Privacy Policy

• Account and identity information: Clerk user ID, name, email address, email-verification state, profile image, and authentication/session information.
• Handwriting and User Content: handwriting template images you upload, style names, generated glyphs, style manifests, document text or math you submit for rendering, layout settings, and the generated document returned to you.
• Service and usage information: plan, page and processing allowances, job status, timestamps, document page and character counts, request hashes, guest-preview session and claim status, errors, and export metadata.
• Product analytics information: page paths and bounded events such as starting signup, beginning and completing a generation, page-count and duration ranges, downloads, and checkout steps. These product events do not contain document text, math input, handwriting files, names, email addresses, billing details, or raw error messages. Session recording is disabled.
• Subscription and payment information: Stripe customer and subscription identifiers, plan, billing interval, payment-method status, trial and renewal dates, transaction status, and limited card details such as brand and last four digits. Wrytely does not receive or store your complete card number.
• Consent, security, and anti-abuse information:consent and agreement text/version, acceptance time, salted or keyed identifiers, limited request and device information, hashed IP address and user-agent values for upload consent, deletion tasks, and restricted error-monitoring events when monitoring is enabled.
• Communications: messages, attachments, and contact details you send to support, billing, privacy, or legal channels.

We receive information directly from you, automatically from your browser and use of the Service, and from providers supporting authentication, payments, hosting, databases, private object storage, background processing, and error monitoring. We may also receive information from a person or organization that lawfully provides it to us, such as an authorized privacy representative.

• Authenticate users and maintain accounts and sessions.
• Process handwriting, create styles, render documents, and provide exports.
• Operate trials, subscriptions, billing, allowances, downgrades, and account deletion.
• Send authentication codes and necessary billing, security, support, and Service notices.
• Respond to support, privacy, billing, security, and legal requests.
• Detect fraud, trial evasion, misuse, duplicate requests, and security incidents.
• Debug failures, maintain reliability, improve performance, and develop Service features using minimized operational information.
• Enforce our Terms, protect rights and safety, and comply with legal obligations.

We process handwriting to create the style you request. Wrytely does not use handwriting as a biometric identifier to recognize or authenticate people.

When you press Generate, the Service sends the document text or math and selected settings to Wrytely's rendering system. Wrytely processes that content to return a document image. The rendered result is held in your browser for viewing and, when available, download; Wrytely does not intentionally save the raw document text or generated document to your account database as part of the normal rendering flow.

We retain limited operational information about the request, including a one-way SHA-256 request hash rather than the raw text, plan usage, status, page count, and timestamps. Error and security systems may temporarily process limited request information when needed to diagnose a failure or protect the Service. Avoid entering information that is unnecessary for your document, especially highly sensitive personal information.

Before sign-up, Wrytely uses a random guest-session cookie to enforce the five-page preview limit. The database stores a keyed digest of that token, page usage, a one-way request hash, status, and timestamps—not the raw document text or generated image. If you sign up, the guest usage is transferred once to your account allowance so the preview pages are not granted twice.

When you create a custom style, Wrytely sends your completed template images to a restricted processing worker and stores the resulting private style bundle and related metadata so you can reuse the style. Uploaded source images, job files, generated glyphs, style versions, and manifests may remain while the style or account exists so that we can process, retry, secure, and delete it correctly.

Losing paid access may lock a retained style but does not automatically delete it. Deleting the style or account starts the applicable permanent cleanup process. Do not upload signatures or another person's handwriting unless you have lawful permission.

After Stripe confirms that your card was saved for a Plus or Pro trial, Wrytely creates a keyed HMAC-SHA-256 code from your verified primary email. The anti-abuse record does not contain your email address. It contains the protected code, key version, selected trial type, claim date, and the agreement text/version and acceptance time shown when you started the trial. We use it to enforce one trial per verified identity and preserve evidence of post-trial billing authorization.

We retain this minimal record for the lifetime of the Wrytely Service, including after account deletion. Because Wrytely can compare a verified email with the protected code using a separately secured key, we treat the code as pseudonymous personal information, not anonymous information. When you delete your account, the direct account link is removed from this record.

We disclose personal information only as reasonably necessary for the purposes described here:

• Clerk for authentication and account identity.
• Stripe for payment methods, trials, subscriptions, billing, and fraud controls.
• Vercel for website and server-function hosting.
• Neon for application database hosting.
• Cloudflare for private object storage and related infrastructure.
• Railway for restricted handwriting-processing infrastructure.
• Sentry, when enabled, for restricted error and reliability monitoring.
• PostHog, when enabled, for minimized product analytics and Stripe revenue reporting without session recording or document content.
• Professional advisers and support providers under appropriate confidentiality duties.

We may also disclose information when required by law or valid legal process; to investigate fraud, abuse, or security threats; to protect Wrytely, users, or others; or as part of a merger, financing, acquisition, reorganization, bankruptcy, or transfer of the Service, subject to appropriate notice and safeguards. Providers may process information in U.S. or other locations where they operate.

