Privacy Policy

• What we process. If you only read, we and our hosting provider see technical logs. If you create an account, we also keep your email, username, a hashed password, and the writing, invitations, votes, reports, and appeals attached to your account.
• Age. Nodusy is for people 14 and older. We ask for a date of birth to confirm your age and do not keep the date afterward.
• AI covers. To generate a work’s cover, we send only the work’s title, genre, and opening sentence (plus a fixed style prompt) to OpenAI. We never send your email, account ID, drafts, or the later sentences of a work.
• Sensitive information. We do not seek racial, health, or similar special-category data. Do not put it on a public page.
• Selling / training. We do not sell your personal information, and we do not use your writing to train AI models.
• Analytics. Google Analytics runs only if you turn it on (“Count pages”). It never receives your sentences, drafts, email, or password.
• When you leave. We delete your account and personal information. Sentences on shared pages remain as “Anonymous” so the collaborative work still reads; Just-me pages are deleted entirely.
• Your rights. Close your account from your account page, or write to contact@nodusy.com for a copy, correction, or deletion. Extra rights may apply in Korea, the EU/UK, California, and other US states.

1. What information do we collect?
2. How do we process your information?
3. What legal bases do we rely on?
4. When and with whom do we share information?
5. AI features and your data
6. Social logins
7. International transfers
8. How long do we keep your information?
9. How do we keep your information safe?
10. Information from minors
11. Your privacy rights
12. Controls for Do-Not-Track
13. US state privacy rights
14. Updates to this notice
15. Contact us
16. Review, update, or delete your data

Personal information you provide. We collect what you give us when you register, write, invite, report, appeal, or contact us. Depending on how you use the Service, this may include:

• email address and password (the password is stored hashed);
• country/region — used to determine applicable law and show the right regional notices and language. At sign-up a default is pre-selected from your IP address (country level only, not precise location) and you can change it;
• username and, if you add one, an avatar;
• date of birth — used only to confirm you are 14 or older. We do not keep the date after the check; we retain only a record that your age was confirmed;
• sentences, drafts, titles, chapters, and summaries you write;
• invitations you send or accept;
• reports, appeals, and the notes attached to them.

Sensitive information. We do not process special-category information as a product feature. Writing on a public page is public — do not put special-category data there.

Payment data. We do not take payments, so we do not collect payment-card data.

Information collected automatically. When you visit, we and our hosting provider automatically collect device and usage information that does not by itself identify you, including your IP address, browser type, dates and times, the pages you open, and error logs. We infer only an approximate location from your IP address; we do not request GPS.

Google Analytics (opt-in). If you turn analytics on, Google Analytics (GA4, measurement ID G-WPCP12HEFF) records which pages are opened. See Section 4.

Google API. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. (Google sign-in is currently turned off — see Section 6.)

We do not buy personal information from data brokers or marketing partners, and we do not run advertising pixels.

In short: to run Nodusy, keep it safe, and follow the law — not to sell lists of writers.

• to create and maintain your account and sign you in;
• to show a page, give you a turn, hold your in-turn draft, and pass the Booth;
• to send and accept invitations;
• to generate a work’s cover image (see Section 5);
• to hide reported sentences, pause a page, and review appeals;
• to confirm you are 14 or older;
• to answer you when you contact us and to send service notices about the Service or these policies (not marketing blasts);
• to keep the Service safe — fraud, abuse, spam, and illegal content;
• to understand which pages are opened, if you turn on Google Analytics;
• to comply with the law, including reports involving the sexual exploitation of a minor.

If you are in the EU or UK, the GDPR / UK GDPR requires a legal basis. We may rely on: contract (running your account, the Booth, invitations, and showing the page); legitimate interests (keeping the Service running, preventing abuse, and understanding usage to improve it, where those interests are not overridden by your rights); consent (for example Google Analytics — you can withdraw it, which does not undo processing already done); legal obligation (for example cooperating with law enforcement where required); and vital interests (protecting someone’s safety, including a child).

If you are in Korea, we process under the Personal Information Protection Act; see the Korean notice for details.

If you are in Canada, we process with your express or implied consent where that is the rule, and without consent only where Canadian law allows.

In short: processors that run the product, and the authorities if we must.

We share personal information with processors that need it to do work for us. They should use it only for that work.

We may also share information: where the law requires it, or to protect rights, safety, or the Service; in a merger, sale, or similar business transfer, under this notice; and with you, when you ask for a copy of your data.

Other writers can see your public username and the sentences you post. That is the product, not a sale. We have not sold personal information, and we do not share it for cross-context behavioral advertising.

A work’s cover image is generated automatically by our server (not chosen by writers). When a signed-in user opens a work that needs a cover, we send to OpenAI: the work title, genre, and opening sentence, plus a fixed marker/brush-pen style prompt. The model gpt-image-1 produces a still image; sora-2 produces a short looping video from that still. The resulting files are stored in Supabase Storage, and the address is saved to the work.

We do not send your email, account ID, drafts, or the later sentences of a work to OpenAI. If our AI keys are absent, this step is skipped. We do not use your writing to train AI models.

