DATA ETHICS & PRIVACY|Updated October 2026
Privacy Policy
We believe an author’s words are sacred. This policy details how PenCanvas protects your manuscripts, reader relationships, and personal data.
Our commitmentZero AI Model Training
We Never Train AI on Your Private Manuscripts
PenCanvas does NOT use, license, crawl, or analyze your unpublished drafts, world bibles, character dossiers, or reader communications to train machine learning models, public language models, or synthetic datasets. Your creative work remains your exclusive intellectual property.
1. Overview & Core Philosophy
PenCanvas ("we," "our," or "the Platform") is an all-in-one publishing operating system for fiction authors, novelists, and indie publishers. We respect the deeply personal nature of creative writing.
Unlike ad-supported platforms or social media hubs that monetize user content, PenCanvas is funded strictly through transparent, direct software subscriptions. You are our customer, not our product.
2. The Zero-AI Training Guarantee
As an indie author platform, we recognize the existential risk unauthorized AI scraping poses to writers. Under our terms and privacy architecture:
- Your manuscripts, chapters, revision snapshots, outlines, and character bios are treated as strictly confidential author property.
- We do not sell, license, or share author text with third-party generative AI labs or datasets.
- PenCanvas has no AI features. Your text is never sent to an AI service.
3. Information We Collect
We only collect data strictly necessary to provide the platform services:
Account Credentials: Name, pen name, email address, password hashes (bcrypt), and workspace billing identifiers.
Author Content: Manuscripts, story lore, chapter notes, book covers, visual editor layouts, and site settings.
Transactional Data: Payment statuses, subscription tiers, and direct sales receipts. We do not store raw credit card numbers; payment data is securely handled by Lemon Squeezy or Stripe.
Telemetry & Error Logs: Aggregated system logs, request durations, browser types, and IP addresses to keep the service running and prevent brute-force attacks.
4. How We Use Information
Your information is used solely to:
- Provide cloud autosave and revision history across your devices.
- Build, serve, and cache your public author website and link-in-bio reader portal.
- Dispatch transactional emails and reader newsletters via AWS Simple Email Service (SES).
- Facilitate direct sales of e-books, bundles and chapters without charging platform commissions.
- Maintain enterprise security, prevent denial-of-service abuse, and verify account ownership.
5. Beta Reader & Reader Data
When you invite beta readers into your manuscript portal:
- Beta reader names and emails, and their reading progress, are stored on behalf of the author.
- The reader view shows the reader's email address as a faint watermark to deter unauthorized manuscript leaks.
- Beta reader comments and survey responses belong entirely to the author and are never published externally.
6. Subprocessors & Infrastructure
PenCanvas works with these infrastructure partners:
Cloudflare
Edge routing, SSL for custom domains, R2 file storage, bot checks (Turnstile) and site analytics.
Amazon Web Services (AWS)
Simple Email Service (SES) for account emails and newsletters; Lambda and CloudFront to run the app.
Stripe, PayPal & Lemon Squeezy
Payment processing: our plan billing (Lemon Squeezy) and the accounts you connect for direct sales.
Supabase (PostgreSQL)
Primary database hosting.
Google
Optional Sign in with Google.
Unsplash
Stock image search in the media library.
Only when you connect them yourself, your content or contacts also go to the social networks you publish to (such as Meta, TikTok, LinkedIn, YouTube, Pinterest, Bluesky, Mastodon and Threads) and the email-list services you sync with (Mailchimp, Kit, MailerLite).
7. Security Safeguards
We employ physical, technical, and organizational measures designed to protect your author data against accidental loss or unauthorized access:
- Encryption in Transit: Public web and API connections use HTTPS.
- Storage: Data is stored with our infrastructure providers (database and object storage), which encrypt stored data at rest. Payment and social-account credentials you connect are encrypted by PenCanvas before they are stored.
- Tenant Isolation: Strict workspace scoping prevents data cross-contamination between author accounts.
8. Data Retention & Portability
You can take your work with you at any time:
- Export a book as DOCX, EPUB or HTML, and chapters as Markdown, plain text or HTML.
- Export your newsletter subscribers and your website form responses as CSV.
- If you delete your account, your workspace, manuscripts and draft history are deleted.
- To keep the free trial to one per person, we keep a salted hash of your email address and the date your trial started after you delete your account. The hash cannot be turned back into your email address, and nothing else is kept.
10. Author Rights (GDPR / CCPA)
Regardless of where you reside, PenCanvas extends full data rights to all users:
- Right to Access: Export your manuscripts, newsletter subscribers and form responses yourself (see section 8), or write to us for anything else we hold about you.
- Right to Rectification: Correct or update any account or billing information.
- Right to Erasure ("Right to Be Forgotten"): Request irrevocable deletion of your account and manuscripts.
- Right to Data Portability: Take your work in open formats: DOCX, EPUB, HTML and Markdown for manuscripts, and CSV for subscribers and form responses.
11. Privacy Contact & Legal Entity
If you have questions, feedback, or requests regarding this Privacy Policy or our security practices, please reach out directly: