WritingBricks

Privacy policy

Last updated 8 November 2026

WritingBricks is operated by The Founder Upgrade L.L.C-FZ, a company registered in the United Arab Emirates. For privacy questions or requests, contact piernicola@thefounderupgrade.com.

Your writing and where it lives

Markdown files opened from a local folder stay on your device. Signing in does not upload them. Browser drafts are stored in that browser using IndexedDB. Clearing site data, removing a browser profile or losing a device can remove those drafts. Export a copy of work you want to keep.

If you choose to save a project online, we process its text, file names and project structure to store it and make it available to your signed-in devices. This is optional. Online projects are stored on the service, not end-to-end encrypted with a key that only you hold. The operator can access service data when needed to provide support, investigate a failure or protect the service. Your text is not sent into an AI training pipeline by WritingBricks.

If you connect Dropbox, the browser uses Dropbox OAuth with PKCE and communicates directly with Dropbox. Its access token is held in browser storage. WritingBricks does not copy those Dropbox documents to its own server. Disconnect Dropbox and review connected apps in Dropbox to revoke its access. Dropbox handles its own service under its privacy policy.

Account and security data

For an account we process your email, optional name, password hash, recovery-key hash and session records. Passwords use scrypt hashing. The email address is not currently verified. Account recovery uses the recovery key supplied at signup, not an email reset link. Keep that key privately and do not send it to support.

We use an essential session cookie to keep you signed in. It lasts up to 90 days and can be renewed while you use the service. Device storage also holds preferences, recent-file information and local editing state. These functions are needed to deliver the features you choose. We do not use advertising cookies or analytics trackers.

Requests to the service can expose an IP address and technical request information to hosting and security systems. We use these to deliver pages, limit abuse, investigate failures and protect accounts.

Optional anonymous update statistics

The Mac app can send optional update statistics when enabled. These contain a random installation token, stored on the server as a hash, together with platform, app version and timestamps. They do not include document text or your account email. You can disable this option and request deletion of its stored record through the app.

Why we process data and who receives it

We process account and online-project data to provide the service you request. We process technical security information to operate and protect it. Where applicable law requires a legal basis, these purposes rely on performing our agreement with you and our legitimate interests in service reliability and security. Optional update statistics rely on your choice to enable them.

Our production hosting provider is Hetzner. Hosting and infrastructure providers process the data necessary to operate the service on our behalf. GitHub, a Microsoft company, provides build and release infrastructure and stores encrypted recovery backups in a private repository. Backup copies are encrypted before they leave the server. Support correspondence is handled through our email service. We may disclose information when required by applicable law or when necessary to investigate abuse and protect legal rights. We do not sell your writing or personal data.

The operator is based in the United Arab Emirates and support or administration can involve access from the UAE. Infrastructure or support providers may process information in other countries. Where applicable law requires safeguards for an international transfer, those requirements apply. This policy does not represent certification under any privacy framework.

Retention and deletion

Account and online-project data remain while you use the account until you delete them. Deleting your account removes its online projects and associated sessions from the active service. It does not delete your local Markdown files, browser copies or files in your own Dropbox.

Encrypted recovery backups normally remain for 30 days. After a new backup has been verified, the retention process removes older verified and incomplete copies. A failed backup or retention job can delay removal and is flagged for investigation. Deletion from the active service does not immediately remove data from an earlier backup. Those copies remain restricted to recovery. When restoring a backup, we review applicable deletion requests received through support.

Technical security records and support messages are kept only as needed for their purpose, legal obligations or resolving an issue. When you disable optional update statistics, use the deletion action to remove its existing server record as well.

Your requests and rights

Depending on applicable law, you may have rights to access, correct, export or delete personal information, restrict or object to processing, withdraw consent and complain to a competent supervisory authority. Contact us using the address above. We may ask for proportionate evidence that an account or request belongs to you before disclosing or deleting data.

Changes

We will update this page when the service or its data handling changes. The date below identifies this version.