Your Documents

• The documents you write are saved in your browser (IndexedDB / localStorage). We don't store them on the Writebox server.
• If you connect Dropbox, Google Drive, OneDrive, or Box, your documents are saved to your own cloud storage. When you save or open a file, the request passes through the Writebox server to the API of that service, but the server does not store or log the contents of your documents.
• We don't read your file contents, we just convert the file encoding to show characters correctly.

Cloud Storage Connections

• We don't store your Dropbox, Google Drive, OneDrive, or Box password. (We don't have access to this information.)
• When you connect a cloud storage service, we store the following on the Writebox server (Google Cloud Datastore):
  • The access token issued by that service (stored encrypted).
  • The e-mail address of that account, so you can see which account is connected.
• For Google Drive, Writebox uses the drive.file permission, which only allows access to files you select and files created by Writebox.

Accounts

A Writebox account is optional. If you sign in, we use Firebase Authentication (Google) to sign you in with your Google account or with a link sent to your email. We store on our servers (Google Cloud Datastore): your account ID, email address, display name and profile photo URL (if provided by Google), sign-in times, and which browsers are signed in to your account (the browser's session key).

We use this information only to sign you in, to provide the Supporter Plan, and to contact you about your account or subscription. We do not use it for advertising.

Supporter Plan and Payments

Payments for the Supporter Plan are processed by Link (Stripe). For customers outside Japan, Link, LLC is the seller of record. You enter your card and billing details on Link's checkout page; we never receive or store your card number.

We receive and store: your Stripe customer ID, subscription ID, plan (monthly or yearly), subscription status, current billing period, and whether cancellation is scheduled. We use this only to provide the Supporter Plan (for example, to stop showing ads).

Link's privacy policy applies to the information you give at checkout: https://link.com/privacy

Collection and Use of Google User Data

• When you connect Google Drive, our application collects the email address associated with your Google account for the sole purpose of showing which Google account is connected to Writebox.
• We do not use your email address for any other purposes, and we do not share this information with third parties.
• Writebox's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• We do not use Google user data to serve ads or for advertising-related analysis.

Cookies and Browser Storage

Writebox uses the following cookies:

• sessionkey: An identifier that links your cloud storage connections to this browser. It expires after 30 days.
• A temporary cookie used only while connecting Dropbox: Used to protect against cross-site request forgery (CSRF). It expires after 1 hour.

Writebox also stores the following in your browser's localStorage. This information is not sent to the Writebox server, but related events are sent to the analytics tools described below.

• Your settings (such as font and theme).
• Your file history.
• Which ad display pattern you are shown.
• When you closed the support banner.
• Whether you asked to be notified about the supporter plan.
• wb_signed_in: Remembers that this browser is signed in, so the sign-in code is loaded only when needed.
• wb_plan: Remembers that you are a Supporter (with an expiry), so ads are not shown while offline.
• wb_email_for_sign_in: Keeps the email you entered until you open the sign-in link (removed after sign-in).
• How often an ad has been shown, and the day you closed the Supporter Plan banner, so ads are shown only occasionally.

If you sign in, Firebase Authentication keeps you signed in on this browser using IndexedDB.

Cookies used by analytics and advertising services are described in the following sections.

Analytics

• Google Analytics 4 (Google): We use Google Analytics on Writebox and on this website to understand how they are used. Google Analytics uses cookies. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• PostHog (PostHog Inc., servers in the United States): We use PostHog to understand how features are used and to find errors in Writebox. PostHog uses cookies and localStorage. We send events about your actions (for example, starting to write, saving a file, or changing a setting), together with information such as your browser, screen size, and approximate country. We do not send the text of your documents or your file names.
• If you sign in, we link your analytics data to your account ID (not your email address) so that we can understand how the Supporter Plan is used.

Advertising

Writebox shows a single ad in the margin of the screen to some visitors (some new visitors on desktop computers) using Google AdSense.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to Writebox or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to Writebox and/or other sites on the Internet.
• You may opt out of personalized advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalized advertising by visiting www.aboutads.info.
• For more information about how Google uses data from sites that use its services, see How Google uses information from sites or apps that use our services.
• We currently do not show ads to visitors from the European Economic Area (EEA), the United Kingdom, or Switzerland. If we show ads to these visitors in the future, we will use a Google-certified consent management platform that lets you consent, decline, or manage your options.
• We check whether an ad blocker is in use in order to estimate the number of ads displayed. The result is sent to the analytics tools described above. We do not use it to identify you.

Information Sent to Third Parties

The following services receive information from your browser when you use Writebox or this website.

Server Logs

• Google App Engine's standard access logs (such as IP address, URL, and date and time) are stored in Google Cloud for 30 days. We use them to prevent abuse and to investigate problems.

Data Protection Mechanisms

We are committed to protecting the security of your personal data. We implement the following measures to ensure your data is secure:

• Encryption: All data transmitted between our app and our servers is encrypted using HTTPS to prevent unauthorized access during transmission. Access tokens for cloud storage services are stored encrypted.
• Access Controls: Only the developer can access data stored on the server, and only to operate and maintain Writebox.
• Data Storage: Your user data are stored in secure environments that are protected against unauthorized access, disclosure, or misuse.

Data Retention and Deletion

We retain your user data only for as long as necessary to fulfill the purposes outlined in this policy.

• Cloud Storage Connections: When you disconnect a service, the link to this browser is removed. When no browser remains linked, the access token and e-mail address are deleted.
• Browser Storage: Documents, settings, and file history saved in your browser remain there until you delete them, for example by clearing your browser's site data.
• Accounts: You can delete your account at any time from the Writebox menu (Delete Account). This deletes your account information from our servers and from Firebase Authentication, and ends your Supporter Plan. We keep records of payments and subscriptions (not card details) for as long as required by tax and accounting laws.
• User Control: You have the right to delete your user data at any time. If you need assistance with deleting your data, please contact us at support@writeboxapps.com.

Transfer of the Service

If Writebox is transferred to another operator (for example, if the developer incorporates a company or transfers the business), your account and subscription information may be transferred to the new operator, who will continue to protect it under this policy. We will notify you before the transfer.

Changes to This Policy

• We may update this policy as Writebox changes, for example when we add features that handle personal information.
• The date of the latest update is shown at the top of this page.

Contact

Writebox is operated by Bluearc Consulting Inc. (4-20-3 Ebisu, Shibuya-ku, Tokyo 150-6018, Japan), a company in Japan. Writebox was originally developed and operated by Kazuhiro Shibuya (shibuyak) as an individual developer, and its operation, including the handling of your information, has been taken over by Bluearc Consulting Inc., of which he is the representative.

If you have any questions about this policy or your data, please contact us at support@writeboxapps.com. You can also reach the developer on X (@shibuyak25).