Google sign-in exists in our code but is currently turned off and not offered in the interface, so no data currently flows to Google through sign-in. If we enable it in the future, we would receive the email, name, and avatar that Google provides for that sign-in, use them only as this notice describes, and update this notice. We do not control Google’s own use of your information; read Google’s privacy policy and your Google settings. (This is separate from Google Analytics in Section 4, which runs only if you opt in.)

We operate from the Republic of Korea. Our processors — including Supabase, Vercel, OpenAI, and Resend — may transfer, store, and process information in the United States and other countries, which may not have the same data-protection laws as yours. If you are in the EEA, UK, or Switzerland, using the Service means you understand this transfer. We rely on our processors’ published transfer tools (such as Standard Contractual Clauses they offer their customers) where those apply; we do not claim a separate SCC between you and us. Korean users: see the 국외 이전 section of the Korean notice.

In short: until you close your account — then we delete the person and anonymize the shared sentences.

We keep account information while you have an account, unless a longer period is required or allowed by law (for example a safety investigation, or access logs kept for a limited period for security and legal compliance).

When you close your account, we delete your email, username, and sign-in. Sentences you posted on Together and Invited-people pages remain, attributed to “Anonymous,” because others wrote around them and the work would break if those lines vanished; the license in the Terms survives that closing. Just-me pages are deleted entirely (root, sentences, and forks). Reports and safety records may be kept longer where needed. Backups may hold a copy until they rotate out; we isolate that from active use until it is gone. Your date of birth is used only for the age check and is not kept afterward.

One record of a closed account is kept: its internal account number, the username it held, the country or region, and the dates it opened and closed, together with a list of which sentences it wrote. We keep this so that a sentence written years ago can still be traced to the right person if there is a legal claim or a safety investigation, and so a username is never handed to a second person and confused with the first. It contains no email, no password, and no date of birth, and it is not visible to anyone using the Service — the public byline is still “Anonymous.” Because a username is never reissued, the name and account number are kept for as long as Nodusy runs.

We use reasonable technical and organizational measures: access controls, hashed passwords, database access rules, and processor security. No internet transmission or storage can be guaranteed perfectly secure, so you use the Service at your own risk and should prefer a secure network.

Nodusy is not for anyone under 14. We ask for a date of birth when you join and block registration for anyone under 14; we do not operate a legal-guardian consent process. If we learn we hold an account for someone too young, we will close it and delete the personal data we can, subject to the anonymization of shared sentences described in Section 8. If you believe a child under 14 has given us data, write to contact@nodusy.com. Sexual content involving anyone under 18 is never allowed (see the Guidelines).

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal information, to object, to withdraw consent, and not to be subject solely to automated decisions with legal or similarly significant effects. We do not make that kind of automated decision about you. We will handle requests as the applicable law requires.

In the EEA or UK you may complain to your data-protection authority; in Switzerland, to the FDPIC; in Korea, you have rights under the Personal Information Protection Act. Account: close your account from your account page (this deletes personal account data and anonymizes shared sentences), or write to contact@nodusy.com.

Cookies. We use strictly necessary cookies to keep you signed in and to maintain your session; these are always on because the Service does not work without them. We set analytics cookies (such as Google’s _ga) only after you opt in with “Count pages,” and you can turn them off again from your account page. We do not use advertising cookies. Google Fonts are downloaded at build time and served by us, so visitors’ browsing does not go to Google through fonts.

Do-Not-Track. Browsers may send a Do-Not-Track (DNT) signal. Because there is no common standard for honoring it, we do not respond to DNT; California law requires us to say so. Turning analytics off does not restrict reading, writing, signing in, or account management.

In short: California and several other US states give you rights to know, access, correct, and delete your data, and not to be discriminated against for using them. We do not sell your data.

If you live in a US state with a consumer-privacy law (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia), you may have the rights below, as that law allows.

Categories collected (past twelve months, depending on use):

We disclose identifiers, limited account data, and log data to the processors in Section 4 for a business purpose (running the Service). We have not sold personal information or shared it for targeted advertising in the past twelve months.

Your rights (where they apply): to know and access; to correct; to delete (closing your account; shared sentences remain “Anonymous”); to obtain a copy of what you provided; not to be discriminated against for exercising these rights; and to opt out of sale, targeted advertising, or certain profiling — none of which we do. To exercise them, email contact@nodusy.com; we will verify you are the person the data is about. An authorized agent must show they are allowed to act for you. If we refuse, some state laws let you appeal by writing to the same address; if the appeal is denied you may complain to your state attorney general.

California “Shine the Light” (Civil Code 1798.83): we do not disclose personal information to third parties for their own direct marketing.

We will update this notice when the law or the product requires it. The “Last updated” date is the date that counts. If a change is significant, we will try to say so in the product or by email.

Personal Information Protection Officer / Representative: EunJin Yoo
Email: contact@nodusy.com

Close your account from your account page, or write to contact@nodusy.com to ask for a copy, a correction, or deletion. Deleting your account anonymizes your shared sentences as described in Section 8. The law may limit what we can do.