Privacy Policy

Last updated: 2 July 2026

The full policy

1. Who we are

This service is provided by Binary Spiders Ltd, a company registered in England & Wales (company number 09525143) ("Wayscript", "we", "us"). We are the data controller for the personal data described in this policy.

For any privacy question, or to exercise your rights, contact us at [email protected].

2. The personal data we collect

• Account details. If you create an account, we collect your email address, a username (handle), an optional display name, and a securely hashed password. Your handle and display name are visible to others when you use community features.
• Your content. Your manuscripts, scenes, story bible (characters, places, items, notes), goals, writing history, and dictionary terms. On the free app this stays on your device; on paid plans it syncs to our servers (see §4).
• Subscription & billing data. Your plan, subscription status, renewal date, review-credit balance, and the customer/subscription identifiers from our payment provider. We do not receive or store your card details (see §6).
• AI usage records. When you use an AI feature we log minimal metadata (the type of action, an approximate word count, and a timestamp) to manage your credit allowance and to support authorship certification.
• Shared content. If you share an excerpt for feedback, we store the excerpt and your chosen sharing settings (e.g. whether comments or downloads are allowed, and an expiry).
• Technical data. When you connect to our servers or load our website, standard technical information (such as IP address and browser type) is processed to deliver and secure the service. We run no analytics service, third-party or otherwise — any aggregate insight into usage comes from our own server logs (see §8).
• Location signal for age gating. To meet our online-safety duties we derive an approximate country from your IP address to decide whether age-restricted content should be gated for you. We do not store your raw IP address for this purpose — only a coarse country code, and only against your account so that we don't have to re-check you each visit (see §14).
• Age-verification status. If you complete age verification, we store only the fact that you passed, the method, and the date — never a copy of any identity document (see §14).

We do not intentionally collect special category data. Please don't include sensitive personal information about real, identifiable people in content you sync or share.

3. How we use your data, and our lawful bases

• To provide the service — run your account, sync and back up your work, process your subscription, and deliver the features you use. Lawful basis: performance of a contract.
• To run optional AI features you choose to use. Lawful basis: performance of a contract, and your consent where applicable.
• To keep the service secure and working — prevent fraud and abuse, flag likely machine-generated or copied text, debug problems, and understand usage in aggregate. Lawful basis: our legitimate interests.
• To communicate with you — service messages such as account, security, or subscription notices. Lawful basis: performance of a contract / legitimate interests. We will not send marketing without your consent.
• To comply with the law where we are required to. Lawful basis: legal obligation.
• To keep children safe — classify content, resolve an approximate country, and gate age-restricted content behind age verification for users in regions that require it, and to review reported content. Lawful basis: legal obligation (online-safety duties) and our legitimate interests.

4. Local-first storage and cloud sync

The free desktop, mobile, and web app is local-first: your writing is stored on your own device and is not transmitted to us. If you use a paid plan and enable cloud sync, your content is sent to and stored on our servers — encrypted in transit and at rest — so you can access it across devices and benefit from backups. Our servers are hosted within the UK and/or EU. You can stop syncing, export your work, or request deletion at any time.

5. AI features and your text

Wayscript's AI tools — passage diagnostics, the Reviewer, Discover analysis, and inline autocomplete (Smart Compose) — are optional and available on paid plans. When you trigger one, the relevant text (for example, the passage you selected, the excerpt you submit, or a short span of context around your cursor) is sent through our backend to our AI sub-processor, Anthropic, which generates the response.

• Your manuscript is only sent when you actively ask for an AI result.
• Under our provider's terms, your inputs and outputs are not used to train AI models.
• The Reviewer only ever critiques; it does not generate prose for you. Discover analysis produces estimates (such as keywords, an age rating, and originality/AI-use indicators) to support transparency and accountability.
• These analyses are tools for you and are not used to make decisions that produce legal or similarly significant effects about you.

6. Payments

Payments and subscriptions are handled by Paddle (Paddle.com Market Ltd), acting as Merchant of Record. Paddle collects and processes your payment details directly under its own privacy policy; we never receive your full card number or payment credentials. We receive confirmation of your subscription and the identifiers needed to manage your plan and credits.

