Privacy

Bookwright keeps what it needs to hold your books and sign you in, and nothing to sell. This page says what that is.

Visiting the site

Reading these pages sets no cookies and loads no trackers. Vercel, which serves the site, keeps ordinary request logs for a short time.

Your account

• Your email address, when the account was made and when you last signed in.
• Your sessions: a random token in an HttpOnly cookie called __Host-bw_session, of which we keep only a hash, with the browser's name ("Chrome on macOS") and when it was last used.
• A sign-in code while it is waiting, kept for 10 minutes as a keyed hash, never as the code itself.
• A log of sign-in events by account id with the first part of the IP address only (a /24 or a /48), keeping about the last 10,000.

Your books

Everything you write and everything the Director and its desks write for you: the brief, the bible, the outline, the text, notes, versions, designs and metadata. They are yours. You can export a book whole at any time, and deleting it deletes it.

Your model keys

If you give Bookwright a key for Anthropic, OpenAI, Google, OpenRouter or another provider, it is sealed at rest with AES-256-GCM, opened only to call that provider on your behalf, and never shown back to you beyond its last four characters. What the Director sends to your provider is your book and your instructions, under that provider's own terms. If you use your Claude plan through the connector, Bookwright never sees your Claude login.

Who handles it

• Vercel runs the site and its functions, in the United States.
• Upstash stores accounts and books in Redis, in the United States (us-east-1).
• Resend sends the sign-in emails.
• The AI provider you choose receives what the desks send it.

Deleting it

On your account page, delete the account: it removes the account, every book, every session, every key and every connection, at once. The sign-in log keeps only the event and the account id.

Updated 20 October 2026.