1. Scope and Current Status
This is a substantive pre-launch privacy-policy draft for WritingSignal. It describes the implemented product architecture and intended practices, but it is not yet legally effective. The operating legal entity, controller details, launch regions, and jurisdiction-specific notices require approval before public launch.
2. Information WritingSignal Processes
- Account information supplied through Clerk, such as an identity identifier, primary email address, and available profile name.
- Submitted writing, supported documents, private titles or filenames, Humanizer instructions, and the results created for the account.
- Plan, word-usage, payment-order, paid-through, and payment-status records needed to provide prepaid access. WritingSignal does not receive crypto wallet keys or store payment-card details.
- Feedback, support messages, data-export requests, deletion requests, and necessary service-email records.
- Limited security and technical information such as random request IDs, safe error categories, timing, account-scoped record IDs, and audited staff actions.
3. How Information Is Used
- Authenticate users and enforce account ownership.
- Accept, process, store, display, download, and delete requested analyses and Humanizer revisions.
- Measure separate Detector and Humanizer word allowances.
- Create hosted payment invoices and apply plan access after verified payment notifications.
- Send necessary service messages, investigate problems, prevent abuse, recover interrupted work, and maintain security.
- Produce privacy-safe aggregate product and reliability information without sending submitted writing to ordinary analytics.
4. How Submitted Writing Is Protected
Source writing and Humanizer results use private, opaque object storage and account-scoped authorization. They are excluded from ordinary application logs, PostHog events, Sentry payloads, queue messages, payment records, and routine service emails.
AI Detector text is processed by WritingSignal's private analysis boundary. AI Humanizer text is transmitted to an approved external AI processing service because that transmission is necessary to provide the requested revision. The interface discloses this before submission. WritingSignal does not disclose that processor's credentials or internal infrastructure.
WritingSignal does not use submitted writing for advertising or sell it. Model training or improvement using customer content is off by default and would require a separate, explicit permission.
5. Service Providers
- Clerk for authentication and account identity.
- Namecheap for private virtual-server and network hosting.
- Supabase PostgreSQL for structured account and business records.
- Cloudflare R2 for private content objects and short-lived exports.
- NOWPayments for hosted crypto invoices and signed payment status.
- Paystack for hosted card checkout and verified payment status when card checkout is enabled.
- Resend for necessary service email.
- PostHog for allow-listed, privacy-safe product events.
- Sentry for redacted error and performance monitoring.
- An external AI processing service for user-requested Humanizer revisions.
6. Retention and Deletion
- Active account content is kept until the user deletes an item, requests account deletion, or an approved retention rule expires.
- Temporary uploads and abandoned work are removed through bounded cleanup processes.
- Account-export packages and permissions expire after 24 hours.
- Webhook deduplication records are retained for 30 days.
- After confirmed account deletion, active private content is purged through retry-safe background processing.
- Encrypted managed database backups may contain deleted fragments until backup expiry, targeted at no more than 30 days. A restore must reapply completed deletion checkpoints before accepting traffic.
- Minimal billing, fraud-prevention, security-audit, and deletion records may be retained where operationally or legally required, without submitted writing or object keys.
7. Analytics, Cookies, and Monitoring
WritingSignal uses manual, allow-listed analytics events and does not include submitted writing, filenames, comments, payment data, or identifiable AI scores. Sensitive-page session recording is off.
Clerk may use cookies needed for secure authentication. The separate Cookie Policy describes the current cookie categories and the remaining consent decisions.
8. User Choices and Requests
- Access and review account and plan information in Settings.
- Request a private, short-lived account-data export after recent identity confirmation.
- Delete individual analyses or Humanizer revisions.
- Request account deletion after recent reverification.
- Contact support@writingsignal.com with privacy questions or applicable rights requests.
9. Security and Incident Response
WritingSignal uses authenticated access, account-scoped authorization, private storage, signed webhooks, secret isolation, rate limits, idempotency, bounded requests, safe error handling, monitoring redaction, and audited operational controls.
No system can guarantee absolute security. Incident notification duties and timelines will follow applicable law after launch regions and the operating entity are approved.
10. International Processing and Children
WritingSignal's providers may process information in more than one country. Final transfer mechanisms and regional disclosures require review before public launch.
WritingSignal is not currently positioned as a service directed to children. The minimum age and any school or parental-consent process must be approved before these terms become effective.
11. Contact
Privacy questions may be sent to support@writingsignal.com. A formal privacy contact address and any required representative details will be added after the operating entity and launch regions are confirmed.