Privacy policy

Hellowriter ("we", "us") is an AI story-writing service available at hellowriter.ai, operated by a limited liability company based in Florida, United States. This policy explains what information we collect when you use Hellowriter, how we use it, and the choices you have. For anything privacy-related, email us at [email protected].

We collect only what we need to run the service:

• Account information. When you sign up we ask for your email address. You can add a display name later. If you sign in with Google, Google shares your name, email and profile picture with us. Passwords and sign-in codes are handled by our authentication provider (Neon) — we never see or store your password.
• Content you create. Your story ideas and prompts, the story text itself, the characters, places and chapters that make up your story, your writing-style preferences, and the images generated for your stories.
• Billing information. Payments are handled entirely by Stripe. Your card number never touches our servers. We store your subscription status and Stripe customer and subscription identifiers.
• Usage information. We use PostHog analytics to understand how the product is used — pages visited, features used, and basic device and browser information. After you sign in, this activity is linked to your account.
• Technical information. Your IP address, which we use to rate-limit the free story generator and to protect the service from abuse, and standard server logs.

We use your information to run Hellowriter: to generate and illustrate your stories, keep your characters and chapters consistent as your story grows, process payments, send you the emails the service needs (like sign-in codes), understand what to improve, prevent abuse, and meet our legal obligations. We do not sell your personal information, and we do not show ads.

Hellowriter is built on AI models. When you generate story text, your prompt and the relevant parts of your story are sent to AI model providers — routed through OpenRouter to models from Anthropic and Google. When you generate images, image prompts derived from your story (and, for character consistency, previously generated character images) are sent to fal.ai. These providers process your content only to produce a response, under their API terms. The free generator on our public pages works the same way, even before you have an account.

We do not use your stories to train our own models. We record AI inputs and outputs in our analytics tooling (PostHog) so we can monitor quality, errors and cost — this data is handled under the same protections as the rest of your information.

We share data only with the service providers that make Hellowriter work, and only for the purposes below:

• Neon (United States) — database hosting and account authentication.
• Stripe (United States) — payment processing and subscription billing.
• Amazon Web Services (United States) — sending transactional email.
• Cloudflare (global) — story and image storage, content delivery and image resizing.
• OpenRouter (United States) — AI request routing to models from Anthropic and Google.
• fal.ai (United States) — image generation.
• Google (United States) — optional "Sign in with Google".
• PostHog (United States) — product analytics.

We use a small number of first-party cookies and similar storage:

• Essential cookies keep you signed in (session cookies set by our authentication layer). Deleting them signs you out.
• An analytics cookie from PostHog gives your browser a random identifier so we can count visits and understand usage. Blocking it does not break the site.
• A preference cookie remembers your language. Your light/dark theme choice is kept in local storage.

We send transactional email that the service needs to work: sign-in codes and magic links, email verification, password resets, a welcome message, and billing notices. These are sent from mail.hellowriter.ai.

We send marketing email — product news, tips, offers — only if you opt in. Every marketing email includes an unsubscribe link, and unsubscribing never affects the transactional email your account needs.

We keep your data for as long as your account is active. You are in control of deleting it:

• Delete a story any time from your stories page. This permanently removes the story text, its history and its generated images from our storage.
• Delete your account from your profile page. This permanently removes all of your stories, images and writing-style data, cancels any active subscription, and deletes your account record with our authentication provider.
• Residual copies in encrypted backups and logs are cleared on their normal rotation schedule, typically within 30 days.
• Stripe retains payment records for as long as tax and accounting law requires — that retention is outside our control.
• You can also email [email protected] and we will delete your data for you.

If you are in the EU, EEA, UK or another region with data-protection laws, you have the right to access, correct, delete and receive a copy of your personal data, to restrict or object to certain processing, and to lodge a complaint with your local supervisory authority. Most of these you can exercise directly in the product (export your stories, edit your profile, delete stories or your whole account); for anything else, email us.

If you are a California resident, you have the right to know what personal information we collect, to delete it, and to correct it. We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We will never discriminate against you for exercising your rights.

Hellowriter is operated from the United States and our service providers listed above process data primarily in the United States. If you use Hellowriter from the EU, EEA, UK or Switzerland, your data is transferred to the US under recognized safeguards — our providers rely on standard contractual clauses and, where applicable, EU–US Data Privacy Framework certification.

Hellowriter is for people aged 16 and older. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has created an account, email us at [email protected] and we will delete it.

All traffic to Hellowriter is encrypted in transit (TLS), your data is encrypted at rest by our infrastructure providers, and access to production systems is limited to what operating the service requires. No online service can promise perfect security, but if we ever learn of a breach affecting your data, we will notify you as the law requires.

When we change this policy we will post the new version here and update the date at the top. If a change meaningfully affects how we handle your data, we will tell you by email or in the product before it takes effect.

Questions, requests or complaints about privacy: [email protected].