Privacy Policy

This policy explains which personal data we process when you use Anderbuch, for what purposes, on what legal basis, who receives it, how long we keep it and what rights you have. It applies to the website anderbuch.com, the installable web app and the emails we send. This is a convenience translation; the German version prevails.

1. Controller

Elias Tölle
Bulgariplatz 11
4020 Linz, Austria
Email: contact@anderbuch.com

We have not appointed a data protection officer because we are not legally required to. You can reach us about any privacy matter at the email address above.

2. The essentials

We process only what we need to provide Anderbuch: your account, your stories and worlds, your settings and your usage.
To provide AI features, excerpts of stories and world details may be sent to the services described in sections 3.3 and 4. We train our own writer only if you opt in under section 3.4. The optional "Muse" voice sends text to Meta on terms that allow Meta to train its models, as described in section 3.5.
The text of your stories and your input are stored encrypted with a key of your own, along with the moves we suggest from them. We cannot read that text unless you give us a time-limited support code. The record of your world that a story builds (people, places, their current state and open questions) is not encrypted this way, because the application works with it on every turn; it is stored in our database like your account data.
We use no advertising or tracking cookies, and we do not sell or rent out data.
You can export your stories and delete your account and its stories at any time. Some billing records may be retained for the periods in section 6.

3. What data we process and why

Data: email address, display name, password (stored only as a salted hash, scrypt), when signing in with Google your Google account identifier and verified email address, sessions (stored only as a hash), your confirmation that you are of age, the time and version of your acceptance of the Terms, and, only if you enter it, your date of birth.
Purpose: creating your account, signing you in, protecting your account, enforcing the minimum age and the age requirement for the "Mature" level and the opt-ins.
Legal basis: performance of contract (Art. 6(1)(b) GDPR); for recording your acceptance of the Terms and your age confirmation, our legitimate interest in being able to prove them (Art. 6(1)(f) GDPR).

3.2 Stories, worlds and settings

Data: your input (descriptions, actions, dialogue, corrections), the generated text, the record of your worlds (people, places, relationships, events, notes), saved positions and branches, your settings (for example narrative voice, length, appearance, content level) and, if you use read-aloud, the assignment of voices to characters.
Purpose: writing, storing, displaying and continuing your stories.
Legal basis: performance of contract (Art. 6(1)(b) GDPR).
Please do not enter sensitive data about yourself or other real people in your stories (for example about health). If you do, we process it only to write the story for you, and it is not used for anything else.

3.3 Writing with AI models

To write a passage, we send an excerpt of your story (the latest passages, relevant entries from the record of the world and your current input) to an AI model provider. The new text is also sent to AI services to keep the record of the world, check content (section 3.12), provide Otie (section 3.9), make typed decisions, and, if you use it, decide who speaks which line when reading aloud. Typed decision requests can contain world state and questions about the story. We do not send your account email address or account display name as request fields.
Depending on the feature and provider selected, requests may go through OpenRouter, Inc. (USA), directly to DeepInfra, Inc. (USA), or to TypeSafe AI's System One decision service. For requests routed through OpenRouter, we request hosts marked "data collection: deny"; the "Muse" voice is the exception described in section 3.5. For the "Storyteller" voice we additionally require hosts that keep neither the request nor the response (zero data retention). Providers' processing and retention terms can differ; see the recipient list and the provider terms.
Legal basis: performance of contract (Art. 6(1)(b) GDPR).

3.4 Help train our writer (optional)

If you switch on "Help train our writer" in Settings, we may use finished passages from your stories at the "Standard" level to train Anderbuch's own narrative model. For the export, an automated job decrypts these passages; they are exported without any user, story or passage identifier and are not passed on to anyone. This is only possible with a date of birth showing you are at least 18.
Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in Settings; later training sets then leave you out. A model already trained cannot unlearn what it has learned.

3.5 The "Muse" voice (optional)

On plans where we offer it, you can write with the "Muse" voice. Muse is a model from Meta Platforms, Inc. (USA) on terms that allow Meta to use what it is sent to train its models. Stories in this voice are therefore sent to Meta with that permission. We use Muse only if you have expressly agreed, after an explanation, and are at least 18; otherwise such a story is written in the "Writer" voice. For Meta's processing for its own training, Meta is an independent controller, and its privacy policy applies.
Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in Settings; your Muse stories then continue as "Storyteller". Text already sent to Meta cannot be recalled.