7. Community and sharing

If you use community and sharing features, your handle and display name are visible to other users, and any excerpt you choose to share is visible to the people you share it with, according to the settings you select. Real-time features such as chat and writing sprints relay messages live between participants and are not stored by us after the session. Don't post anything you wouldn't want others in that space to see.

You can report any work or comment you believe is illegal or harmful. Reports go to our moderators, who can remove content and, where warranted, suspend the account responsible. We keep a record of reports and the action taken.

8. Cookies, local storage and analytics

We do not use advertising or cross-site tracking cookies, and we do not run any third-party analytics. To run the app we store a small amount of strictly-necessary data in your browser's local storage — your sign-in token, your preferences (such as theme and language), and any drafts saved offline so you don't lose work. Because this is strictly necessary for the service, it doesn't require consent under PECR; a one-time in-app notice tells you about it on your first visit.

Any insight we have into usage comes only from aggregate server logs (for example error rates), not from tracking you. Web fonts and other assets are served from our own infrastructure rather than third-party content delivery networks.

9. Who we share data with (sub-processors)

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract:

• Anthropic (USA) — AI processing for the review, Discover, and autocomplete features: the text you submit for analysis, with no account identifiers attached.
• Paddle — payment processing and subscription management (as Merchant of Record).
• Our cloud hosting provider (UK/EU region) — hosting the application and database for paid-plan sync.

We keep a dated sub-processor register (with each provider's service, location, and safeguard) and will give notice before adding a new one — available on request. We may also disclose data where required by law, or to establish, exercise, or defend legal claims.

10. International transfers

Our AI provider, Anthropic, is based in the United States, so when you use an AI feature the text you submit is transferred there. We rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in our provider's data-processing terms, and have completed a transfer impact assessment, to protect that transfer. Only the submitted text is sent — no name, email, or handle. Your synced account and content otherwise stay on UK/EU servers.

11. How long we keep your data

We keep your account and synced content for as long as your account is active. When you delete your account in-app the erasure is immediate on our live systems; requests sent by email are actioned within 30 days, and erased data drops out of routine backups within about 90 days. Short-lived items (password-reset tokens, logout records) are purged automatically, and our security/audit log is kept for 2 years. Content on the free local app is held only on your device and is not retained by us; real-time chat and sprint messages are not stored after the session. We maintain a full retention schedule — available on request.

12. How we protect your data

We protect your data with appropriate technical and organisational measures: encryption in transit (HTTPS/TLS), encryption at rest provided by our hosting infrastructure, securely hashed passwords, role-based access controls, rate limiting and account lockout against brute-force, revocable sessions, and use of a PCI-compliant payment provider so we never handle card data. No system is perfectly secure, but we work to keep your information safe and to improve our protections over time.

13. Your rights

Under UK GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to its processing; data portability; and to withdraw consent where we rely on it. To exercise any of these, email [email protected] — we'll respond within the timeframes the law requires, normally one month.

13.1 Exercising your rights in the app. If you have an account, you can do most of this yourself, immediately, from Settings → Privacy: Export my data downloads a complete machine-readable copy of your data (access + portability); Change email corrects your contact details (rectification); and Delete account permanently erases your account and personal data (erasure). Deletion and email changes ask for your password to confirm. We log each rights request we action so we can demonstrate we honoured it.

If you're unhappy with how we've handled your data, you can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to put things right first.

14. Children

Wayscript is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

To meet our UK online-safety duties, age-restricted works in the Discover showcase are gated. We derive an approximate country from your IP address to decide whether the gate applies; where it does, the content is shown only after age verification through a certified provider. We store only a coarse country code and the fact that you passed verification — never your raw IP for this purpose, and never a copy of any identity document. We do not attempt to block or ban VPNs; the design resolves around them.

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we'll update the date at the top and, where appropriate, let you know in the app. Continuing to use Wayscript after an update means you accept the revised policy.

16. Contact

Binary Spiders Ltd — privacy enquiries: [email protected].