What leaves your device, and what never does.

Last updated: 29 September 2026

The short version: nothing you write is ever measured, and nothing about you is sold. The app has no tracking pixels, no advertising, no cookies for any of it, and no profile of you anywhere. We do keep an anonymous count of which parts of the app get used — how many exports happen, how many documents are started — and you can switch that off in Settings. It never carries a title, a folder name or a sentence. Your writing is saved to your own device first and synced to our server only so you can reach it from another one.

The one exception is our website, minimalwriter.app, and it asks first: we advertise on Google, and if you allow it, Google sets a cookie there so we can tell whether an ad brought you. Say no and Google's script never loads. See section 8.

1. Who is responsible

The controller of your personal data is Granularitylabs, Carstenvegen 6B, 6017 Ålesund, Norway. Contact: support@minimalwriter.app.

2. What we hold, and why

Your email address	So you can sign in and so we can reach you about your account or a change to the service. Legal basis: performance of our contract with you.
Your documents and folders	The text you write, its titles, its structure, its version history and its language. Held so it can sync between your devices. A journal you have encrypted is held as a blob we cannot read — see section 6. Legal basis: performance of our contract.
Which document you have open	While the app is open it tells your own other devices which document is on screen, and when that window last asked to be the one writing in it, so they can show you where you are working and hand the writing between them. It is the document's identifier and two timestamps — no title and no text — it is passed between your devices rather than stored, and it is gone the moment you close the tab. Legal basis: performance of our contract.
Your personal dictionary	Words you add to the spellchecker, so they follow you to another machine. Legal basis: performance of our contract.
Subscription state	Your plan, its status and its renewal date, sent to us by Paddle. We never see or store your card details — those stay with Paddle. Legal basis: performance of our contract, and our legal obligation to keep billing records.
Crash reports	Only when the app breaks, and only from the deployed app. Legal basis: our legitimate interest in a writing tool that does not lose your work. See section 4.
Anonymous usage counts	That an export happened, that a document was started — never which one, and never by whom. No account is attached and no identifier follows you between visits. Legal basis: our legitimate interest in knowing which parts of the app are worth building on. You can switch it off. See section 4.

We do not ask for your name, your address, your phone number or your date of birth, and we do not build a profile of you. If you subscribe, the Paddle checkout collects the name and billing address that tax law requires — that goes to Paddle, not to us, and we never receive it.

We use your email address to confirm the account, to send one welcome message after you confirm it, to send a password reset link or confirm a change of address when you ask for one, and — if we ever need to — to reach you about the account itself, such as a payment that failed or something breaking. There is no mailing list, no newsletter and nothing to unsubscribe from, because we never signed you up to anything.

3. What stays on your device

Minimal Writer is local-first. Every document is written to your browser's own database (IndexedDB) before it is sent anywhere, and the app keeps working with no connection at all. A handful of preferences — your theme, your typeface, your writing mode, which document you had open — live in local storage on that device only and are never uploaded.

Spellchecking runs entirely on your device. We ship our own Hunspell checker in a background worker and serve the dictionaries from our own domain, rather than using the browser's built-in checker or a third-party CDN. Nothing you type is sent anywhere to be checked, and no one else learns which languages you write in.

4. Crash reports and usage statistics

When the app crashes we send a report to Sentry so it can be fixed. What goes out is deliberately narrow, and enforced in code rather than promised here:

the error type, message and stack trace, and which browser it happened in;
the page path — with the query string and the URL fragment stripped off;
no user id, no email, no session replay, no performance tracing;
no console output and no record of what you clicked or typed — those breadcrumbs are switched off at the source rather than filtered afterwards.

The one thing we cannot promise mechanically: an error thrown deep inside a library could quote the text it failed on. We treat any such report as a bug to fix at the source.

Separately, we count what the app is used for, through Umami — analytics that sets no cookie, stores no identifier that follows you between visits, and builds no profile. What is sent is one page view and a short, fixed list of named events: a document was created, a file was exported, the writing mode was changed, a plan was viewed. Some carry a value the app itself chose, such as pdf or sentence.

Nothing you wrote is ever part of it — not a document title, not a folder name, not a word of the text, not the id of any document. That is enforced in code: a value long enough to be a sentence is discarded rather than shortened. It is also switched off entirely, without you asking, if your browser sends Do Not Track or Global Privacy Control.

You can turn it off yourself at any time in Settings → About → Usage statistics. It is a per-device setting and takes effect immediately.

5. Who processes data for us

Supabase	Database, authentication and server functions. Hosted in the EU (Ireland, `eu-west-1`).
Resend	Sends all our account email — confirmation, welcome, password reset and address changes. Resend sees the address the message goes to and the message itself; our account is on Resend's EU region, and open and click tracking are switched off, so nothing reports back whether or when you read one. Operated by Resend, Inc. — see Resend's privacy notice.
Cloudflare	Hosting and content delivery for the app itself.
Paddle	Payments, invoicing and tax, as Merchant of Record. Paddle is a controller in its own right for the payment — see Paddle's privacy notice. Paddle's script is loaded on the sign-in screen and on the plan cards so the prices shown are the ones your own country pays; loading it lets Paddle see your IP address, which is how it works out that country.
Sentry	Crash reports only, as described above. Sent to Sentry's EU region (Germany).
Umami	Anonymous usage counts only, as described above, on Umami Cloud. Umami never receives an account, an email or anything you wrote. The statistics are not sold, and they are not used for anyone else's purposes. Operated by Umami Software, Inc. — see Umami's privacy notice and the suppliers it uses in turn.
Google	Two things, both your choice. In the app: only if you choose "Sign in with Google". On our website: Google Ads conversion measurement, only if you allow it in the cookie banner — see section 8. Google is not involved in the app otherwise, and never sees anything you write.