3.6 Research when a world is created

If your world is set in an existing work, a historical period or a real place, Anderbuch researches it on the internet when the world is created. To do so, search queries are formed from your description (for example the name of the work and the moment in the story) and sent through OpenRouter to the search provider Exa Labs, Inc. (USA). Search queries contain no account data.
Legal basis: performance of contract (Art. 6(1)(b) GDPR).

3.7 Usage, allowances and costs

Data: time and extent of written passages, the narrative voice used, technical cost, duration and outcome of each model call (without content).
Purpose: calculating and enforcing your plan's allowances, monitoring cost and quality, fixing errors.
Legal basis: performance of contract (Art. 6(1)(b) GDPR); legitimate interest in economically sustainable and reliable operation (Art. 6(1)(f) GDPR).

3.8 Payments

You buy paid plans from Stripe (the Stripe company named as seller on the checkout page and on the invoice, where it appears as "Link"), acting as reseller ("Merchant of Record"). Stripe processes your payment and billing data, including the name and billing address it needs to calculate VAT, as an independent controller; its privacy policy applies. From Stripe we receive what we need for your plan: customer and subscription identifiers, the plan, its status (for example active, cancelled, payment failed), periods, the email address used for payment and, for display, the card brand and last four digits. We do not receive full payment data. We also store that you requested the immediate start of your plan and acknowledged the consequences for your right of withdrawal.
Legal basis: performance of contract (Art. 6(1)(b) GDPR); statutory retention duties (Art. 6(1)(c) GDPR in conjunction with § 132 BAO).

3.9 Otie

Otie is the companion in the app. If you chat with him, we send your message and up to four recent excerpts of the story you are reading to an AI model (section 3.3). Otie stores memories about you only when you confirm them with "Yes, remember"; you can view, edit and delete them at any time. Otie's memories and support requests are stored encrypted.
Legal basis: performance of contract (Art. 6(1)(b) GDPR).

3.10 Emails

We send emails that are necessary for your account: email confirmation, password reset, security notices (for example a sign-in, a changed password or email address), notices about your plan (for example a failed payment), notices about measures concerning your published worlds and about material changes to these documents. We send emails via Google Workspace or Resend (section 4). The content of a queued email is deleted as soon as it has been sent.
If you sign up for the waiting list, we send you a confirmation link (double opt-in) and later the invitation.
Legal basis: performance of contract (Art. 6(1)(b) GDPR); for the waiting list, consent (Art. 6(1)(a) GDPR), which you can withdraw via the link in every email.

3.11 Security, logs and error reports

Data: IP address, time, requested address, status code, browser identifier and, for errors, the type and location of the error. Logs and error reports contain no story text, no email addresses and no passwords; account identifiers appear in them only as a hash or internal number.
We also keep a security record for your account: when it was signed into and how (password, passkey or Google), failed sign-ins, and changes to your password, email address, two-step sign-in, passkeys and linked Google account. It holds your account number and the time, not your email address or IP address.
Purpose: preventing abuse (for example limiting sign-in attempts), detecting and fixing errors, operational security.
Legal basis: legitimate interest in secure and functioning operation (Art. 6(1)(f) GDPR).
Error reports from the browser and the server are recorded by Anderbuch itself, on our servers in the EU; no third party receives them. They hold the type of error, the page and the time, never text you wrote.

3.12 Automated content checks

Input, generated text and published worlds are checked automatically for breaches of our Acceptable Use Policy, partly with an AI model (section 3.3). A match means input is refused or a text is rewritten. We store neither the text nor the match with your account. Measures against accounts (for example a suspension) are always decided by a human.
Legal basis: performance of contract (Art. 6(1)(b) GDPR) and legitimate interest in protecting users and complying with the law (Art. 6(1)(f) GDPR).

3.13 Product statistics

We count which features are used (for example "story created", "passage written", "world corrected"), with short technical attributes such as duration or length and your account number. These events contain no text and are recorded without cookies. On the public website we count page views only as daily totals, with no IP address and no account.
In the app we count which pages are opened the same way, as daily totals per kind of page, with no IP address and no account; no third party is involved.
We count only with your consent: on your first visit, the website and the app ask whether we may ("Allow statistics" or "Necessary only"). Until you say yes, nothing is counted for your account or your device.
Purpose: improving Anderbuch. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: in Settings under "Privacy and your data" (your account's events are then no longer recorded, and the app no longer counts page views on that device), with "Cookie settings" at the foot of the website, or in any other way (section 8).

If you publish a world, other users see the world, its description, its starting points and your display name as its author. Publishing a world does not publish its stories. Stories stay private unless you choose to share individual passages; anyone with a shared passage link can read that passage until you revoke the link. Ratings others give your world, and reports about it, are stored.

