Most privacy policies are written to be skipped. This one is part of the product. It's short, it's plain, and we intend to be held to it.
If you read as a guest, your story lives in your own browser, and the only thing we keep is a count: which pages and chapters get read, in aggregate, under a random number your browser holds — no cookies, no IP address, and nothing sent to anyone but us. If you make an account or join the library, we hold: your email address and sign-in records; your story — scenes, the ink ledger, your underlined lines, and your heroine's casting — so it can follow you between shelves; a record of what you've purchased (kept by our payment processor — we never see or store your card number); and any letters you write to us. That's the entire list. No third-party trackers, no advertising pixels, no data brokers, and no profile of you assembled for anyone else's use — nothing about you is sold, shared, brokered, or used to target you, here or anywhere else. We do our own counting, on our own servers, and share it with no one.
Want off any list? Write to hello@heartsandink.com and it's done — emails deleted, not archived.
Hearts & Ink is a place where you'll tell a character things. So we'll say the important part in ink:
Your conversations are never training data. Not for our models, not for anyone else's. They exist for exactly one purpose — so the story can remember you — and for no other use: not marketing, not "product research," not aggregate anything.
You can read everything he knows. The memory ledger — we call it "written in ink" — shows every remembered thing, with the chapter it came from. And where a story lets a character keep notes about you rather than only for you — his margin, his own read on what you've said — those are shown to you in the same drawer, in full, dated, in his words, and you can strike any of them. There is nothing he holds that you are not shown. There is no second, hidden list.
Washing out means gone. Delete a line from the ledger, or strike a line from the margin, and it is removed from his memory and from our systems — not flagged, not soft-deleted. Delete your account and everything goes with it, with one exception that only exists if you switch it on yourself.
The exception, in full: custody. Some things are written precisely so they can outlive the account — a letter meant to be opened by a daughter at eighteen is worthless if it dies the day you close your library card. So you may place specific things in the library's custody: letters you have addressed to a named person to be opened on a date or a condition, and your bound volume. Custody is off unless you turn it on, and turning it on asks you to read and accept its own short terms first. When it is on, those letters — and only those — are kept if the account goes, together with the address they were written to, held where no reader-facing part of the site can reach them, and released only on the condition you set. Everything else is still deleted with the account: your story, your ledger, your margin, your email. Switch custody off and nothing is held at all; withdraw it before you delete and your deletion is ordinary and total. You can see exactly what is in custody at any time, and take a complete copy of all of it whenever you like.
If you name someone. Naming an heir means giving us their name and a way to reach them. We use it for one thing — the delivery you asked for — and for nothing else: never marketing, never an account created on their behalf, never passed to anyone. Remove them and their details go immediately. They are told nothing until the moment you designed for them, and if you withdraw custody, they are never contacted at all.
We will never sell your data. Our business is membership. You pay us; that's the entire model. The moment a company's revenue comes from somewhere other than its readers, its readers become the product — so we've made that structurally impossible here.
Who touches your data, and why. A short, complete list of the services that operate the library, each bound to use your data only to do its job for us: Supabase hosts accounts and your saved story. Stripe processes payments (your card number goes to them, never to us). Anthropic provides the AI that writes the character's side of a scene — your words in a scene are sent to it to generate his reply, and are not used to train its models. Netlify serves the site. Resend delivers our letters. None of them may sell, share, or repurpose anything of yours.
How long we keep things. As long as you have an account, and no longer — with the single exception of anything you deliberately placed in custody, described above, which is kept until the condition you set is met. Delete a ledger line and it's gone; delete your account and your story, ledger, margin, and email go with it. Purchase records stay with the payment processor for as long as tax and accounting law requires — that part isn't ours to shorten.
Your rights. Wherever you read from, we honor the strong version: write to us and we'll show you everything we hold about you, correct it, or delete it — usually within days, at most within a month. You can also complain to your local data-protection authority, though we'd rather you gave us the chance to fix it first.
Where your data lives. Hearts & Ink is operated from the United States and the services above are US-based; if you read from elsewhere, your data is processed in the US under the contracts described here.
Hearts & Ink is for readers eighteen and over, and we do not knowingly hold data about anyone younger. If a minor's account comes to our attention, we delete it. More on who the library is for, and the honest words about the pen being an AI, on the Pen & the Reader page.
Questions, doubts, or a promise you think we've bent?
Write to us: hello@heartsandink.com