Privacy Policy / Datenschutzerklärung

We collect the following.

Account data

• email address,
• display name, if you set one,
• bio, if you set one,
• timezone.

Your writing

We store everything you create in the app: manuscripts, chapters, story-bible entries, book settings, and images you upload.

This data is never sold and never used to train AI models.

Device sessions

We store a per-browser identifier and a device label so the 3-device limit can be enforced and so you can end your own sign-ins.

Support and feature requests

When you write to us from inside the app we receive your message, your email address, and your display name if you have set one.

Waitlist

If you ask to be told when Galley launches we store your email address and the page you submitted it from.

Crash reports

When the app throws an error we receive the error, the line of our code it came from, your browser and operating system version, and the page you were on.

Crash reports do not contain your writing. Section 5 sets out how that is enforced.

Image fingerprints

Images you upload as covers, ornaments or scene-break art are hashed. The hash is compared against databases of known illegal images.

No person views the image as part of this check and no text is involved. Terms § 4 sets out why the check exists.

Session recordings

If you allowed analytics, PostHog records your session in the app: which control you clicked, in what order, how the page responded, and console messages from our own code.

All text is masked before the recording leaves your browser. Every text node is replaced with placeholder characters, so a recording shows the shape of the page and never its words. That covers your manuscript, chapter titles, story-bible entries, notes and anything typed into a field.

We use recordings to work out what happened when something is reported as broken, and to see where a screen is hard to use. They are not watched for any other purpose.

Nothing is recorded if you refused the banner or have not answered it.

Usage analytics

What we receive depends on your answer to the consent banner.

If you pressed Allow, we receive:

• a random identifier held in a first-party cookie,
• an approximate location derived from your IP address at page load, being country, region and city,
• your timezone,
• the site or search that referred you,
• pages viewed and clicks on our own controls,
• your account id, once you are signed in.

Your IP address is read to derive the location and is then discarded. It is not stored.

If you refused, or have not answered, we receive:

• a random identifier held only in the memory of the open page, which is forgotten when you leave or reload it,
• an approximate location, being country, region and city, which our host derives from your IP address,
• your timezone,
• the site or search that referred you,
• pages viewed and clicks on our own controls.

In that state nothing is read from or written to your device, and visits cannot be linked across pages or days. Your IP address is read to derive the location and is then discarded. It is not stored.

Data we do not collect

We do not buy data from brokers. We do not enrich your email address against any source. We run no advertising and no ad network.

We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR. The image check described above compares hashes and flags a match for a person to handle. It reaches no decision by itself.

Each activity in section 2 rests on one of the following.

• Account data and your writing. Art. 6 (1)(b), performance of our contract with you.
• Device sessions, crash reports, spam checks, rate limiting. Art. 6 (1)(f), our legitimate interest in keeping accounts secure and the service running.
• Image fingerprint checks. Art. 6 (1)(f), our legitimate interest in not hosting material that is unlawful to possess, and Art. 6 (1)(c), our obligation to act on illegal content under Art. 16 of the Digital Services Act. The check runs on uploaded images only and never on text.
• Support and feature requests. Art. 6 (1)(b) where your message concerns your account or the contract, and otherwise Art. 6 (1)(f), our legitimate interest in answering people who write to us and in improving the product.
• Waitlist email. Art. 6 (1)(a), your consent, given when you submit the form. Every email carries an unsubscribe link.
• Analytics and session recordings, where you pressed Allow. Art. 6 (1)(a) GDPR and § 25 (1) TDDDG, your consent. Withdrawing it stops both.
• Analytics, where you refused or did not answer. In that state nothing is read from or written to your device, so § 25 TDDDG does not apply. We rely on Art. 6 (1)(f) and our legitimate interest in knowing how many people visit, from roughly where, and how they find their way around the site. The identifier lasts one page, so no profile of you is built.
• The cookie recording your answer. § 25 (2) no. 2 TDDDG, strictly necessary. A refusal cannot be honoured if it is not recorded.

You can withdraw consent at any time. Withdrawal takes effect immediately and does not affect processing carried out before it. See section 8.

