Privacy Policy

Last updated: March 16, 2026

Penpoint is built by Tophat Creative, LLC. We believe your writing is yours — and so is your data. This policy explains what we collect, why, and how you stay in control. By using Penpoint, you also agree to our Terms of Service.

Your Writing Data

Penpoint is a desktop application. All of your projects, characters, notes, and other content are stored locally on your computer. We do not have access to your writing data — no prose, manuscripts, or project files are ever transmitted to our servers.

Diagnostic logs generated on your device may include metadata such as entity names (e.g., a character's name) or navigation paths, but never your actual writing content. These logs remain on your computer unless you choose to share them with us for support purposes.

Optional Community Analytics

Penpoint includes an optional community analytics feature that helps us understand how writers use the app and powers aggregate community statistics (for example, "142 authors writing today"). This feature is disabled by default — it only activates if you explicitly opt in.

If you choose to enable it, Penpoint periodically sends a small anonymous usage report containing:

This data does not include your name, email address, IP address, or any writing content. The device identifier is a randomly generated number with no connection to your identity. Under certain privacy frameworks (such as the GDPR), a persistent pseudonymous identifier may be considered personal data — we treat it accordingly and process it only with your explicit consent.

You can view exactly what data is being sent at any time in Settings > Community & Updates. You can disable analytics at any time — doing so immediately stops all data collection and deletes your historical data from our active systems. Infrastructure-level backups maintained by our hosting provider may retain residual copies for a limited period consistent with their retention policies, after which they are automatically purged.

Aggregate community statistics derived from this data (such as total active authors or total words written) may appear within the app or on the Penpoint website. These statistics only ever represent broad totals and can never identify an individual user.

Website Analytics

Our marketing website (penpoint.app) uses Google Analytics to understand how visitors find and use the site. This collects:

This data is aggregated and anonymous. Google Analytics operates in cookieless mode on our site — no tracking cookies are set on your device. We use this data to understand which features interest writers most and how to improve the site. The legal basis for this processing is our legitimate interest in understanding how visitors use our website (GDPR Article 6(1)(f)). Google's privacy policy applies to this data collection: policies.google.com/privacy.

We also track anonymous aggregate click counts on certain website buttons (such as download and purchase buttons) to understand how visitors interact with the site. This tracking stores only a daily total count per button type — no cookies, identifiers, or personal information are collected or stored.

Auto-Update Checks

Penpoint periodically checks for new versions by contacting GitHub's servers. This is a standard HTTPS request that may transmit your IP address to GitHub. No personal data or usage information is included in these requests.

Discord Rich Presence (Optional)

Penpoint includes an optional Discord Rich Presence feature that displays your writing activity in your Discord profile status (e.g., "Working on Characters" or "Working on the Manuscript"). This feature is disabled by default and only activates if you turn it on in Settings > Community & Updates.

When enabled, Penpoint communicates directly with the Discord desktop app running on your computer using Discord's local IPC protocol. The only information shared is:

No writing content, character names, project titles, or personal information is ever shared. The communication happens entirely on your device between Penpoint and the Discord desktop app — no data is sent to Penpoint's servers. Discord's own privacy policy governs how Discord handles your presence status once it is displayed.

You can disable this feature at any time in Settings, which immediately stops all presence updates. The Discord desktop app must be running for this feature to work.

Email & Support

If you contact us at support@penpoint.app, we'll have your email address and whatever you include in your message. We use this only to respond to you and won't share it with anyone.

Data Retention

Community analytics data is retained for up to 18 months, after which it is automatically deleted. If you opt out of community analytics, all of your data is deleted from our servers immediately.

We do not retain website analytics data ourselves — Google's retention policies apply to that data. Support correspondence is retained for up to 24 months after the inquiry is resolved, then deleted. You may request earlier deletion of your support correspondence at any time by contacting us.

Data Security & Location

Community analytics data is transmitted over HTTPS (TLS) and stored on Supabase infrastructure hosted in the United States. The underlying database uses AES-256 encryption at rest. For users in the EEA or United Kingdom, data is transferred to the United States under Standard Contractual Clauses.

Third Parties

We do not sell your data. We do not share it with third parties except as described below, where services process data on our behalf to operate Penpoint:

Only Tophat Creative, LLC has access to the raw community analytics data stored in Supabase. No other individuals, contractors, or services have access.

Your Rights

Regardless of where you live, you have the right to:

If you are located in the European Economic Area (EEA) or United Kingdom, you also have rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection authority. The legal basis for processing community analytics data is your explicit consent (opt-in).

Children's Privacy

Penpoint is a general-purpose writing tool. It is not directed at children under the age of 13 (or 16 in jurisdictions where GDPR applies). We do not knowingly collect personal information from children. If a parent or guardian becomes aware that their child has opted into community analytics, they may contact us at support@penpoint.app to have the data deleted, or simply disable the feature in the app.

Business Transfers

In the event that Tophat Creative, LLC or Penpoint is acquired, merged, or sold, anonymous community analytics data may be transferred to the successor entity. Any such transfer will remain subject to the commitments made in this privacy policy. If a new owner materially changes how your data is handled, we will notify users through the app or this policy before those changes take effect.

Changes

If this policy changes, we'll update the date at the top and, for material changes, notify users within the app. For any questions, reach us at support@penpoint.app.