Privacy Policy

Your manuscript is used to generate your pack and then deleted. It is not stored after delivery, not backed up, not used for training, and not shown as an example anywhere.

One exception, and it is yours to make. At upload you can tick a box asking us to keep the manuscript text for 15 days so we can investigate feedback you send us. That box is unticked by default. If you leave it alone, nothing about the paragraph above changes. If you tick it, the text is stored in our database, used only to look into problems you report, and deleted automatically after 15 days by a scheduled job.

We never publish your manuscript, your pack, or your name. Nothing you upload is posted to this site, to social media, or anywhere else. Your pack is reachable only through a private link containing a token unique to your job, and those pages are excluded from search engines.

The teaser asks about your book — genre, protagonist, goal, conflict, stakes. Those answers are used to write your logline and tagline and are then discarded, unless you tick the box asking us to keep them. That box is separate from the email opt-in, and both are optional: you get the teaser either way.

If you do tick it, we hold those answers for 90 days for one purpose — so that if you later buy a pack for the same book, we can show them back to you and let you confirm or correct them. Your own description of your book is the most accurate thing we can have. They are deleted automatically after that, and the writing sample is never stored at all.

Generation runs through an AI provider under enforced Zero Data Retention: the provider does not keep your text after answering the request. We set this per request, server-side. If no eligible provider can serve a call, the job fails rather than fall back to one that would keep your data.

• Your generated pack — kept so you can re-download it from the link we email you, then deleted. The expiry date is stated in that email and on the page.
• Job records — job id, timestamps, which pack you bought, your manuscript's word count and title, your email address, and a record that you confirmed you hold the rights to the manuscript, together with the version of these terms you agreed to. Kept for accounting, support and legal purposes.
• A reading record of your book — to build your pack we read the manuscript section by section and record what happens, who appears, and what the book establishes. That record is kept alongside your pack, for the same period, so that if you buy the story bible add-on we can write it without needing your manuscript again. It is a summary, not your text.
• Teaser answers — only if you asked us to keep them, and only for 90 days.
• Waitlist details — your email address, and your name, writing stage and genre if you chose to give them. Kept until we launch and you have been told, or until you ask us to remove you.
• Feedback you send us — the message and rating, linked to the job it was about.
• Your manuscript text — only if you opted in, and only for 15 days.

Where the law requires us to keep something longer — tax and accounting records, for instance — we keep that record and nothing more.

Manuscript text, prompts and generated packs are never written to our application logs. Errors are logged with a message and a job id only. Where an email address appears at all, we log the domain rather than the address.

We use a small number of companies to run the service. Each one gets only what it needs to do its job, and none of them are permitted to use your data for their own purposes:

• OpenRouter — routes generation to an AI provider under the Zero Data Retention terms above. This is the only third party that sees your manuscript, and only for the duration of the request.
• Rainforest API — receives comparable book titles and authors so we can check they exist. It never receives your manuscript.
• Resend — receives your email address and the link to your pack. It never receives your manuscript.
• Stripe — handles payment. Checkout happens on Stripe's own site, so your card details are given to them directly and never pass through or rest on our servers.
• Sentry — receives error reports so we can fix faults. Configured to send no personal information and no manuscript text; an error report is a message and a job id.
• Railway — hosts the application and the database, in the United States.

We do not sell your data, we do not share it for advertising, and we do not combine it with data bought from anyone else. We may disclose information if the law requires it — a court order or a lawful request from a regulator — or where we need to establish or defend a legal claim.

If you are somewhere that requires us to name a lawful basis for each use — the UK and EU do — these are ours:

• To perform our contract with you — generating and delivering your pack, emailing you the link, taking payment, and handling refunds.
• Your consent — marketing email, keeping your teaser answers, and keeping your manuscript text. Each is a separate, unticked-by-default choice, and you can withdraw any of them at any time without affecting the rest.
• Our legitimate interests — keeping the service secure and available. This covers rate limiting, preventing automated abuse, and investigating faults. We have kept the data involved to the minimum: rate limiting works on an IP address held in memory for a day and never written to the database.
• Legal obligation — accounting and tax records, and responding to lawful requests.