Providing your email address and your writing is not a statutory requirement. It is required in order to perform the contract. If you do not provide them, we cannot create an account for you or provide the service.

Each entry states what the service does, what data it receives, where it runs, and the capacity in which it acts.

Most act as our processors under Art. 28 GDPR, on that provider's standard data processing terms. Two do not, and are marked below: where your browser contacts a third party directly, that party receives your IP address as a controller in its own right and on its own legal basis.

Supabase

Database, authentication and file storage. Your manuscript is stored here.

Data received: account data, your writing, device sessions.

Location: AWS eu-central-1, Frankfurt, Germany.

Capacity: processor.

Supabase privacy and GDPR

Vercel

Hosting and delivery of the website and the app.

Data received: IP address, user agent, URL requested.

Location: serverless functions run in Frankfurt (fra1). Static files and the sign-in routing check are served from Vercel's global edge network.

Capacity: processor.

Vercel privacy and GDPR

Cloudflare

Turnstile, the spam check on the sign-in and waitlist forms.

Data received: IP address, user agent. Turnstile requires the IP address in order to distinguish a person from a script.

Location: US company, global edge network. See Transfers outside the EU below.

Capacity: processor.

Cloudflare GDPR compliance

Resend

Delivery of the support and feature-request messages you send from inside the app. Messages go to our own inbox. No automated copy or confirmation is sent to you, and nothing passes through Resend unless you write to us.

Data received: email address, display name, message content.

Location: EU region for our sending domain. The company is US-based.

Capacity: processor.

Resend GDPR compliance

MailerLite

The waitlist, its confirmation email, and the launch announcement.

Data received: email address.

Location: EU company, Lithuania.

Capacity: processor.

MailerLite GDPR compliance

PostHog

Usage analytics. A cookie only if you press Allow. Sections 2 and 8 set out what it receives under each answer.

Data received: pages viewed, clicks on our own controls, approximate location, timezone and referrer, and, where you consented, a random identifier in a cookie and your account id.

Location: EU cloud.

Capacity: processor.

PostHog GDPR compliance

Sentry

Crash reports.

Data received: the error, the line of our code, browser and operating system version, and the page. Not your account id, name or email address.

Location: EU region.

Capacity: processor.

Sentry data processing addendum

Instatus

Our status page and the status badge in this site's footer. It is hosted away from our own servers so that it remains available when our servers are not. Your browser loads the badge from Instatus on each page.

Data received: IP address, user agent. It sets no cookie and writes nothing to your device.

Location: global edge network.

Capacity: separate controller. Your browser requests the badge from Instatus directly, so Instatus receives your IP address on its own legal basis rather than on ours.

Instatus privacy policy

Payments

Checkout is not open. When it opens, a Merchant of Record will sell Galley to you as the seller of record and will process the payment. It will be named here before the first sale.

Capacity: separate controller. A Merchant of Record contracts with you in its own name, so it determines the purposes and means of processing your payment and invoicing data itself. It is not our processor for that data, and its own privacy policy applies to it.

We will not receive or store card details.

Transfers outside the EU

Your account data and your writing are stored in Frankfurt and remain in the EU.

Some processors above are US companies operating global networks. Technical data, being an IP address seen by a CDN or by the spam check, or the contents of a crash report, may be processed outside the EEA.

Where that happens the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses under Art. 46 (2)(c) GDPR.

To obtain a copy of the Standard Contractual Clauses in place for a given provider, email [email protected].

Crash-reporting tools collect a great deal by default: the body of the failed request, the variables in memory at the time, database query contents, and, where session replay is enabled, a recording of the page. In a writing app each of those would contain your manuscript.

All of them are disabled. Specifically:

• request bodies are not collected,
• stack-frame variables are not collected,
• database query parameters, inline values and returned rows are not collected. The sanitised statement text and table names are, which is what identifies a broken query without exposing its data,
• session replay is switched off in the crash reporter,
• cookies and authentication headers are stripped before a report is sent.

Automated tests assert each of these on every change.

Analytics receives pages, clicks on our own controls, and the fields listed in section 2. It does not receive chapter text, character names or book titles under either answer to the banner.

