Privacy, plainly stated.

The short version

• Your stories stay on your computer. The app does not upload them to us.
• We keep the minimum needed to run your account, take payment and manage your licence.
• We never see your card details. Stripe handles them.
• No advertising, no trackers, no selling data. Website analytics are off until you say yes.

Who is responsible for your data

Ultimate Apps (“we”, “us”) sells and runs NovellaForge. You can reach us at support@novellaforge.app or through the contact form.

We are the “controller” of the personal data described here under the UK GDPR and the Data Protection Act 2018.

What we collect, and why

Account and sign-in

Your email address, when you start a trial, buy, request a sign-in link or contact us. We use it to create your account, email you one-time sign-in links, and answer you. There are no passwords: we email a link. Basis: performing our contract with you.

Purchases and licences

What you bought, the amount, the date, your terms and download consents, and Stripe’s reference numbers for the payment, customer and any refund. We use this to give you your licence, handle refunds and meet our accounting duties. Basis: contract and legal obligation.

Your devices

When you activate the app we receive a device identifier (a hash of a public key the app generates), that public key, your operating system (for example “linux”) and the app version, plus the dates of first and latest activation. This lets us enforce the device limit and issue your signed licence. It does not include your name, files or stories. Basis: contract and our legitimate interest in preventing licence abuse.

Downloads

When you download the app we record the date, your browser’s user-agent text and, if you are signed in, your account. Basis: legitimate interests (supporting you and checking your entitlement).

Support messages

The name, email and message you send through the contact form, and our replies. Basis: legitimate interests, and contract where it concerns your purchase.

Security

To limit abuse (for example repeated sign-in or checkout attempts) the site counts requests using a one-way hash of your IP address; it does not store the IP address itself in that counter. Our hosting software may keep short-lived technical logs that include IP addresses, which we use only to keep the service secure and working. Basis: legitimate interests.

Cookies and similar storage

• nf_csrf protects our forms from forgery. Strictly necessary; it expires after a day.
• nf_customer keeps you signed in to your account for up to 30 days. Strictly necessary for the sign-in you asked for.
• Your analytics choice, and (only if you accept) a random session number, are kept in your browser’s local storage.

We use no advertising or cross-site tracking cookies.

Website analytics (only with your consent)

If you choose “Allow analytics”, the site records anonymous page views and a few interactions (such as clicking a trial button): the page, the referring site, your browser type, a device category (mobile, tablet or desktop), screen size and time on page, tied to a random session number we hash again before storing. We do not store your IP address in analytics and we do not combine them with your account. If you choose “No thanks”, or your browser sends Do Not Track or Global Privacy Control, nothing is recorded. You can change your mind by clearing this site’s data in your browser. Basis: consent.

What the app itself sends

After you activate it, the app checks your licence on your own computer and does not need to contact us. It contacts us only to activate or refresh a licence (the device information above). It does not send us your stories, prompts, pictures or usage. If you set up an AI provider, your prompts and story text go from your computer to that provider under their terms; we do not receive them.

Who we share data with

• Stripe (Stripe Payments UK Ltd and its group) takes payments for us. It receives your email and payment details and is also responsible for its own handling of payment data under its privacy policy.
• Our hosting provider supplies the servers that run this website, our database and our email. Our servers are located in the United Kingdom. Email is handled by our own mail server rather than a third-party email service.
• Authorities and advisers where the law requires it, or to protect our rights, for example accountants and, if needed, legal advisers.

We do not sell your data or share it for advertising. Stripe may process some data outside the UK; where it does, it relies on approved safeguards such as the UK International Data Transfer Addendum or an adequacy decision.

How long we keep it

• Account, purchase and licence records: as long as your account exists and for six years after your last purchase, because the law requires us to keep accounting records. If you ask us to delete your account and you have bought nothing, we delete it.
• Analytics, download records and support messages: deleted automatically after 24 months.
• Sign-in links, sessions and security counters: removed automatically shortly after they expire.

Your rights

You can ask us to: give you a copy of your data; correct it; delete it (where we do not have to keep it); limit or object to how we use it; move it to another service; and withdraw consent for analytics at any time. Write to support@novellaforge.app; we will respond within one month. You can also release devices yourself on your account page.

If you are unhappy with how we handle your data, please tell us first so we can fix it. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Children

NovellaForge is a tool for adults and young people who can enter a contract; it is not aimed at children under 16, and we do not knowingly collect their data. Stories you make for others are yours; we never see them.

Changes

If we change this policy in a way that matters, we will update the date above and, for significant changes, tell account holders by email.