Last updated: August 2026
kudowrite is a fiction-writing app. This policy explains what data the app handles, where it lives, who else is involved, and how to get it back or get rid of it.
This changed in August 2026. kudowrite used to store everything in your browser, with an optional backup file in your own Google Drive, and ran no server at all. It is now account-based: your writing is stored in a database we operate. Google Drive sync has been removed. Section 2 explains what that means for you, including the part that is less private than before.
Using kudowrite means creating an account. These are stored on kudowrite's backend:
We also collect aggregate, anonymous usage analytics, described in section 6. We do not sell any of it, and we do not use your writing to train anything.
Your content is stored in a PostgreSQL database hosted by Supabase in the European Union (Ireland). Every row is tied to your account and protected by database-level row-level security, so no other account can reach your data through the app or its API. Traffic is encrypted in transit with TLS.
Being straight with you about the trade-off: because your writing now sits on a server we operate, we are technically able to read it — whoever administers a database always can. We don't, we won't share or sell it, and nothing trains on it. But it is no longer true, as it was in earlier versions of kudowrite, that we couldn't see your work even if we wanted to. If that guarantee was why you chose this app, that's a fair reason to reconsider, and section 8 tells you how to take your data out.
What you gain for that: your work is on every device you sign in from, it saves continuously without you thinking about it, and clearing your browser no longer destroys anything.
Your browser now holds only your login session, a couple of interface preferences, some local diagnostics, and a short-lived buffer of any edits that haven't reached the server yet — so a dropped connection doesn't cost you a sentence. That buffer clears the moment those edits are saved.
You can create an account with an email address and password, or with Google. Authentication is handled by Supabase Auth. Passwords are stored only as salted hashes — never in readable form, and never visible to us.
If you sign in with Google, Google provides your email address, name and profile picture, which are stored on your account and shown in the app. kudowrite no longer requests any access to your Google Drive; the narrow drive.file permission used by earlier versions has been removed entirely. Your use of Google Sign-In is subject to Google's Privacy Policy.
kudowrite is a bring-your-own-model tool: you supply your own OpenRouter or Mistral API key and choose which models to run.
Your key is stored on your account, so it follows you between devices instead of having to be re-pasted in every browser. It is encrypted at rest: the ciphertext sits in a column the app's public API cannot read or write at all, and it is decrypted only for you, through a database function scoped to your own account. The encryption key itself is held outside the database.
When you use an AI feature the key is sent directly from your browser to your provider, and nowhere else. We never use it for anything but the requests you make.
Your prompts and the model's responses travel directly from your browser to OpenRouter or Mistral, under your own account. They do not pass through, and are not logged by, any kudowrite server. Your manuscript is stored on your account (section 2); the request traffic to the model is not.
Not on our side. kudowrite does not train models, and has no business model that depends on your writing. Whether the model provider may use your prompts and outputs for training is governed entirely by OpenRouter or Mistral and the specific model you select, not by kudowrite. OpenRouter exposes this directly: in your account settings you can control data logging and training, and each model is labelled with its provider's data policy (some never train on inputs; some may, depending on the route). Because you hold the key and pick the model, that choice is always yours to make and to change.
To review or adjust it: see your OpenRouter privacy & data settings, OpenRouter's Privacy Policy, or Mistral's terms and privacy documents.
kudowrite uses Google Analytics (GA4) to understand aggregate, anonymous usage — such as how many people visit, which pages they view, and roughly where they come from — so the app can be improved. Google Analytics sets cookies and processes limited technical data (such as a truncated IP address) on Google's servers. It does not have access to your writing or your API key. Your use of Google Analytics is subject to Google's Privacy Policy, and you can opt out site-wide with the Google Analytics Opt-out Browser Add-on.
Your login session is kept in your browser's local storage rather than in a cookie.
Deletions carried out in the app are immediate and cannot be undone; there is no backup we can restore from afterwards. Your data is kept for as long as your account exists.
If you are in the EU or the UK, the GDPR gives you the right to access, correct, export, delete, restrict or object to the processing of your personal data, and to complain to your local data protection authority. Requests go to admin@kudowrite.com.
kudowrite is not intended for users under the age of 18 and contains content suitable for adults only. If you are under 18, please do not use this application.
If this policy changes materially, the "Last updated" date above will be updated. Continued use of the app after any change constitutes acceptance of the revised policy.
Questions about this policy can be directed to admin@kudowrite.com.