Custom world-page sections, community discussions and comments are also shared content. Your display name and posting date appear beside your contributions. Avoid posting private story excerpts or personal information you do not want other readers to see. You can remove your own contributions; a removed marker may remain to preserve the conversation's structure. World owners can moderate their communities, and administrators can review reports and remove content. Reports and explanations for moderation decisions are stored separately from public discussion text. Applicable retention and notice procedures for community moderation must be confirmed before publication.
If you send us a report (for example about illegal content), a complaint or a support request, we process your details and our correspondence to handle it.
Legal basis: performance of contract (Art. 6(1)(b) GDPR); for reports and complaints, legal obligation (Art. 6(1)(c) GDPR in conjunction with Art. 16, 17 and 20 Digital Services Act).

3.15 Support access to your stories

We cannot read the text of your stories (the record of your world is not encrypted this way, see section 2). If you want support to look at a story, you create a code in Settings and give it to us. It lets one person in for 30 minutes; you can end it earlier. Every access is logged.
Legal basis: performance of contract (Art. 6(1)(b) GDPR) at your request.

3.16 Read-aloud

The downloaded natural voices run on your device. The first time you use them, your browser downloads the voice files from Hugging Face, Inc. (USA), Cloudflare, Inc. (cdnjs, USA) or jsDelivr (Prospect One, Poland, delivered through Cloudflare and Fastly); these see your IP address. Your story text is not sent to these download hosts. If you choose a device voice, processing depends on the speech service supplied by your browser or operating system; it is not necessarily local.

Audiobook voice input is optional. Recording starts only after you agree to use your browser's speech service and press the microphone control. That service may send audio off your device for transcription under its own terms. Anderbuch does not upload or store the microphone recording. The transcript stays in the reply panel until you explicitly send it; a sent transcript is processed as an ordinary story input (sections 3.2 and 3.3). You can edit it, cancel it, or type instead. Browser speech-service providers and their current terms require confirmation before release.
Legal basis: performance of contract (Art. 6(1)(b) GDPR), because you request the feature.

3.17 Fonts

Anderbuch's typefaces are delivered from our own server, like the rest of the application. No font provider or other third party is contacted, and no data is processed for this beyond an ordinary request to our server.

4. Recipients and processors

We use the following service providers. Processors process data only on our instructions under a contract pursuant to Art. 28 GDPR.

Railway Corporation, USA — hosting of the application; server location Amsterdam, Netherlands. Processor.
Supabase, Inc., USA — operation of the database including backups; server location Ireland. Processor.
OpenRouter, Inc., USA — routing requests to AI models and research. Processor.
TypeSafe AI (System One) — may receive story/world state and decision questions for Jev, directly or through OpenRouter. Confirm TypeSafe's legal entity, role, processing country, and applicable terms before publication.
Model hosts via OpenRouter, which receive the excerpts described in section 3.3 (sub-processors), for the record of the world, research, Otie and checks, and for a writing voice when its own hosts are unavailable: Modal Labs, Inc., BaseTen Labs, Inc., CoreWeave, Inc. and FriendliAI, Inc. (all USA). The route configuration and provider-specific retention/training terms must be confirmed before this policy takes effect.
For the "Novelist" voice: SiliconFlow (Singapore), Together Computer, Inc. (USA) and FriendliAI, Inc. (USA). Sub-processors via OpenRouter.
For the "Dramatist" voice: Novita AI (USA) and DeepInfra, Inc. (USA). Sub-processors via OpenRouter.
For the "Storyteller" voice (every story's default): Together Computer, Inc., DigitalOcean, LLC, Prime Intellect, Inc., Fireworks AI, Inc. and DeepInfra, Inc. (all USA). Sub-processors via OpenRouter, limited to hosts that retain neither prompts nor outputs (zero data retention).
For the "Minimalist" voice: Anthropic, PBC (USA), Amazon Web Services, Inc. (USA) and Google LLC (USA). Sub-processors via OpenRouter.
For bookkeeping steps (keeping the record of the world): Alibaba Cloud (Singapore) Pte. Ltd. (Singapore). Sub-processor via OpenRouter.
TypeSafe AI — the decision model "Jev" (section 3.3). Sub-processor via OpenRouter.
Exa Labs, Inc., USA — web search for research when a world is created (section 3.6). Sub-processor via OpenRouter.
DeepInfra, Inc., USA — fallback model host, used directly when the hosts above are unavailable. Processor.
Meta Platforms, Inc., USA — only for the "Muse" voice and only with your consent (section 3.5); independent controller for its own training.
Google Cloud EMEA Limited, Ireland — sending email (Google Workspace) and managing the encryption keys for your stories (Google Cloud Key Management). Processor.
Plus Five Five, Inc. (Resend), USA — sending email, if we use it instead of Google Workspace. Processor.
Google for "Sign in with Google" — Google processes the sign-in as an independent controller under its own privacy policy; we receive your Google identifier, your email address and whether it is verified.
Stripe (the Stripe company named as seller at checkout) — sale and billing of paid plans as an independent controller (section 3.8).
Hugging Face, Inc., Cloudflare, Inc. and jsDelivr — download of read-aloud voice files (section 3.16).
With "Your own key": the AI provider you chose (OpenRouter or DeepInfra), with which you have your own contract. The prose of your stories is then generated through your account there; that provider's privacy policy also applies.

