Effective date: [EFFECTIVE-DATE] · Written for India’s Digital Personal Data Protection Act, 2023 (DPDP)
Mythwright is a writing and worldbuilding tool operated by [ENTITY-LEGAL-NAME] ([ENTITY-FORM: e.g. a sole proprietorship of Vishal Kundar]) from [REGISTERED-BUSINESS-ADDRESS, India], and published at mythwrites.com. In this policy “Mythwright”, “we” and “us” mean that operator, and “you” means the person using the service.
The short version
Your manuscripts are yours. We store them so you can reach them from any device, and for nothing else. We do not sell your data, we do not read your writing for product or marketing purposes, we run no advertising or analytics trackers, and we never send your work to an AI model on our own initiative. AI features run from your browser with an API key you supply, so your text goes straight from your device to the provider you picked. Delete your account and we delete your projects, your profile and your login.
We do not collect your date of birth, government ID, location, contacts, or any biometric data. We set no advertising or analytics cookies. Your sign-in session is held in your browser’s local storage by our authentication library.
Project content is stored as structured data in a Postgres database hosted by Supabase in the [SUPABASE-PROJECT-REGION, e.g. ap-south-1, Mumbai] region, protected by row-level security so that only you and the collaborators you invited can read it. Images go into a private storage bucket named project-images and are served through short-lived signed links rather than public URLs. The application itself runs on Vercel. Depending on the region named above, your data may be stored or processed outside India. As at the effective date of this policy the Indian government has not restricted transfers to any country under the DPDP Act, and we will update this section if that changes.
This is the complete list of processors we use. We name them individually, rather than by role, so you can go and check them yourself.
We use no advertising networks, no analytics platforms, no session recording tools and no data brokers. We do not sell, rent or share your personal data or your writing with anyone for their own purposes.
AI assistance is bring-your-own-key. You paste an API key for OpenAI, Anthropic, or a compatible endpoint you run yourself. That key is held in your browser tab’s sessionStorage, is cleared when the tab closes, is stripped out of every save, sync and export, and is never sent to Mythwright’s servers.
When you run an AI action your browser calls the provider directly. The request does not pass through our servers, so we cannot see, store or log your prompts or the model’s replies. The request carries, from the project you have open:
Whole chapters are not uploaded, but an excerpt of every one of them is. If part of your work is confidential or under embargo, that is a good reason to leave the AI key blank. With no key set the assistant falls back to a local heuristic and nothing leaves your device at all.
On training. We never use your manuscripts, worlds or characters to train any AI model, and we never license them to anyone who does. What the provider you chose does with your text is governed by your contract with that provider, not by this policy. OpenAI and Anthropic both state that content submitted through their APIs is not used to train their models by default, but that is their promise to you rather than ours, and you should read their current terms before sending anything sensitive.
Under the DPDP Act we process your personal data on the consent you give when you create an account and accept our terms, and for the certain legitimate uses the Act permits, such as acting on a request you make to us or meeting a legal obligation. You can withdraw consent at any time by deleting your account. Withdrawal does not undo processing that already happened, and it does not erase records the law requires us to keep, such as payment and tax records.
Sections 11 to 14 of the DPDP Act give you the rights below. We honour them for every user, wherever you live.
The Act also places duties on you, including not raising false or frivolous complaints and not impersonating anyone else when you give us personal data.
In cloud mode, deleting your account immediately:
One honest exception. If you accepted an invitation to somebody else’s project, your name and email stay on that project’s collaborator list until its owner removes you or deletes the project, because that record is theirs. Ask us and we will remove it for you.
If any part of the deletion fails, we tell you so on the spot rather than reporting success. Should the subscription cancellation be the part that fails, your account is still deleted and we say so, and you should contact us or your bank so the mandate is revoked.
Deletion is immediate and cannot be undone, so export anything you want to keep first. In browser demo mode there was never a server copy, and deleting simply clears that browser’s storage.
We keep your account and project data for as long as your account exists, because that is the service. After deletion we retain nothing except records the law requires, principally payment and tax records for the period Indian tax law prescribes, and any correspondence needed to defend a legal claim. Database backups may hold residual copies for a short period before they roll off.
Everything travels over HTTPS. Database rows are protected by row-level security policies, so one account cannot read another’s projects. Uploaded images sit in a private bucket reached only through expiring signed links. AI keys never reach our servers. If a personal data breach happens we will tell you and the Data Protection Board of India, as Section 8 of the DPDP Act requires, without waiting to be asked.
Being straight with you: this is a small independent product, not a bank. We offer no security guarantee, and you should keep your own copies of anything you cannot afford to lose. The Export page is there for exactly that.
Mythwright is for adults. You must be 18 or older to create an account. We do not knowingly collect data from children, we do not track or profile children, and we run no advertising directed at anyone. If you believe a child has created an account, tell us and we will delete it.
Mythwright is operated from India and this policy is written to Indian law. If you are in the European Economic Area, the United Kingdom, California, or anywhere else with its own data protection statute, we extend the same rights described above to you: access, correction, deletion, portability, and the right to complain. We do not sell personal information as California law uses that term. Write to the contact below and we will handle your request under whichever regime gives you the stronger right.
If we change this policy in a way that materially affects you, we will email the address on your account and show a notice in the app at least 14 days before the change takes effect, so you have time to export your work and leave if you disagree. The effective date at the top always tells you which version is current.
Grievance officer under the DPDP Act: [GRIEVANCE-OFFICER-NAME], reachable at support@mythwright.app or by post at [REGISTERED-BUSINESS-ADDRESS, India]. Write there for any privacy question, to exercise any right above, or to complain. We acknowledge within 3 working days.
If we do not resolve your complaint to your satisfaction, you may take it to the Data Protection Board of India.