Privacy Policy
Last updated 13 October 2026
This Privacy Policy explains how New Version Limited ("we", "us", "our"), a company registered in New Zealand, handles personal information when you use NovelGPT on iOS, Android, macOS and the web at novelgpt.app (together, the "Service").
The short version:
- Your writing is yours. We do not sell it, we do not use it to train AI models, and we do not show you ads.
- Guest books stay on your device. Unless you sign in and turn on sync, your books are stored only on the device you write on.
- AI requests pass through us, but we don't keep them. When you ask the AI to do something, the text needed for that request goes through our server to the AI provider you chose, and the reply comes back to you. We do not store the request or the reply.
- We keep only what we need to run the Service: an account ID, your credit balance, records of what you used and bought, and (if you sign in) your email address and synced books.
- No analytics, advertising or cross-app tracking.
If you have a question, email support@novelgpt.app.
Who we are
New Version Limited, New Zealand, operates the Service and is responsible for your personal information (the "controller" under the GDPR and UK GDPR, and the "agency" under the New Zealand Privacy Act 2020). Our privacy officer can be reached at support@novelgpt.app.
The Service is offered worldwide. This policy is written to meet the New Zealand Privacy Act 2020 and, where they apply to you, the EU and UK General Data Protection Regulations, the Australian Privacy Act 1988, and US state privacy laws.
What we collect
Information you give us
| What | When | Why |
|---|---|---|
| Your writing (premises, people, places, chapters, notes and other book content) | When you write | To provide the Service. Stored on your device. Also stored in our cloud database only if you sign in, so your books sync between your devices. |
| Text you send to the AI (your instructions plus the parts of your book the action needs) | When you tap an AI action or chat | To get the AI result you asked for. Passed through our server to the AI provider; not stored by us. |
| Email address | Only if you sign in with an email code | To sign you in and to contact you about your account. |
| Apple or Google sign-in details (an account identifier, and an email address, which may be an Apple private relay address) | Only if you sign in with Apple or Google | To sign you in. |
| Support emails | When you email us | To answer you. |
| Reports about AI responses (the reason you choose, an optional note, the AI text if you choose to include it, and the feature, AI model, app version and platform; linked to your Account ID until you delete your account) | When you tap Report | To review harmful output and improve safety. |
Information created when you use the Service
| What | Why |
|---|---|
| Account ID — a random identifier created the first time you open the app, even as a guest | To keep your credits and purchases attached to you without asking you to sign up. |
| Credit balance and usage records — for each AI request: time, which AI model, the number of tokens and credits used, the feature used (for example "draft chapter") and an internal book number | To charge the right number of credits, show your usage, prevent abuse, and keep accounting records. These records do not contain your writing. |
| Purchase records — plan or pack, store transaction ID, dates, renewal and refund status | To give you what you paid for and keep accounting records. We do not receive your card or bank details. |
| Technical information — your IP address, device type, app version and request times | Your IP address is used briefly to limit how many new accounts can be created from one network, and is seen by our hosting provider when your device connects. We do not store it with your account. |
Information from others
- Apple, Google and Stripe tell us when you buy, renew, cancel or get a refund, through our payments provider RevenueCat.
- Apple and Google tell us your sign-in identifier and email when you choose to sign in with them.
We do not buy information about you, and we do not combine it with information from data brokers.
What we do not do
- We do not sell or rent personal information, and we do not "share" it for cross-context behavioural advertising.
- We do not use your writing, your AI requests or the AI's replies to train AI models, and our AI providers are not allowed to use them for training either (see AI providers).
- We do not run advertising, analytics or crash-reporting tools, and we do not track you across other companies' apps or websites.
- We do not read your books. Staff may see writing only if you send it to us (for example in a support email or a report), or if we are legally required to look.
How and why we use information
We use personal information to:
- provide the Service: store and sync your books, run the AI actions you ask for, and show your credits;
- process purchases, subscriptions, renewals and refunds;
- keep the Service secure and prevent fraud and abuse (for example, limits on free credits and new accounts);
- answer support requests and reports;
- meet legal, tax and accounting obligations;
- tell you about important changes to the Service or these terms.
Legal bases (EU and UK users). We rely on: contract — to provide the Service you asked for, including AI actions, sync and purchases; legitimate interests — security, abuse prevention, reviewing reports and improving the Service, balanced against your rights; legal obligation — tax and accounting records; and consent — sending your text to AI providers, which you agree to in the app before any AI action and can withdraw at any time in Settings › Privacy.
AI providers
When you use an AI action, the text needed for that request is sent from your device to our server and then to the AI provider that runs the model you chose. The reply returns the same way. We do not store the text or the reply, and we do not log their contents.
We use each provider's paid business API. On the date of this policy, each provider's terms for that API say:
| Provider | Trains on your data? | How long the provider keeps requests |
|---|---|---|
| Anthropic (Claude models) | No | Deleted within 30 days, longer only if flagged for a policy violation or required by law |
| OpenAI (GPT models) | No | Abuse-monitoring logs kept up to 30 days, longer only if required by law or to prevent harm |
| Google (Gemini models) | No (paid Gemini API) | Logged for a limited period only to detect policy violations |
| xAI (Grok models) | No | Kept 30 days for abuse audits, then deleted |
These providers act as our service providers (processors). Their own terms can change; we will update this table when they do.
