The short version
- Your novel files, covers, Codex entries, settings, and API keys are stored on your computer, not in the HexaQuill account database.
- We store the account information needed to sign you in and confirm whether you have Free or Premium access.
- If you choose OpenRouter, the text needed for your request is sent directly from the desktop app to OpenRouter and its selected model provider. We do not receive or keep a copy.
- Local AI connections such as LM Studio or Ollama run through the server address you configure. HexaQuill does not receive those prompts or responses.
- If you enable the MCP Companion, the third-party AI application you connect can request content from the one novel you approved. That provider handles the information under its own terms and privacy policy.
- We do not currently use advertising trackers or analytics on the HexaQuill website.
Developer note: We do not use your account information to read your writing, build advertising profiles, or sell your data. If you choose Google Sign-In, Google and Firebase handle the sign-in process. We never receive your Google password or gain access to your Gmail, Google Drive, contacts, or other private Google content. The sign-in service provides the basic profile details needed to create and identify your HexaQuill account, which may include your email address, name, and profile photo. We use your email address as an ordinary contact address—the same way a sender emails a recipient—and to connect your account with its Free or Premium tier.
1. Information we handle
Account information
When you create or use an account, we may handle your email address, Firebase user ID, display name, profile photo, sign-in method, email verification status, account creation and update times, plan, Premium status, and subscription status.
If you sign in with Google, Google provides the basic account details you approve, such as your email address, name, and profile photo. We do not receive your Google password.
Technical and security information
Firebase and Google may process your IP address, user agent, device or browser information, authentication events, and related security logs to host the website, provide sign-in, prevent abuse, and keep the service secure.
Support information
If you contact us, we receive the information in your message and any files you choose to send. HexaQuill support will never ask for your password, API keys, authentication codes, or payment card details. Never send these secrets to us or anyone claiming to represent HexaQuill. Only send manuscript excerpts or files when you choose to and they are necessary to investigate a specific issue.
Payment information
Online payments are not active on this staging website. Before paid checkout launches, we will name the payment provider here. The payment provider will process card or payment credentials under its own privacy notice. HexaQuill will receive limited transaction information needed to activate Premium, manage the subscription, handle refunds, prevent fraud, and keep financial records. We will not store full card details.
Information stored only on your device
Novel files, covers, chapters, Codex entries, exports, writing statistics, custom themes, panel settings, local AI server addresses, and AI API keys are stored locally by the desktop app. If you place your novel folder in OneDrive, Dropbox, or another sync service, that provider processes the files under the account and terms you have with them.
2. How and why we use personal information
| Purpose | Information | UK GDPR lawful basis |
|---|---|---|
| Create accounts, sign users in, and provide plan access | Account, authentication, and entitlement information | Contract, or steps requested before entering a contract |
| Operate the website and protect accounts from misuse | IP address, user agent, sign-in events, and security logs | Legitimate interests in running a reliable and secure service |
| Reply to questions and provide support | Contact details, messages, and attachments you send | Contract where support relates to the service, otherwise legitimate interests |
| Administer payments, refunds, tax, and accounting | Account and transaction information | Contract and legal obligation |
| Send optional product news or marketing | Email address and communication preferences | Consent where required. We do not currently send marketing emails |
Our legitimate interests: operating HexaQuill, protecting users and the service, responding to support requests, diagnosing failures, and preventing fraud or abuse. We consider whether these interests can be met in a less intrusive way and whether your rights override them.
We do not use personal information for solely automated decisions that produce legal or similarly significant effects.
3. Manuscripts and AI features
HexaQuill is local-first. We do not upload your manuscript to our account database, use it to train AI models, sell it, or inspect it remotely.
Cloud AI is optional and only runs when you ask HexaQuill to perform an AI action. When OpenRouter is selected, the app sends the text and context required for that action to OpenRouter using your API key. OpenRouter then routes the request to the model provider you selected. Their handling of prompts, responses, metadata, retention, and model training depends on your OpenRouter settings and the chosen model provider.
Read the OpenRouter Privacy Policy and its data collection guide before sending confidential or personal information. Use a local AI provider if you do not want writing sent to a cloud AI service.
You are responsible for making sure you have the right to submit personal information about other people in your manuscript or prompt.
MCP Companion and third-party AI applications
The MCP Companion is optional. When you enable it, HexaQuill starts a local, read-only session for the novel you currently have open. A compatible AI application can then request approved chapter and Codex information through the available MCP tools. The session stops when you disable it, sign out, close HexaQuill, or change novels.
The AI application and its provider are separate third parties. Content they receive is handled under their own terms, privacy policy, retention settings, model training choices, and copyright rules. Review those documents before connecting the provider or sharing confidential work.
You must make sure you have the rights and permissions needed to share manuscript content, personal information, and other protected material with the provider. Do not connect a provider if its terms are not suitable for your work.
