Privacy Policy

Account data

Display name, username, email address, password hash, and date of birth if you provide one. You must be at least 13 to hold an account.

Content

Stories, chapters, drafts, comments, votes, and the covers you upload.

Reading activity

Which chapters you opened, how far you read, library saves, and who you follow. This powers your library and discovery shelves.

Payment data

Premium subscription status, Credit balance, Credit ledger, purchase history, and paid-part unlock records. Card details are held by Stripe, not Nottpad.

Messages

The text of 1:1 direct messages you send or receive. Messages are text only in this launch. We do not collect images or other media from DMs.

Technical data

IP address, device and browser type, session identifiers, and error logs.

To run the service: sign you in, show your library, sync your reading position across devices, deliver the notifications you asked for, and process payments. Our lawful basis for this is performance of our contract with you.

To keep the place safe: classify published content for age bands, detect spam, investigate reports, and enforce age ratings. Our lawful basis here is legitimate interest, and the interest is other readers.

To show advertising on free accounts. Free users may see third-party ads on story overview and end-of-part pages. Premium subscribers do not see ads. Our lawful basis is legitimate interest for ad-supported free access.

We do not sell personal data. We do not use your writing to train generative models. Published part text is sent to Google Gemini for age-rating classification only, under Google's paid API terms.

We use the following processors to operate nottpad.com. Each processes data only for the purpose described and under a data-processing agreement or equivalent contractual terms.

Supabase

Authentication, database, file storage, and realtime sync for accounts, stories, and reading activity.

Vercel

Web application hosting and operational logs.

Resend

Transactional email: account verification, password reset, and notification delivery.

Didit

Age assurance for 18+ content opt-in on the web. Selfie capture and liveness checks; borderline cases may request ID verification.

Google Gemini

Automated age-rating classification of published part text. Paid API tier; we do not use your writing to train our own models.

Stripe

Premium subscriptions via Checkout and the Customer Portal, Credit purchases, and author payouts through Connect. Payment card data is collected and stored by Stripe, not Nottpad.

Google advertising product

Third-party advertising for free accounts on story overview and end-of-part placements only.

Reading 18+ stories on the web requires age verification and an explicit opt-in. Verification is performed by Didit using facial age estimation and passive liveness detection. Borderline estimates may trigger an adaptive ID check.

Free accounts may see third-party advertising on story overview pages and at the end of a part. We do not show ads between every chapter.

Advertising partners may use cookies and similar technologies to measure ad delivery and relevance. Premium subscribers do not receive third-party ads while their subscription is active.

You can manage advertising cookies through your browser settings. Blocking advertising cookies does not remove ads, but may make them less relevant.

Premium is an optional subscription that removes ads and unlocks Premium benefits. You start checkout on /premium; Stripe Checkout collects the payment and the Stripe Customer Portal is where you change payment methods or cancel.

Credits are virtual currency used to unlock paid story parts. Bundles are 50, 120, or 300 Credits. Credits are not cash, are not transferable, and have no value outside Nottpad. Your balance and ledger live on /credits.

Author payouts for exclusive parts use Stripe Connect. We record a 70% author / 30% platform split on each unlock. Payments are processed by Stripe. We receive subscription status, transaction references, and Credit ledger entries. We never store your full card number.

We use strictly necessary cookies for authentication and session management. These are required for the site to function.

Free accounts may also receive advertising cookies from our ad partner when ads are displayed. See section 5 for how to manage these.

Under UK and EU data protection law you can ask for a copy of your data, correct it, delete it, restrict how we use it, or object to processing based on legitimate interest.

To request a copy of your data, email privacy@nottpad.com. We respond within 30 days. You can close your account from Settings → Delete account. We send a confirmation link to your email; after you confirm, the account is removed from live systems and encrypted backups expire within 30 days.

If we get it wrong you can complain to the Information Commissioner's Office.

Account and content

Until you delete it, then up to 30 days in encrypted backups

Reading activity

24 months, then aggregated beyond recovery

Age verification result

Lifetime of the account (the flag only, not the selfie)

Payment and Credit records

As long as required for tax, fraud prevention, and dispute resolution

Direct messages

Until you delete the thread or your account, then up to 30 days in encrypted backups

Moderation records

3 years, to handle repeat cases and appeals

Nottpad Ltd is the data controller. Write to privacy@nottpad.com or to Nottpad Ltd, 14 Tib Street, Manchester M4 1SH, United Kingdom.

Material changes to this policy are posted on this page with an updated date.