Some of these process data outside the EEA. Where they do, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We do not sell personal data, and we never have.

6. How your writing is stored

Everything between your browser and our server travels over TLS, and Supabase encrypts the disks it sits on. Inside the database every row belongs to one account and is fenced off by row-level security, so no other user of Minimal Writer can read your documents — enforced by the database itself rather than by the app asking politely.

For ordinary documents that is not end-to-end encryption. An ordinary document is not end-to-end encrypted: we hold the keys, which means we have the technical ability to read the text stored on our server. Any service that syncs your work without asking you to hold a key of your own is in the same position — but we would rather say it plainly than let the care we take everywhere else imply something we have not built.

Journals are the exception, and they are end-to-end encrypted. When you turn encryption on, your browser makes a key and never sends it to us. From then on a journal's text is encrypted before it leaves your device and decrypted only after it arrives back, so what our database holds is a blob — to a database dump, to our admin dashboard, and to us. There is no copy of your key on our server, which is why we cannot read a journal and cannot recover one either: if you lose both your passkey and your recovery code, that writing is gone, including for us. The app says so before it switches anything on.

What encryption does not hide is the shape around the writing: the name you gave the journal, which day it was last saved, roughly how long it is, and that it exists at all. Those are what make syncing work, and they stay readable to us. Turning encryption on also seals the journals you had already written before you turned it on, and their version history with them — not only what you write afterwards.

It protects the journey, not the desk it left from. This is encryption between your device and us, and on your own device the journal is stored the way every other document is: as readable text in your browser’s database, so the app can search it, count it and open it instantly offline. While it is unlocked, the key sits in your browser’s session storage and is discarded when the browser closes. So locking a journal puts it beyond us and beyond anyone who reaches our database — it does not put it beyond someone who has your unlocked computer and your browser profile. If that is the risk you are guarding against, use your operating system’s disk encryption and a locked screen; those are the tools for it, and they work for everything else on the machine too.

What we do with that ability is nothing. We do not read your documents, we do not train anything on them, and no export, dashboard or internal tool anywhere puts your text in front of us. Two ordinary exceptions: if you ask us for help with a specific document and there is no other way to solve it, we will ask your permission first; and if the law compels us, we will comply, and tell you unless we are forbidden to. We, here, is one person in Ålesund — there are no staff, and nobody else has access.

7. How long we keep it

Your documents stay until you delete them or delete your account. Version-history snapshots thin out over time automatically: recent ones are kept in full, older ones are reduced to one a day, and a document keeps a capped number in total.

The exception is an account that has been abandoned: one with no subscription that has not been signed in to for twelve months may be deleted, along with everything in it. We email you at least 30 days beforehand, with a link that exports your writing, and signing in restarts the twelve months. Keeping a lapsed account's documents on our servers forever is not something we have a reason for, and holding personal data without one is exactly what we are meant not to do. The rule in full is section 4 of the Terms of Service.

Deleting your account removes your documents, folders, snapshots, dictionary and profile from our servers. Billing records that we are legally required to keep stay with Paddle for as long as tax law requires.

8. Cookies

The app sets no advertising cookies and no analytics cookies, so there is no consent banner — the usage counts in section 4 are deliberately cookieless for exactly this reason. Signing in stores an authentication token in your browser so you stay signed in, and your settings are kept in local storage on that device; both are strictly necessary to provide the service you asked for. Paddle's script, which loads wherever a price is shown, and the Paddle checkout, when you open it, set their own cookies for the payment; those are covered by Paddle's notice.

Our website

The website at minimalwriter.app — not the app — can use the Google tag for Google Ads, and only after you press Allow in its cookie banner. Until then Google's script is not loaded at all, so Google receives nothing from the site: no page view, no IP address. If your browser sends Global Privacy Control or Do Not Track, you are not asked and the answer is no.

If you allow it, Google sets its own advertising cookies on the website (_gcl_au, and _gcl_aw if you arrived by clicking one of our ads), which keep for up to 90 days. Google then learns which pages you visited, your IP address and browser, and whether you went on to the app, so we can see which ads bring writers rather than just clicks. It is not used to put you on a remarketing list or to personalise the ads you see — that setting is off. Google receives this as a controller in its own right under its advertising terms; see Google's privacy policy. Google may process it in the United States, relying on the EU–US Data Privacy Framework. Legal basis: your consent.

Your answer is remembered in your browser's local storage on that device, so the banner does not ask on every page. You can change it at any time under Cookie settings at the bottom of any page on the website; saying no removes Google's cookies there. Separately, the website counts anonymous page views with Umami, exactly as described in section 4 — no cookie, and off under Do Not Track or Global Privacy Control.

9. Your rights

If you are in the EEA or the UK you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interest, or ask for it in a portable form. Two of those you can do yourself, right now, without asking:

Portability — export any document to Markdown from the app. It is free, open, and never behind a plan.
Erasure — delete your account from Account settings. It is immediate and permanent.

For anything else, email support@minimalwriter.app. You can also complain to your data protection authority — in Norway, Datatilsynet.

If you live in the United States, including California: we do not sell your personal information, and nothing in the app shares it for cross-context behavioural advertising. The only data an advertising company receives is the Google Ads measurement on our website described in section 8, which you have to allow first, which is off if your browser sends Global Privacy Control, and which is not used for personalised advertising.

10. Changes

If this policy changes in a way that affects you, we will say so by email or in the app before it takes effect. The date at the top always says when it was last revised.