We disclose data to authorities and courts only where we are legally obliged to.

5. Transfers outside the EU

Some service providers are established in the USA or Singapore, or process data there. We base transfers to the USA on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise, like transfers to Singapore, on the Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). The provider list and route-specific processing descriptions are in sections 3.3 and 4. You can request information about the safeguards from us.

6. How long we keep data

Account, stories, worlds, settings, Otie memories: until you delete them or your account.
Sessions: until you sign out or they expire (30 days), deleted no later than 30 days afterwards.
Security record of your account (sign-ins and changes to how you sign in): 1 year, or until your account is deleted.
Usage and allowances: until your account is deleted; data relevant for billing and tax, 7 years (§ 132 BAO).
Subscription data from Stripe: payment details from Stripe's messages (email address, card brand, last four digits) 90 days; records of the subscription and the purchase until the end of the subscription, then 7 years for tax purposes.
Technical records of model calls and passages (without content): 90 days.
Error reports: individual occurrences 30 days, grouped errors 90 days after they last occurred. Server logs: 30 days.
Product statistics: 13 months. Daily page-view totals on the website contain no personal data.
Emails: content deleted on sending; the sending record after 30 days.
Waiting list: unconfirmed entries 7 days; confirmed entries until you are invited or unsubscribe.
Reports and complaints: until the procedure is closed and 1 year after that; where there are indications of a criminal offence, as long as necessary for proceedings.
Support access: the code and grant until they expire; the log of the access 1 year.
Backups: deleted data disappears from the database backups no later than 30 days after deletion.

7. Cookies and storage in the browser

We set two cookies: a session cookie that keeps you signed in (valid for 30 days), and, only during sign-in with Google, a cookie that protects that sign-in (valid for 10 minutes). Both are sent only over an encrypted connection and cannot be read by scripts.
The application also stores in your browser's storage (localStorage/sessionStorage) your reading and display preferences, text you have not sent yet, writing in progress, Otie's position, and whether you have visited Anderbuch before. If you install the app, it stores program files, fonts, read-aloud voice files and the three most recently opened passages and your list of stories for reading offline; both are deleted after 7 days or when you sign out. The public website stores, on your device only, the opening you tried there and the premise you typed, so the app can continue from them.
This storage is strictly necessary for the functions you request (§ 165(3) TKG 2021) and therefore needs no consent. We also store your answer to the question about product statistics (section 3.13), so we do not ask again. We use no analytics, advertising or tracking cookies.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).
You can do much of this yourself: in Settings you can change your details, withdraw consents and delete your account and its stories, subject to the billing-record retention described in section 6; you can export every story from the story itself. For anything else, write to contact@anderbuch.com. We reply within one month.

9. Complaints to the supervisory authority

You can complain to the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at, dsb@dsb.gv.at — or to the supervisory authority of your country of residence.

10. Do you have to provide data?

For an account we need your email address, a sign-in method and your confirmation that you are of age; without them we cannot provide Anderbuch. Your date of birth is only needed for the "Mature" level and the opt-ins. All other information is voluntary.

11. Automated decisions

The AI systems in Anderbuch write and check text. They make no decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Measures against accounts are always decided by a human.

12. Minimum age

Anderbuch is only for people aged 18 and over. If we learn that an account belongs to a younger person, we delete it.

13. Security

We protect your data by, among other things: encrypted connections (TLS); passwords stored only as a salted hash (scrypt); sessions stored only as a hash; story text, your input, Otie's memories and third-party keys encrypted with a key per user, which is itself protected in a separate key management service; administrative access only with additional verification and a log; logs without story text; limits on sign-in attempts; and regular updates of the software we use.

14. Changes to this policy

If we change this policy, we publish the new version here and inform you of material changes by email and in the application.

Last updated: 13 October 2026 · Version 1.0