Data controller
LEBOUCHER Antoine — 12 rue Gatien Arnoult, 31000 Toulouse, France.
Privacy contact : antoine.leboucher@icloud.com.
Data we use
- Account: email, user identifier, authentication information, optional display name, free/premium status, last activity and onboarding status. Google sign-in transmits authorised profile information through Supabase.
- Projects and chapters: titles, summaries, goals, deadlines, covers, chapter order and completion, creation and archive dates.
- Sessions: word counts, duration, date, timezone, feeling and the recorded daily target.
- Technical data: connection and security information, including IP addresses and logs processed by hosting providers.
- Writer+ subscription: Stripe billing identifiers, plan, period and payment status. Card details are entered with Stripe and are not stored by MissQuill.
- Gifted Writer+ access: recipient identifier, optional expiry and controlled reason. A private audit records the actor, recipient, action and change date.
- Bug reports: submitted descriptions and steps, expected and actual outcome, status, page path without a project identifier, language and app version. Browser information is included only if you choose it. The form does not automatically collect manuscripts, screenshots or IP addresses.
- On your device: language, theme and sidebar-collapse preferences, and timer draft. The current service does not request full manuscripts.
Purposes and legal bases
Email and fields marked as required are needed for the corresponding functions. Summaries and covers are optional. Advertising consent is not required to create an account. Writing projections do not produce legal or similarly significant decisions.
- Bug reports
- Investigating the reported problem and providing requested follow-up to maintain the service.
- Account and authentication
- Performance of the requested service (GDPR Article 6(1)(b)).
- Projects, sessions and writing statistics
- Performance of the requested service. Statistics are calculated from your own sessions.
- Subscription and billing
- Performance of the requested subscription and compliance with applicable invoicing obligations.
- Security and abuse prevention
- Legitimate interest in protecting the service and accounts (Article 6(1)(f)).
- Internal service statistics
- Aggregate registration, activity and feature-adoption measures, without reading project content or adding navigation trackers. The legitimate-interest balancing assessment must be documented before production activation.
- Rights requests and legal obligations
- Compliance with applicable legal duties (Article 6(1)(c)).
Recipients and transfers
The publisher and technical providers access data according to their roles: Vercel for the application, Supabase for authentication, database and files. Stripe processes payments and subscription management if you choose Writer+. Google is involved if you choose Google sign-in, under its own terms. The current version includes no advertising or external audience-measurement tool.
Processing regions : To be completed before publication.
Transfers and applicable safeguards : To be completed before publication.
Retention and deletion
Bug reports are retained for up to six months and removed with the account. Their author can view and export them as JSON; only administration can view other reports and change their status. Purging depends on the daily maintenance job operating correctly.
Administrative access-change logs are kept for six months, then removed by daily maintenance. Account references are removed when the account is deleted. Gift access remains associated with the account while the entitlement needs to be managed.
The intended retention period is 1 year after last activity. Inactive-account deletion is implemented but production activation must be verified before public launch.
You can delete a project and its sessions in project settings. Archiving retains data and is not deletion. Account deletion is available in account settings after identity confirmation, or by contacting the publisher above. Erasure requests are handled without undue delay, subject to legal exceptions.
Technical logs : To be completed before publication.
Backups and residual copies : To be completed before publication.
Data on your device remains until cleared or replaced. A timer draft is removed when saved or discarded; the theme preference remains until changed or browser storage is cleared.
Your rights
Subject to GDPR conditions, you can request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. If processing later relies on consent, you can withdraw it without affecting earlier lawful processing.
Send your request to the contact above. Requests are normally answered within one month; any permitted extension will be explained. Proportionate identity verification may be needed. French law also allows instructions about personal data after death.
You can complain to the CNIL or the supervisory authority in your country, without prejudice to other remedies.
Data protection
Application checks and database security rules restrict projects and sessions to their owner. Covers are private and accessed through temporary links. Supabase manages authentication. No system can guarantee absolute security.