Privacy Policy
Last updated: 23 July 2026
This policy explains what Typetoe collects, why, and what you can do about it. It covers the Typetoe web app at app.typetoe.com and the Typetoe app for iOS.
We built Typetoe as a place to keep unfinished writing. That only works if you trust it, so the short version is this: your writing is yours, we do not sell it, we do not use it to train AI models, and it leaves our systems only when you ask for something that requires it.
1. Who we are
Typetoe is operated by Manuel Masia ("we", "us"), Via Luigi Galvani 15, 47843 Misano Adriatico (RN), Italy. VAT number: IT04298960404.
For anything in this policy — including a request to see or delete your data — write to feedback@typetoe.com.
2. What we collect
Your account. Sign-up and sign-in are handled by Clerk. Depending on how you register, this means your email address, your name if you provide one, and an identifier from Google or Apple if you use those. If you sign in with Apple and choose Hide My Email, we only ever see Apple's private relay address — that is fine, and everything works normally.
What you write. Projects, documents and folders, saved versions, the cards of the Editorial Desk (characters, locations, charter rules, checklist items), annotations, bibliography entries, writing goals, and your conversations with the assistant. This is content you create; we store it so the app can give it back to you.
AI usage records. For each AI request: the provider and model used, which feature triggered it, the number of tokens consumed, and an estimated cost. We use this to enforce plan limits and the free preview budget. It records that a request happened and how large it was — not a copy of the text.
Technical and diagnostic data. Standard server logs, error reports through Sentry when something breaks, and aggregate traffic measurement through Vercel Analytics. We also record a small number of product events (an account was created, a card was reviewed, writing happened on a given day) through PostHog, keyed to your account identifier rather than your name or email.
Optional connections. If you connect Dropbox for backups, we store your Dropbox account email and an encrypted refresh token so scheduled backups can run. You can disconnect at any time.
Your own AI keys. If you bring your own API key for an AI or search provider, that key is kept in your browser's local storage. It is sent with a request only to make that request on your behalf, and it is never written to our database.
3. Why we process it, and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and storing your work | Performance of a contract |
| Sending service emails (welcome, account notices) | Performance of a contract |
| Enforcing plan limits and the free AI preview budget | Performance of a contract |
| Keeping the service secure and diagnosing faults | Legitimate interests |
| Understanding which features get used | Legitimate interests |
| Any future marketing email | Consent — asked for separately, withdrawable |
4. Your writing and the AI
Typetoe's AI features are opt-in per action. Nothing is sent to an AI provider because a document merely exists.
When you run a scan, ask the assistant something, or accept a suggestion, the relevant text is sent to the AI provider you have selected. Depending on your setup that is one of: OpenAI, Anthropic, Google (Gemini), DeepSeek, Groq, or xAI. If you use the research tool, the query goes to Tavily, Brave Search, or Exa.
Two arrangements exist:
- Free preview. Requests run on our own provider key, within a capped token budget. The provider processes the text under its own terms as our processor.
- Bring your own key. Requests run on your key and your account with that provider, and your own agreement with them governs the processing.
We do not use your writing to train models, and we do not permit our providers to train on it under the terms we use. We cannot control what a provider does under an agreement you have made with them directly, so if that matters to you, check their settings.
5. Who else processes your data
We keep the list short on purpose. Every one of these acts as a processor under contract, and none of them receives your data to use for their own purposes.
| Service | What it handles | Where |
|---|---|---|
| Clerk | Authentication and account records | United States |
| Neon | The database holding your content | United States (us-east-1) |
| Vercel | Hosting, delivery, aggregate analytics | United States / global edge |
| Resend | Sending service emails | Ireland (eu-west-1) |
| AI providers | Text you submit to an AI feature | Varies by provider |
| Search providers | Research queries you run | Varies by provider |
| Sentry | Error diagnostics | European Union |
| PostHog | Product usage events | European Union |
| Dropbox | Backups, only if you connect it | United States |
6. Transfers outside the EEA
Some of the services above are based in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, and where applicable on the EU–US Data Privacy Framework. You can ask us for details.
7. How long we keep things
Your content stays until you delete it. Deleting a project moves it to Trash, where it remains recoverable until you empty the Trash — at which point it is removed from the live database.
If you close your account, we delete your content within 30 days. Backups and system logs may retain copies for a short period after that before rotating out. AI usage records are kept in aggregate for billing and abuse prevention.
If you have connected Dropbox, archives already written to your own Dropbox are yours and stay there; deleting your Typetoe account does not remove them.
8. Your rights
Under the GDPR you can ask us to: give you a copy of your data, correct it, delete it, restrict or object to how we process it, or hand it over in a portable format. You can also withdraw any consent you have given.
Three of these you can exercise yourself, immediately, without asking us:
- Export. Any project can be exported as an archive from the app, at any time.
- Deletion. Delete a project, then empty the Trash.
- Closing your account. Your account settings have a Security section with Delete account. This removes your account and, with it, your projects, documents, cards, chats, settings, and any Dropbox connection.
For anything else, write to feedback@typetoe.com. We will respond within one month. If you believe we have handled your data badly, you may complain to your national data protection authority.
9. Security
Traffic is encrypted in transit. Passwords are never handled by us — Clerk manages authentication. The Dropbox refresh token is encrypted at rest with AES-256-GCM. Your own AI keys are not stored on our servers at all.
No system is perfect. If you find a security problem, please tell us at feedback@typetoe.com before telling anyone else, and we will work with you.
10. Children
Typetoe is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created an account, write to us and we will remove it.
11. Emails we send
We send service emails: a welcome message when you register, and notices about your account or the service. These are part of providing Typetoe, so they have no unsubscribe link — closing your account stops them.
We do not send marketing email. If we ever start, it will be opt-in, separate from your account, and unsubscribable in one click.
12. Cookies
We use essential cookies only: a session cookie set by Clerk to keep you signed in, and a small preference cookie remembering your chosen language. There are no advertising or tracking cookies, and our analytics run server-side or without cookies — which is why you are not asked to dismiss a consent banner.
13. Changes
If we change this policy we will update the date at the top, and for anything material we will tell you in the app before it takes effect.
14. Contact
This policy is written in English. Any translation is provided for convenience; the English version prevails.
Last updated 23 July 2026.