Legal
Privacy Policy
Effective date: June 6, 2026 — Scriptorium Public Beta
1. Service overview
Scriptorium is a markdown writing workspace with user accounts and server-side storage, currently in public beta. The service is self-hosted or operated by the Scriptorium team.
2. Data we collect
- Account data: Your email address (used as your username), first name, last name, and a secure password hash (handled by Django's built-in auth system). No plaintext passwords are stored.
- Profile picture: An optional avatar image you upload, stored as a data URL. You can remove it at any time from your profile.
- User content: Notes (title, body, tags, slug, pin status) and projects (title, body, ordered note list) that you create in the app.
- Operational metadata: Timestamps (
createdAt,updatedAt) and UUIDs required for app functionality. - Support tickets: If you submit feedback or a support request, we store the ticket title, description, category, status, and any reply thread.
- Session data: A signed session cookie to keep you logged in between requests.
3. Data we do not collect
- No third-party OAuth tokens or social login data.
- No third-party cloud sync credentials.
- No analytics tracking pixels, advertising identifiers, or behavioural profiling.
- No payment information (the service is free during beta).
4. How we use data
- Authenticate users and keep accounts secure.
- Persist and retrieve your notes and projects.
- Generate markdown import/export zip archives on request.
- Respond to support tickets you submit.
- Generate aggregated, anonymised product metrics for the Scriptorium team (e.g. total note count, daily active users). No individual note content is exposed in these metrics.
5. Data retention and deletion
Your content stays in the application database until you delete individual items or remove your account entirely.
- You can delete any note or project at any time from within the app.
- To permanently delete your account and all associated data (notes, projects, profile, tickets), go to Profile → Delete account and follow the confirmation steps. This action is irreversible.
- We will honour written deletion requests sent to the contact address below within 30 days.
6. Security
Scriptorium uses Django's built-in security features including CSRF protection, password hashing (PBKDF2), session security, and content-type enforcement. In production, all traffic is served over HTTPS with HSTS enabled. Row-level access control ensures each user can only access their own data.
7. Beta notice
This service is in public beta. Features and data handling may change. We will update this policy if material changes are made and notify users where possible.
8. Contact
For privacy questions or deletion requests: [email protected].