Privacy Policy · Quillia

Last updated: 25 October 2026

This policy explains what personal information Quillia ("Quillia", "we", "us") collects when you use quillia.net, why we use it, who we share it with, and the choices and rights you have. We're the data controller for this information.

1. The short version

We collect what we need to run your account, show your stories and process payments.
We don't sell your personal information or your stories.
We don't use your stories to train AI models.
When you use the AI tools, the text you send is processed by our AI providers to generate a reply.
We only use essential cookies - no advertising or tracking cookies.

2. What we collect

2.1 Information you give us

Account details: name, email address, password (stored securely hashed - we can't see it), date of birth, and your pen name if you set one.
Profile: a profile photo if you upload one.
Your writing: stories, chapters, notes, characters, covers and anything else you create or upload, including stories you import from Word documents.
Activity on stories: comments and replies, ratings, bookmarks, the authors you follow.
Messages to us: what you send through the contact page, with your name and email.
Payments: a record of the credits you buy. Card details go straight to Stripe - we never receive them.

2.2 If you sign in with Google

We receive your name, email address and Google account ID from Google. We don't use your Google profile photo.

2.3 Collected automatically

Reading activity: which chapters are viewed, so authors can see how their published stories are doing. Authors see totals, not who read what.
Technical information: browser type, device type, pages visited and similar usage information, through Vercel Web Analytics, which doesn't use cookies.
Security information: IP addresses, kept briefly in server logs and, for the contact form, as a scrambled (hashed) value used only to stop spam.

3. Why we use it

To run Quillia - your account, saving and showing your stories, notifications, emails like account verification and password resets (to perform our contract with you).
To process payments and credits (contract, and our legal obligation to keep financial records).
To provide the AI tools - sending the text you choose to our AI providers to generate a reply (contract).
To apply age limits - your date of birth decides whether mature content is available to you (legal obligation and legitimate interests in protecting younger users).
To keep Quillia safe - preventing spam, fraud and abuse, and moderating content that breaks our Terms (legitimate interests).
To improve Quillia - understanding how features are used and fixing bugs (legitimate interests).
To answer you when you contact us (legitimate interests).

We don't send marketing emails without your permission.

4. Your stories and privacy

Stories are private drafts until you publish a chapter. Published chapters can be read by anyone, including people who aren't signed in. Your pen name (or your name, if you haven't set a pen name), profile photo, published stories, comments and follower count are shown publicly.
We don't read your private drafts. We may look at content when we need to - for example to investigate a report, a security problem or a legal request, or when you ask us for help with it.
We don't use your stories to train AI models, and we don't sell them.

We use trusted service providers to run Quillia. They only process your information on our instructions:

Vercel - hosts the website, and provides cookie-free analytics.
Prisma / Neon - database hosting in Frankfurt, Germany.
Cloudflare - stores uploaded images such as profile photos and covers.
Stripe - processes payments.
OpenRouter and the AI model providers it routes to (such as Anthropic) - process the text and prompts you send with the AI tools, and generate covers.
Zoho - sends our emails.
Google - if you choose to sign in with Google.

We may also share information if the law requires it, to protect people's safety, or as part of a sale or reorganisation of the business (in which case this policy would still apply to your information).

6. International transfers

Some providers (such as Vercel, Stripe, OpenRouter and Anthropic) are based in, or process data in, the United States. Where personal information leaves the UK or EU, we rely on recognised safeguards such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the EU-US / UK-US Data Privacy Framework.

7. How long we keep it

Your account and content: while your account is open. When you delete your account, we delete it within 30 days. Copies in backups are removed as the backups are overwritten.
Payment records: for 6 years, as UK tax law requires.
Contact messages: up to 2 years, so we can follow up on reports and feedback.
Server logs: a short time, usually days.

8. Cookies

We use one essential cookie to keep you signed in, and the browser's own storage for things like remembering that a visitor has confirmed they're 18 or over for this visit, and saving drafts while you write. These are needed for the site to work, so they don't need your consent. We don't use advertising or cross-site tracking cookies.

9. Age

You must be 13 or over to create a Quillia account. We use your date of birth to decide whether mature content is available to you - it isn't shown publicly. If you're under 18, mature content is hidden from you. If we learn that an account belongs to someone under 13, we'll delete it.

10. Your rights

Under UK and EU data protection law, you can ask us to:

give you a copy of your personal information
correct information that's wrong or incomplete
delete your information
limit or object to how we use it
give you your information in a portable format - you can also export your stories from My Books at any time

To make a request, email privacy@quillia.net from the email address on your account. We'll reply within one month.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk), or your local data protection authority in the EU.

11. Security

We use HTTPS everywhere, encrypted database connections, hashed passwords and limited access to personal information. No system is perfectly secure, so please use a strong, unique password.

12. Changes

If we make significant changes to this policy, we'll tell you by email or on the site before they take effect.

13. Contact

Privacy questions or requests: privacy@quillia.net, or use our contact page.