. For every user, including teens, Quill is clearly labelled as an AI, the messages you send to Quill are checked by an automated content-moderation system, AI-suggested changes to your writing are applied only after you approve them, and nothing you write is used to train AI models. A parent or guardian with a question about a teen’s account can contact support@quillx.co.
9. Security
Our security controls include database access policies, encrypted transport, provider-managed storage protections, hashed passwords, authentication checks, browser security headers, and security logging. These controls do not constitute certification or a guarantee that every security requirement has been independently verified. No system is perfectly secure; if a breach affects your personal data we will notify you and regulators as the law requires.
10. Changes to this policy
We may update this policy. For material changes we will notify you (email or in-app) before they take effect. The current version is always at this page.
11. Contact
The Fifth Division Inc. · support@quillx.co