Tellustory
Privacy policy
Effective as of To be completed
Tellustory works offline: your novel — characters, places, scenes, chapters, text — is stored on your device. It only leaves it if you turn on sync, to find it on your other devices: this document then says what our server keeps of it, and for how long. Without sync, it only concerns your account data.
Data controller
The controller of the data described here is To be completed, who can be reached at To be completed.
What we keep about your account
Your email address, a fingerprint of your password (never the password itself), the display name you choose, your account status, and its creation and last-update dates. If you sign in with Google, we also keep your Google account identifier and the name and profile picture Google sends us.
Sync
It is optional, requires an account, and is turned on device by device, from the app. Once on, the app sends our server the contents of your books: their cards, scenes, chapters and texts, the edit history of those texts, and — unless you turn it off — their images, recordings and attached files. It only runs while the app is open, never in the background. For each linked device, we keep the name its system gives it (often the phone model), its platform, and the dates it was linked and last synced — not its IP address.
Who can read your synced books
They are not end-to-end encrypted: they are stored as they are on our server, and the people who run it could technically access them. The server itself does not analyse them: it stores them, measures the space they take and hands them back to your devices. The signal that tells your devices something is new only carries a number, never any text.
What we do not keep
Nothing of your books while sync is off: they then live in the app's local database, and only there. Deleting your account does not touch it — but losing your phone does: the export built into the app remains your backup. Nor do we attach an IP address to your devices or to what you sync.
What it is used for
To authenticate you, to let you recover your account and, if you turned it on, to sync your books across your devices, and, if you send us a crash report, to fix the app. Nothing else: no profiling, no advertising, no reselling.
Signing in with Google
If you use "Continue with Google", Google sends us your email address, a stable identifier, and possibly your name and profile picture. We never receive your Google password. This processing is also covered by Google's own privacy policy.
The emails we send you
We keep a log of the emails we send you: their type (address confirmation, password reset, subscription notices), the address and the date they were sent, and what Brevo, our sending provider, reports back to us — delivered, deferred, refused by your mail provider with the reason it gives, or reported as spam. It serves a single purpose: knowing whether an email reached you when you tell us you never got it. We record neither whether you open these emails nor whether you click their links.
Crash reports
When the app closes unexpectedly, it offers at its next start to send us what happened, and shows you the report before it leaves. It contains the type of the error and where in the code it occurred, the app and system versions, the device model, the interface language, whether sync is on and the screen that was open — without what you wrote: the app removes from error messages the text they quote. Added to it is what you choose to attach: a comment, and your account if you tick the box for it. Without it, the report is anonymous. One exception: if the app closes twice in a row right as it opens, it sends a reduced report without asking, with no error message, no screen and no comment. You can turn off any sending in its settings.
Technical data
To limit abusive sign-in attempts, we temporarily count requests per IP address and, for sign-in, per digest of the targeted email address — the address itself does not appear in those counters. They live in memory and expire after a few minutes to an hour. Server logs record errors, without request contents.
Buying the desktop version
The desktop version is sold in app stores — Microsoft Store, Mac App Store — and the store takes the payment: we never see your payment method, your billing address, or the name you use there. To open the software, the app presents us the proof of purchase the store handed it; we ask the store whether it is valid, and from its answer we keep the identifier of the purchase there, what was bought (trial or licence), the date, and whether it is still held. With Microsoft we also keep the identity key the app passed us, for one purpose only: to ask again later whether the purchase was refunded — that store does not tell us.
Your computer's fingerprint
A licence opens three computers. To count them, the app works out a fingerprint of the machine — a digest of its system identifier and of a salt specific to Tellustory — and it is that fingerprint we receive: never the identifier itself, and the fingerprint only recognises your computer for this software. It is tied to your account if you have one, and to the purchase if you do not. You can free a machine up from "Devices".
How long we keep it
Account data is kept for as long as the account exists, and so is what you sync. An edited text replaces the previous one on the server, but its history is not pruned there: the app keeps twenty states per field, the server keeps every state the app sent it. Deleting a book erases its whole content from the server — texts, cards, images and files — the following night. Deleting an item inside a book — a card, a scene — is recorded there so that your other devices repeat it, but the texts and details attached to it are not yet erased from the server: they stay there until you delete your account. Sign-in tokens expire after 30 days and are erased along with the account. The log of the emails we sent is erased after 90 days, and straight away with the account. Crash reports are erased after 90 days, and those you attached to your account straight away with it. The proof of a purchase and a computer's fingerprint are kept for as long as the purchase exists at the store: deleting your account detaches the purchase from it and does not erase the proof that a machine was paid for, because the licence belongs to the purchase. Technical counters expire on their own. Finally, the database is backed up every night and the last three backups are kept: what is erased from it may remain in them for three days.
Your rights
You can view and correct your details from "My account", on this website, and delete your account there: deletion is immediate and final, and it erases from our server everything you had synced to it — your books stay on your devices. It does leave the proof of a desktop purchase behind, detached from your account: without it, the software you paid for would stop opening. For any other request, write to us at the address given in the legal notice.
Sharing
Your data is hosted on our own server, with the host named in the legal notice, and we pass it to two providers. The emails we send you — address confirmation, password reset, subscription notices — go through Brevo, which receives your email address and the content of the message to deliver them. And to check a desktop purchase, we present the store concerned — Microsoft or Apple — with the proof its app handed us: it receives nothing from us but what it issued itself, neither your email address nor anything from your books. What those stores do with your purchase data is covered by their own privacy policy.