Privacy Policy

1. Who We Are and Scope

Authorlytics LLC ("Authorlytics," "we," "us," or "our") operates a family of author-focused software products, including S.A.M. (Software About Manuscripts), RoyalTree, BookEnd, and Editionary, a planned cover-design application. This Privacy Policy applies to our websites, applications, shared account services, beta programs, support channels, and related communications (collectively, the "Services") when they link to this policy. Product-specific notices may supplement this policy if a feature requires additional disclosures.

Privacy contact: privacy@authorlytics.app.
Business mailing address: 202 N Cedar Ave, St #1 Owatonna, Minnesota 55060.

2. One Authorlytics Account, Multiple Products

Our Services use shared identity and account infrastructure hosted through Supabase. A single Authorlytics account lets you sign in to each product you have added and view your subscriptions and entitlements. You add each product separately, by signing up for it or adding it to your account, and every product has a free tier. Signing up for or buying one product does not enroll you in another, and a product you have never added has no access to your account.

Shared infrastructure does not mean all products or their users can freely view all information. We use account authorization and product-specific access controls to limit access. Basic book information that more than one product uses (such as titles, series, editions, ISBNs, retailer listings, and print specifications) is stored once in your shared Authorlytics account. When you add another product, that product can use this shared book information without a separate linking step. For example, a book you create in S.A.M. appears in BookEnd once you add BookEnd, and its print specifications are available to Editionary once you add Editionary. Each product’s own records, such as manuscripts in S.A.M. or financial records in RoyalTree, stay with that product.

3. Your Creative Work and Ownership

You retain ownership of original manuscripts, stories, notes, illustrations, covers, and other creative material that you create or upload, subject to any third-party rights in assets you use. We do not claim ownership merely because you store or work on that content in our Services. We process content to deliver features you choose, including saving, organizing, displaying, editing, exporting, rendering, and, when authorized, sharing or transferring it between products or collaborators.

Based on the current S.A.M. design, we do not use manuscripts or creative content to train generative AI models, sell them, or supply them to AI companies for model training.

Feedback, suggestions, and ideas you send us about the Services are not treated as your creative work. We may use them to improve our products without obligation to you, as described in the applicable terms or beta agreement.

4. Information We Collect

Account and identity: name or display name, email, optional profile image, authentication identifiers, account preferences (such as display settings, home currency, time zone, and tax-accounting basis), selected products, subscriptions, entitlements, and sign-in/security records. Google sign-in information (such as the name, email address, and profile picture link Google provides) is received only if you choose that option.

Creative and project information: manuscripts, books, series, notes, writing/version history, world-building and reference records, ideas, name lists, items in trash, uploaded images and files, fonts and dictionaries, book metadata, cover layouts and exports, and information you choose to share with collaborators. Not every product collects every category.

Writing activity: when you write, how much you add or change in a session, your local date and time zone, and when you open each book. We use this to show your writing history and statistics.

Financial and commercial information: if you use RoyalTree, financial records you enter or import, such as books, editions and identifiers (ISBN, ASIN), retailers, list prices and royalty rates, sales and page-read counts, royalties and payments (including tax withheld and currency conversions), expenses and vendors, and receipts you attach. When you import a retailer report (such as an Amazon KDP report), the file is read in your browser and the original file is stored so the import can be reviewed. Report files that are not used in an applied import are deleted after 7 days. We keep a history of changes to financial records to protect their accuracy. We do not ask for or store bank account numbers, tax identification numbers, or retailer login credentials. If we offer paid subscriptions, billing identifiers, payment status, and transaction records will be processed. Payment card details will be handled by our payment provider, Stripe, and not stored by us. For their privacy policy: https://stripe.com/privacy

Publishing information: if you use BookEnd, book editions, ISBNs, release dates, retailers, pricing, marketing tasks, launch schedules, and other publishing records you enter.

Cover-design information: if you use Editionary, uploaded artwork, licensed assets, design layers, templates, print dimensions, trim and bleed specifications, cover exports, and associated book metadata.

Beta and support information: application details (such as your name, email, what you write or publish, where you sell, the tools you currently use, how you heard about us, and which other Authorlytics products interest you), feedback, support correspondence, screenshots, technical diagnostics, and where applicable NDA acceptance evidence such as your typed name, email, country, IP address, browser user agent, timestamp, agreement version, and a cryptographic fingerprint of the exact text you accepted. A full copy of the agreement is emailed to you when you accept.

Feedback you send in an app may include a category, title, and description; a screenshot only if you choose to attach one (you can crop or black out parts of it first); and, unless you untick the option, diagnostics such as app version, browser and user agent, language, window size, the screen you were on, connection and save status, and the types and times of recent errors.

