The short version

  • Your sessions, word counts, notes and any writing you do in the app are stored on your device, in your browser.
  • Nothing syncs to us unless you choose to sign in. Signing in is optional and the app works fully without it.
  • We do not run analytics, advertising or tracking cookies. We do not sell or share your data with anyone for their own purposes.
  • The app has no microphone or camera access, and makes no recordings of any kind.
  • You can download everything we hold, or erase it, from the app's Settings screen.

Who we are

Writing Ladder is a product of Tinkerbox LLC, a New Mexico limited liability company, which is the controller of the personal data described here. Post reaches us at 1209 Mountain Road Pl NE, Albuquerque, NM 87110, United States.

For anything on this page, including a request to see or delete your data, use the contact form.

What stays on your device

The app stores the following in your browser's local database (IndexedDB). It is not transmitted anywhere unless you sign in for sync.

  • Your current level and how you have moved through the ladder
  • Session and sprint history: dates, durations, word counts and words per minute
  • Break notes you type
  • Any text you write in the app's writing pad
  • Your settings, such as whether streaks and celebrations show

Clearing your browser's site data, or using "Erase all data" in Settings, removes all of it. If you have not signed in, we hold no copy and cannot recover it for you.

What we hold if you sign in

Signing in is optional and exists only so your history follows you between devices. If you use it, we process:

  • Your email address, used to send the sign-in link and to identify your account. We do not use it for marketing.
  • A copy of your app data as listed above, so it can be restored on your other devices.

Accounts and sync are provided by Supabase, which stores this data on our behalf as a processor. A sign-in token is kept in your browser's local storage so you are not asked to sign in on every visit.

Microphone and camera

The app never asks for either, and there is nothing in it that records audio or video.

If you contact us

The contact form sends what you write to us as an email, through Resend, an email delivery service acting as our processor. That means your email address, your name if you give one, and the contents of your message pass through them and then sit in our inbox.

We use it only to answer you, and we keep the correspondence no longer than we need to. We never add you to a mailing list from it.

Server logs

The site is hosted on Vercel. Like any web host, its servers keep short-term technical logs, which include IP addresses, browser user agent and request timestamps. We use these only to keep the service running and to stop abuse of the contact form. We do not use them to build a profile of you.

Fonts

The site loads the Inter typeface from rsms.me, a third-party host. Loading a file from another domain necessarily reveals your IP address to that host. No other third-party resources are loaded.

Cookies

We set no cookies for analytics, advertising or tracking, so there is no consent banner to dismiss. If you sign in, a sign-in token is stored in your browser's local storage. It is strictly necessary for keeping you signed in and is removed when you sign out.

Why we are allowed to process this

If you are in the UK or the European Economic Area, our legal bases under the GDPR are:

  • Contract, for running your account and syncing your data, because that is the service you asked for.
  • Legitimate interests, for keeping the service secure and preventing abuse, balanced against your rights.

How long it is kept

  • On your device: until you erase it, or clear your browser data.
  • Synced data: until you delete your account, at which point it is removed from our database.
  • Server logs: kept for a short period by our host under its own retention schedule.
  • Messages you send us: kept while we deal with them and for a reasonable period afterwards, then deleted.

Your rights

Depending on where you live you may have the right to see a copy of your data, correct it, delete it, restrict or object to how we use it, and to receive it in a portable form. We honour these requests wherever you are, not only where the law compels it.

Two of them you can exercise yourself, immediately, in Settings:

  • Download my data gives you everything we hold about you as a JSON file.
  • Erase all data wipes your history from the device.

To delete your account and the synced copy along with it, sign in and use Delete my account in Settings. It takes effect immediately and needs nothing from us. If that fails for any reason, the contact form reaches us and we will remove it by hand within 30 days.

If you are in the UK or EEA and think we have handled your data badly, you may complain to your national data protection authority. In the UK that is the Information Commissioner's Office.

If you are in California

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either. You have the right to know what we collect, to delete it and to not be treated differently for asking, all of which the sections above cover.

Children

Writing Ladder is not intended for children under 13, and we do not knowingly collect their data. In the EEA and UK, where the minimum age for consent to online services is higher, the applicable local age applies instead. If you believe a child has given us their data, contact us and we will delete it.

International transfers

We are based in the United States, and our hosting and email providers may process data there or in other countries. Where data is transferred out of the UK or EEA, we rely on our providers' standard contractual clauses to protect it.

Changes

If this policy changes in a way that affects you, we will update the date at the top and, for significant changes, tell you in the app before they take effect.