HexaQuill does not control an independent provider's systems, security, data use, or decisions. If a loss is caused only by that provider's independent conduct, HexaQuill is not responsible for that conduct. This does not reduce your legal rights where HexaQuill caused the problem, failed to meet its own duties, or the law says responsibility cannot be excluded.
4. Who receives personal information
We do not sell personal information. We may disclose it to:
- IONOS: website hosting, content delivery, security, and service logs. See the IONOS Privacy Policy.
- Google Firebase: authentication, account profiles, subscription records, and security. See Privacy and Security in Firebase and the Google Privacy Policy.
- Google: when you choose Google Sign-In.
- OpenRouter and model providers: only when you choose OpenRouter and request a cloud AI action.
- MCP-enabled AI applications and their providers: only when you enable the MCP Companion and the connected application requests information from the novel you approved.
- Our future payment provider: when paid subscriptions launch and you choose to buy Premium.
- Professional advisers and authorities: where reasonably necessary for legal, accounting, security, fraud prevention, or regulatory purposes.
- A buyer or successor: if HexaQuill is reorganised, sold, or transferred, subject to applicable privacy law.
Service providers may only use information as permitted by their contracts and applicable law. Some third parties, including a cloud AI provider you choose, may also act under their own privacy terms.
5. International transfers
HexaQuill is operated from the United Kingdom, with a co-owner and contributor in Bangladesh. Authorised access to account or support information may therefore take place from either country when needed to operate or support the service.
Firebase Authentication is operated from the United States. Other Firebase services use Google infrastructure in multiple countries. OpenRouter, MCP-enabled AI applications, and the model providers available through them may also process information outside the UK.
Where UK data protection law requires a transfer safeguard, we rely on an applicable UK adequacy regulation or contractual safeguards included in the relevant provider agreement, such as approved standard data protection clauses and the UK transfer addendum. Contact us if you would like more information about the safeguard used for a particular transfer.
6. How long we keep information
| Information | Typical retention |
|---|---|
| Account and plan information | While your account remains open, then deleted or anonymised after a verified deletion request unless we need limited information for law, disputes, fraud prevention, or security |
| Firebase authentication backups | Google states that deleted authentication information may remain in live and backup systems for up to 180 days after account deletion is initiated |
| Support correspondence | Normally up to 24 months after the last contact, or longer if needed for an active dispute or legal requirement |
| Payment and accounting records | Normally six years from the end of the company financial year to which the record relates, or longer if UK law requires it |
| Local manuscripts and settings | Until you delete them from your device or chosen storage folder |
| Cloud AI prompts and responses | HexaQuill does not keep a separate copy. The retention rules of OpenRouter and the selected model provider apply |
| Content requested through MCP | HexaQuill does not keep a separate cloud copy. The connected AI application's provider controls its own retention under the terms and settings you accept |
7. Cookies and local browser storage
The website uses Firebase authentication storage that is necessary to keep you signed in and secure your session. It may store identifiers and authentication tokens in your browser. You can remove this data by signing out or clearing site data in your browser, although doing so will sign you out.
We do not currently use Google Analytics, advertising cookies, behavioural advertising, or third-party marketing trackers on this website. If that changes, we will update this policy and request consent where UK law requires it before non-essential storage or tracking starts.
8. Security
We use access controls, HTTPS, Firebase security rules, provider encryption, and restricted account access to protect personal information. Novel files remain under the security of your device and any backup service you choose. No method of storage or transmission is completely secure, so keep your device, email account, passwords, and API keys protected.
9. Children
HexaQuill is not directed to children under 13. A child under 13 must not create an account without a parent or guardian handling the account and giving any consent required by law. Contact us if you believe a child has provided personal information without appropriate permission.
10. Your privacy rights
Depending on where you live and the circumstances, you may have the right to:
- ask for a copy of your personal information;
- correct inaccurate or incomplete information;
- ask us to erase information;
- restrict how we use information;
- receive information you supplied in a portable format;
- withdraw consent at any time where we rely on consent; and
- object to processing based on legitimate interests or to direct marketing.
Your right to object: You may object at any time to direct marketing. You may also object to processing based on our legitimate interests. We will stop unless we have compelling lawful grounds to continue.
Email support@hexaquill.app to exercise a right or request account deletion. We may ask for information needed to verify your identity. Rights can be limited by law, and we will explain if an exception applies.
11. Changes to this policy
We will update this policy when our data practices, providers, or legal obligations change. The effective date at the top shows when the current version began. We will give a more prominent notice before a material change takes effect where appropriate.
12. Contact and complaints
HexaQuill
United Kingdom
support@hexaquill.app
Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner's Office. Visit the ICO complaints page, call 0303 123 1113, or write to the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.