To protect our forms from automated abuse, we use a self-hosted challenge and keep only hashed (non-reversible) forms of email and IP addresses for rate limiting. These are deleted within 48 hours.

Technical and security information: IP addresses and request logs held by infrastructure providers, IP addresses and user agents we record with agreement acceptances, sign-in events, browser and application information, diagnostics, and records needed to prevent abuse or document account administration.

5. How We Use Information

Provide, maintain, authenticate, and secure Authorlytics accounts and the products you choose.
Store and process projects and creative work; support imports, exports, synchronization, offline use, and authorized collaboration or product connections.
Show your writing history, statistics, and dashboards you choose to use.
Manage subscriptions, billing, support, beta applications, and applicable agreements.
Diagnose errors, respond to feedback, maintain backups, prevent abuse, and meet legal obligations.
Send necessary account and service notices, and optional promotional messages where you have consented or where otherwise permitted by law.
Analyze limited product usage or aggregated operational information only as disclosed and supported by actual implementations. We do not currently use third-party analytics, advertising, or tracking scripts. If we add them, we will update this policy and ask for consent where required.

We may disclose information to service providers performing hosting, authentication, email delivery, payment processing, security, and support functions; to collaborators or recipients you explicitly authorize through sharing features; and when legally required or necessary to protect rights and safety. Information may also be disclosed in a merger, acquisition, or transfer of business assets subject to applicable law. We do not sell manuscripts or personal information. Our current service providers are Supabase (database, authentication, file storage, and server functions), Render (website hosting and content delivery), Postmark (email delivery), Google (optional sign-in), GitHub (software development and storage of encrypted pre-release database backups), Backblaze (storage of encrypted nightly off-site backups of our database and uploaded files), Healthchecks.io (monitoring that our backup job ran; it receives job status messages, not your content), and Cloudflare (domain name services). RoyalTree also downloads published currency exchange rates from the European Central Bank; no personal information is sent to it. When we offer paid plans, Stripe will process payments. We do not disclose personal information to third parties for their own marketing.

Authorized administrators can see account-level information: your email address, display name, role, account creation and last sign-in times, and account status. They can also see feedback you send (including screenshots and diagnostics), beta applications, and agreement acceptance records (including IP address and user agent). Administrative tools show counts of your projects and files, not their contents, and do not give access to your creative work or financial records. Administrative actions such as role changes, account restrictions, and deletions are logged. However, our Services do not apply independent end-to-end encryption, and individuals with sufficiently privileged access to the underlying database or backups could technically access stored content, including creative work and financial records. We do not promise that no employee, founder, provider, or infrastructure administrator can ever access it. Access must be restricted, logged where feasible, and used only for legitimate operational, security, support, or legal purposes. Founder(s) of Authorlytics LLC holds administrative rights over the applicable third party infrastructure.

7. Security, Hosting, and International Transfers

Your account and the content you create are stored and processed in the United States, by our database and storage provider (Supabase) and in our encrypted off-site backups (Backblaze B2, run from Render). The websites’ public files, which contain no personal information, are delivered through a content delivery network that may serve them from locations worldwide. Backups are encrypted before they are stored: pre-release database backups with AES-256, and nightly off-site backups of the database and uploaded files with XSalsa20-Poly1305 authenticated encryption, with file names also encrypted. Our nightly backup job runs on Render and stores its encrypted copies with Backblaze in the United States. Other products and services may use additional providers. We use encrypted network connections, provider-managed encryption at rest, and access controls, but no online service can guarantee absolute security.

Information from users outside the United States may be processed in the United States and other locations where providers operate. Applicable privacy laws may provide additional rights and require transfer safeguards.

8. Browser Storage and Offline Data

S.A.M. uses browser local storage for sessions and preferences, session storage for tab coordination, IndexedDB for offline book copies and pending changes, and service-worker caching for application files. S.A.M. does not separately encrypt browser-stored creative content. People who can access your browser profile may be able to access locally stored data. Deleting your cloud account does not necessarily erase browser copies; clear site data on each device. S.A.M.’s offline storage also holds feedback and screenshots waiting to be sent and a local log of recent errors. If you turn on the optional Word copy feature, S.A.M. saves a copy of your manuscript to a folder you choose on your device. That copy is yours to manage and is not removed when you delete your account.

RoyalTree keeps only your sign-in session and display preference in your browser. It does not store your financial records on your device. Our applications do not use advertising or cross-site tracking cookies.

9. Retention and Backups

We keep account and product information for as long as needed to operate your account, deliver the Services, meet legal requirements, and fulfill the purposes described here. Retention varies by category and product. Financial and transaction records may need to be kept longer than creative projects for tax, accounting, or legal reasons. NDA acceptance and security/deletion records may also have distinct retention requirements.