Who we share information with
We share personal information only with the service providers that run the Service for us, and only what each needs:
| Service provider | What they do | Where |
|---|---|---|
| Cloudflare | Hosts our website and the server that relays AI requests | Global network |
| Supabase | Database and sign-in: account, credits, usage records, synced books, reports; sends sign-in code emails | United States |
| Anthropic, OpenAI, Google, xAI | Run the AI models you choose | United States and other countries |
| RevenueCat | Manages in-app purchases and subscriptions | United States |
| Apple (App Store) and Google (Google Play) | Take payment for in-app purchases and provide sign-in | Worldwide |
| Stripe | Takes payment for purchases on the web, when available | Worldwide |
We may also disclose information:
- if the law requires it, or to respond to a valid legal request;
- to protect the rights, safety or property of our users, the public or us;
- to a buyer or successor if our business or assets are sold or reorganised, in which case this policy will continue to apply to your information.
International transfers
We are based in New Zealand, and our service providers process information in the United States and other countries. When information leaves New Zealand, the EU, the UK or your own country, we make sure it is protected to a comparable standard, as the New Zealand Privacy Act (Information Privacy Principle 12) and the GDPR require. We do this through our providers' contractual commitments, including the European Commission's Standard Contractual Clauses and the UK addendum where they apply.
How long we keep information
| Information | How long |
|---|---|
| Books on your device | Until you delete them, delete your account, or remove the app |
| Synced books (signed-in users) | Until you delete them or delete your account |
| Text sent to the AI | Not kept by us; see AI providers for provider retention |
| Email address and sign-in identifiers | Until you delete your account |
| Guest accounts that are never used again and never bought anything | Deleted after 180 days without activity |
| Credit balance | Until you delete your account |
| Usage and purchase records | 7 years, as New Zealand tax law requires. When you delete your account they are separated from your identity and your book references are removed |
| Reports about AI responses | Up to 1 year, then deleted |
| Support emails | Up to 2 years after your last message |
| Server logs (times, error messages and account ID; never your writing) | A few days, and no more than 30 days |
| Database backups | Overwritten on a rolling schedule within 30 days |
Information stored on your device
The app stores your books, settings and sign-in session on your device:
- on iOS and macOS in the app's private storage and the Keychain;
- on Android in the app's private storage, with the sign-in session encrypted and excluded from backups;
- on the web, in your browser's local storage and IndexedDB for novelgpt.app.
We do not use cookies for advertising or analytics. The website uses browser storage only to make the app work, so we do not show a cookie banner. Clearing your browser's site data for novelgpt.app deletes the books stored in that browser, so export them first if you are writing as a guest.
Security
- Information travels over encrypted connections (HTTPS).
- Our database allows access only through our own server.
- AI provider keys are kept on our server, never in the app.
- Access to production systems is limited to the people who need it.
No system is completely secure, so please keep your devices and sign-in methods safe. If a privacy breach is likely to cause serious harm, we will notify you and the relevant regulators, as the New Zealand Privacy Act and other laws require.
Your choices and rights
You can, at any time:
- Withdraw AI consent: Settings › Privacy. AI actions then stop until you agree again.
- Export your books: each book can be exported as DOCX, EPUB, PDF, Markdown or plain text.
- Delete your account and data: Settings › Account › Delete. See Delete your account.
- Use the Service without an account: guest mode needs no email or sign-in.
Depending on where you live, you may also have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct it or delete it;
- object to or restrict some uses;
- receive your information in a portable format;
- withdraw consent.
To make a request, email support@novelgpt.app from the email address you sign in with, or include the Account ID shown in Settings › Account. We may need to confirm it is you. We answer within 20 working days (New Zealand) or one month (EU and UK), and we do not charge for reasonable requests.
Complaints. If you are not happy with our answer, you can complain to:
- the New Zealand Office of the Privacy Commissioner;
- the data protection authority where you live (EU and EEA);
- the UK Information Commissioner's Office;
- the Office of the Australian Information Commissioner.
US residents. Some US states (for example California, Colorado, Virginia and others) give you rights to know, correct and delete personal information, and to opt out of sale, sharing for targeted advertising, and profiling. We do not sell or share personal information, or use it for targeted advertising or profiling, so there is nothing to opt out of. You can use the rights above by emailing us, and we will not treat you differently for doing so. If we refuse a request, you can appeal by replying to our answer.
Children
The Service is only for people aged 18 or older. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has used the Service, email us and we will delete the account.
Changes to this policy
We may update this policy as the Service or the law changes. We will change the "Last updated" date. If a change is significant, we will tell you in the app or by email before it takes effect.
Contact
New Version Limited, New Zealand Email: support@novelgpt.app