If you refused or have not answered, nothing is written to your device and no identify call is made in your browser, so visits are not joined across days. If you pressed Allow, that joining is what you consented to.

Once you are signed in, analytics events carry your account id. They do not carry your email address or your name.

A small number of actions, such as deriving a book or completing an export, are counted on our own server against your account rather than in your browser. That happens under either answer, because it writes nothing to your device and is therefore outside § 25 TDDDG. Those records name the action and never its contents.

Crash reports are not linked to your account.

Session replay in analytics is switched on and masked, which section 2 sets out. The masking is configured in the app rather than requested of PostHog: every text node is replaced before the recording is sent. It is set as mask-everything rather than a list of selectors to mask, because a list fails open, and the first screen that renders prose without being on the list would leak the book.

Under the GDPR you have the right to:

• access your data, Art. 15,
• have it corrected, Art. 16,
• have it erased, Art. 17,
• restrict its processing, Art. 18,
• receive it in a portable format, Art. 20,
• object to processing based on legitimate interest, Art. 21,
• withdraw consent at any time, Art. 7 (3).

Two of these are controls in the app rather than requests to us. You can export everything you have written at any time, in open formats, and you can delete any of it yourself.

For anything else, email [email protected]. We respond within one month, as required by Art. 12 (3) GDPR.

Your right to object, Art. 21 GDPR. Where we process your data on the basis of our legitimate interest, which under section 3 means device sessions, crash reports, spam checks, rate limiting, the image fingerprint check and non-consented analytics, you have the right to object to that processing at any time on grounds relating to your particular situation. If you object we will stop unless we can demonstrate compelling legitimate grounds that override your interests. Email [email protected].

Art. 77 GDPR gives you the right to lodge a complaint with a supervisory authority. The authority competent for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, datenschutz-berlin.de. A complaint may also be lodged with the supervisory authority of your habitual residence or place of work.

Everything below except analytics is strictly necessary and is set under either answer to the banner.

• Sign-in. A session cookie, so you stay signed in.
• Preferences. Your theme and device id, stored on your device.
• Offline writing. A copy of your open book's chapters, and of the app's own pages once installed, held in your browser's storage. It stays on your device, is readable only by the app, leaves only to sync to your own account, and is removed when you clear the browser's site data.
• Sandbox countdown. A readable cookie holding the demo's expiry time. It is not a credential.
• Turnstile. Cloudflare's spam check may set a short-lived token to confirm you are a person. It sets no tracking cookie and is not used to profile you or serve advertising.
• Status badge. The badge in the footer is loaded from Instatus. It sets no cookie and writes nothing to your device.
• Analytics. One first-party cookie holding a random identifier, set only if you press Allow. It lasts six months.
• Your answer to the banner. A cookie recording Allow or No thanks, for six months, on usegalley.com and its subdomains, so you are asked once rather than three times. Strictly necessary under § 25 (2) no. 2 TDDDG.

There are no advertising cookies, no third-party trackers and no cross-site tracking.

Changing your answer

Ask me again clears your answer and brings the banner back, here and on the app and the sandbox.

Choosing No thanks deletes the analytics cookie immediately rather than at your next page load. Clearing your browser's cookies has the same effect.

Galley is operated from Germany and this policy is written to the GDPR. Some US state privacy statutes can reach a business outside the United States that meets their thresholds.

We do not meet them. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to a business with annual gross revenue above USD 26,625,000, or that buys, sells or shares the personal information of 100,000 or more California residents or households in a year, or that derives 50% or more of its annual revenue from selling or sharing personal information. Otlo UG meets none of the three. The thresholds in the Virginia, Colorado, Connecticut, Utah, Texas and Oregon statutes are comparable and we meet none of those either.

The following are true whether or not any of those statutes applies to us:

• we do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA,
• we do not process personal information for targeted advertising, and we run no advertising,
• we do not knowingly collect or sell the personal information of anyone under 16,
• we do not use personal information for automated decision-making or profiling,
• the access, correction, deletion and portability rights in section 7 are available to anyone who asks, wherever they live. We do not limit them to people in the EU.

We do not currently detect the Global Privacy Control signal. Analytics is off unless you press Allow, so there is nothing to opt out of by default.