Wrytely and Clerk use cookies and similar browser technologies that are necessary for authentication, security, sessions, and Service functionality. Wrytely also uses browser session storage for short-lived checkout-attempt bookkeeping and to restore a guest preview after authentication, and local storage or a browser broadcast channel to synchronize sign-out across tabs. When product analytics is enabled, PostHog uses a pseudonymous browser identifier to connect page and product events within the same browser. After you sign in, Wrytely sends your Clerk account ID to PostHog to connect those events with your account activity. Wrytely also imports Stripe customer and billing records into PostHog to measure purchases and revenue. Those records can include your name, email address, customer identifier, subscriptions, invoices, and payment status. Wrytely does not send PostHog your document content or complete card number. These technologies are not currently used by Wrytely for behavioral advertising.

You can control cookies and browser storage through your browser. Blocking or deleting essential authentication or security data may sign you out or prevent parts of the Service from working correctly.

Because Wrytely does not currently sell personal information or use targeted or cross-context behavioral advertising, it does not presently respond differently to browser "Do Not Track" signals. Where legally required, we will treat a recognized opt-out preference signal, such as Global Privacy Control, as a request to opt out of applicable sale or targeted-advertising activity. We do not currently conduct those activities.

• Account, plan, and ordinary usage records are retained while your account exists and afterward only as reasonably needed for deletion completion, security, disputes, legal obligations, and financial recordkeeping.
• Handwriting uploads, processing files, derived styles, and saved style versions may remain until you delete the style or account, including while a style is locked after a downgrade.
• Stripe and transaction records are retained as needed for billing, tax, accounting, chargeback, fraud, and legal obligations.
• Upload-consent evidence is detached from your account during deletion and assigned a one-year retention review or expiration date. It may be retained longer when reasonably required for a legal claim, security investigation, or legal obligation.
• Trial anti-abuse records are retained for the lifetime of the Service as described above.
• Guest-preview sessions are configured to expire after 180 days. Minimal usage and claim records may be retained longer when reasonably necessary to enforce limits, investigate abuse, resolve disputes, or comply with law.
• Support messages and security or error records are retained only as long as reasonably necessary for the request, investigation, Service protection, and legal obligations.

Retention may be extended for an active legal hold, dispute, chargeback, fraud inquiry, or other legal requirement. Backup copies may persist for a limited period before being overwritten. When information is no longer needed, we delete, de-identify, or isolate it from ordinary use.

You may delete an individual custom style from the authenticated account area. Permanent account deletion removes ordinary profile information, uploaded handwriting, style bundles, processing jobs, and other customer content from Wrytely's active systems and requests deletion of the corresponding Clerk identity and Stripe customer, subject to limited retained records described above.

Account deletion immediately ends your ability to use the account and may immediately cancel an active subscription. It cannot be undone after cleanup begins. If you want to use a paid subscription through the end of its billing period, cancel the subscription first and wait until the period ends before deleting the account.

Wrytely does not currently sell personal information, share personal information for cross-context behavioral advertising, use personal information for targeted advertising, or perform profiling in furtherance of decisions producing legal or similarly significant effects. We also do not offer financial incentives in exchange for personal information. If these practices change, we will update this policy and provide any legally required notice and opt-out mechanism before the change takes effect.

Depending on where you live and whether a state privacy law applies to Wrytely, you may have rights to confirm processing; access, correct, or delete personal information; obtain a portable copy; or appeal a denied request. Applicable law may also provide rights concerning sale, targeted advertising, profiling, or sensitive information, although Wrytely does not currently conduct those activities as described above.

Use the authenticated account controls or email support@wrytely.io. Describe the right you wish to exercise. We may need to verify your identity and authority. An authorized agent may submit a request, but we may require proof of authorization and direct verification where permitted. We will respond within the legally required time, will not discriminate against you for exercising an applicable right, and will explain any available appeal method if we deny a request.

California residents may request information about the categories of personal information collected, sources, purposes, and categories of recipients, as described in Sections 1, 2, 3, and 7. Wrytely does not currently sell or share personal information as those terms are used in California law and has not done so during the preceding 12 months. We do not knowingly sell or share personal information of people under 18.

California's specific access, deletion, correction, and portability rights apply when Wrytely is subject to the California Consumer Privacy Act. California's "Shine the Light" law may also permit certain requests about disclosures for direct marketing; Wrytely does not disclose personal information to third parties for their own direct marketing. Submit requests through the contact method in Section 12.

Wrytely is for people who are 18 or older. People under 18 may not create an account, start a trial, create a custom handwriting style, or submit personal information through the Service. We do not knowingly collect personal information from children under 13. If you believe a person under 18 has provided personal information, contact us so we can investigate and delete it as appropriate.

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, restricted private storage, transport encryption, minimized operational records, request and file validation, upload-size and file-type restrictions, rate limits, same-origin checks for billing actions, ownership checks before private assets are served, and deletion workflows. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If you believe your account or information is at risk, contact us promptly.

Wrytely and its providers may process information in the United States and other countries whose laws may differ from those where you live. The Service is currently directed to U.S. users.

We may update this policy as the Service or law changes. We will post the revised policy and update the date above. If a change materially affects how we use previously collected personal information, we will provide additional notice and obtain consent when required before the change takes effect.

Privacy, deletion, billing, security, legal, and general support requests: support@wrytely.io, or use our Contact page. Please do not email complete payment-card details, passwords, or unnecessary sensitive information.