Wherever you are, you can ask us to:

• Tell you what we hold about you, and give you a copy of it.
• Correct it if it is wrong or out of date.
• Delete it — your job record, your feedback, a retained manuscript, your teaser answers, or your waitlist entry.
• Stop marketing email, either by clicking unsubscribe in any message we send or by asking us.
• Withdraw a consent you gave earlier, without having to explain why.
• Object to, or ask us to restrict, a use of your data that rests on our legitimate interests.
• Receive your data in a portable form so you can take it elsewhere.

The way to exercise any of these is the same: email us at [email protected]. We will not charge you for it, and we will not treat you differently for asking. We aim to respond within 30 days.

You never have to give us anything beyond what a purchase requires. Declining the optional boxes does not change the pack you get.

We do not currently offer ShelfCrunch in the United Kingdom, the European Union or the wider European Economic Area, and visitors from those countries are turned away rather than served.

That is a deliberate choice, and the reason is this document. Serving you properly under the GDPR means having transfer agreements in place with every company that touches your data, and a complaints route that works. We have not finished that work, and we would rather decline the market than write a policy claiming protections we have not put in place. We intend to open here once it is done.

If you reached us anyway and gave us something, the rights listed above are yours in full and we will honour them — email us and we will delete what we hold.

This section is for residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Florida, Utah and Virginia.

What we collect. In the last twelve months we have collected identifiers (your email address, and your name if you gave it), commercial information (which pack you bought and when), and the content you chose to give us (your manuscript, its title and word count, your teaser answers, and any feedback). We collect it from you directly — nowhere else. The purposes are the ones set out above.

What we do not do. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either. We do not collect biometric, geolocation, or precise-location data, and we do not profile you.

Your rights. You can ask us to tell you what we have collected, to give you the specific pieces, to correct them, to delete them, and to limit how we use any sensitive information. Exercising these rights costs you nothing and changes nothing about the service or the price you pay. Email [email protected]. If we need to confirm it is really you, we will ask you to send the request from the address on the job.

We set one cookie, and only while ShelfCrunch is in private beta: when you enter an access code, a cookie records that you were let in so you are not asked again on every page. It cannot be read by scripts, it contains no personal information, and it does nothing else.

There are no analytics cookies, no advertising cookies, and no third-party tracking of any kind. The site loads no third-party scripts at all — our Content Security Policy forbids it, so this is enforced rather than merely intended. That is also why you are not being shown a cookie banner: there is nothing here to consent to.

Because we do not track you, browser “Do Not Track” signals have nothing to act on.

Your pack is reachable only with a token that is stored hashed, never in plain text, and traffic to the site is encrypted in transit. Manuscripts held under the retention opt-in sit in a database that carries its own expiry and is swept automatically, so deletion does not depend on anyone remembering.

We will protect your information by commercially reasonable means, but no method of transmission or storage is perfectly secure and nobody can promise otherwise. If a breach affects your data we will investigate it, tell the regulators the law requires us to tell, and tell you where we are required to or where you would want to know.

ShelfCrunch is for adult authors. It is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, tell us and we will delete it.

Where we link somewhere else — a retailer, a payment page — that site has its own privacy policy and we have no control over it. This policy covers what happens on ShelfCrunch, and stops at the point you leave.

If Sundial Forge, LLC is acquired, merges, or transfers the part of its business that runs ShelfCrunch, customer data may transfer with it. Whoever receives it would be bound by this policy for the data collected under it, and we would tell you before anything about the handling of your data changed.

We may update this policy as the product changes or the law does. Each version carries the version number shown at the top, and the version you agreed to is recorded against your job — so “you accepted the policy” always resolves to a specific text rather than whatever happens to be on this page today. Where a change needs your consent, we will ask for it rather than assume it.

Sundial Forge, LLC is organized under the laws of the State of Wyoming, United States, and the data described here is processed in the United States. This policy is governed by Wyoming law, without regard to its conflict-of-laws rules.

If you are somewhere that grants you data-protection rights beyond what this policy describes — the UK or EU under the GDPR, or California, for instance — those rights still apply to you, and the way to exercise them is the one above: contact us and we will action it.

Privacy questions, data requests and complaints all go to the same place, and a person reads it:

Ray Calloway, Sundial Forge, LLC
[email protected]