We keep three kinds of backups. Our database provider keeps daily backups for seven days. We keep an encrypted database backup taken before each software release for 90 days. Each night we also make an encrypted off-site backup of the database and of every uploaded file (such as images, fonts, receipts, covers, and report files), and keep each nightly copy for 90 days. Database backups include account and sign-in records. When you delete a file or your account, the off-site backup keeps the earlier copy for up to 90 days before it is permanently removed; we do not restore deleted data from backups except to recover from a failure of our own systems. Copies may remain in backups until those backups expire. At this time, member data is saved across multiple servers.

Specific records are kept as follows:

Agreement (NDA) acceptance records: for as long as needed to enforce the agreement, including after account deletion.
Feedback: kept after account deletion with your name, email, screenshot, and diagnostics removed.
A minimal deletion record: the account identifier and the dates deletion was requested and completed.
If an administrator restricts or deletes an account: the email address, name, and reason, so the restriction can be enforced.
Records of administrator role changes.
Hashed rate-limit records: up to 48 hours.
Unused import files: 7 days.
Beta applications that do not result in an account: Within 30 days after public product release, applicants will receive marketing from Authorlytics LLC via email to ensure the applicant is aware of the public product release, after which their application will be deleted.

10. Deleting Accounts and Individual Products

S.A.M. currently describes a 30-day pending account-deletion period during which users may sign in, view existing content, and cancel deletion, but cannot create new content. After that period, active-system deletion is completed subject to lawful exceptions and backup expiration. This is a description of the current S.A.M. process, not a verified policy for the future shared Authorlytics account.

To protect you, deletion requires a recent sign-in and an explicit confirmation. Where available, you can download a copy of your work before your account is deleted.

With a shared account, discontinuing one product must be distinguished from deleting your entire Authorlytics account. Deletion of any product specific account when used in tandem with another app(s) data, will keep the continuing account’s data stored, where-as the deleted account’s app-specific data will be purged after 30 days and starting from scratch will be available to any user after that time. Expired accounts hold information as a read-only indefinitely until full Authorlytics account deletion, or default to the free tier of the product until such time that a user re-ups their subscription. Requests may be made at privacy@authorlytics.app; in-app controls will be described when available.

11. Marketing and Communications

We send essential messages about accounts, purchases, security, product changes, and service operations. Promotional emails about Authorlytics products or testing opportunities are optional where consent is required. You may unsubscribe using the message link or by contacting privacy@authorlytics.app. We may retain a minimal suppression record to honor your preference. Beta applicants that did not receive access to their requested Authorlytics product will receive marketing material within 30 days of public product launch, after which their application is purged.

12. Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information, object to or restrict certain processing, withdraw consent, or appeal certain decisions. We may verify your identity and apply lawful exceptions. Contact privacy@authorlytics.app.

We do not sell personal information or share it for targeted advertising. If that changes, we will honor opt-out preference signals such as Global Privacy Control.

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

These rights include:

Right to know whether or not we are processing your personal data
Right to access your personal data
Right to correct inaccuracies in your personal data
Right to request the deletion of your personal data
Right to obtain a copy of the personal data you previously shared with us
Right to non-discrimination for exercising your rights
Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”)

California “Shine The Light” Law

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section “Contact.”
We do not currently disclose personal information to third parties for their direct marketing purposes.

Australia

We collect and process your personal information under the obligations and conditions set by Australia’s Privacy Act 1988 (Privacy Act).

This Privacy Policy satisfies the notice requirements defined in the Privacy Act, in particular: what personal information we collect from you, from which sources, for which purposes, and other recipients of your personal information.

At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details listed in the section “Contact.”

If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner.

13. Children and Eligibility

You must be at least 13 years old to create an Authorlytics account, or older if the law where you live sets a higher minimum age to consent to the processing of personal information (for example, 16 in some countries of the European Union). Authorlytics’ beta tests are intended for adults aged 18 and older. Our Services are not directed to children under 13, and we do not knowingly collect personal information from them. We ask you to confirm your age when you apply or create an account. If we learn that we have collected personal information from a child under 13, or from someone below the minimum age where they live, we will delete it and close the account. If you believe a child has given us personal information, contact privacy@authorlytics.app.

14. Future Features and Changes

As Authorlytics develops, new features may include collaborative writing, beta reading, shared book metadata, cover design, financial integrations, publishing workflows, and additional products. We will update this policy and provide any additional notices or choices required before material changes in how personal information is collected, used, or shared. The current version and effective date will appear above.

15. Contact

Authorlytics LLC
Privacy inquiries: privacy@authorlytics.app
Website: https://authorlytics.app
Mailing address: 202 N Cedar Ave, St #1 Owatonna, Minnesota 55060