Published privacy notice · Updated 10 October 2026
Application Privacy Policy
Effective and last updated 10 October 2026 for The Novelist 0.1.22. This policy covers the desktop application, not the website or independently operated providers.
Operator and contact
The Novelist is independently developed by Panos Sakalakis (Panagiotis Sakalakis), based in Greece. For privacy requests, email info@panossakalakis.com or use https://panossakalakis.com/contact/. Do not send a license token, API key or an entire manuscript with an initial request.
Panos is responsible for processing he operates, including licensing and support. Your chosen AI, payment and hosting providers have their own responsibilities and policies.
Writing and local storage
Books, manuscripts, notes, research, comments, entities, connections and progress are stored in your local workspace and SQLite database. Media and backup files may also be stored in the workspace. Settings, license state, AI configuration and caches use separate local application storage. No Novelist cloud account or manuscript sync service is required.
Use Settings to identify the active workspace rather than assuming every installation uses the same folder. Application installers are not your library. A folder you place in a third-party sync service follows that service's rules. Do not delete an unfamiliar workspace to troubleshoot an update.
Offline features and network connections
Core writing, Story Bible, notes, preview and local exports work without an internet connection, subject to feature entitlements. Network requests are separate: updates, license activation/verification, opted-in analytics, configured AI services and links you choose to open.
Some update and license checks occur in the background. Local signature validation exists, but offline Pro access is subject to the licensing contract and verification/grace rules; it is not a promise of perpetual offline access.
Optional usage analytics
Usage analytics are disabled by default. Choose whether to enable them in Settings → Privacy. Turning them on takes effect at the next launch when the SDK initializes; turning them off blocks new app-originated events immediately. Withdrawal does not undo already transmitted requests or automatically erase historical statistics.
The app's main-process gate checks consent and readiness before sending validated app events to Aptabase's EU endpoint. Events describe startup, onboarding, feature categories, export format and generic failure category, local/cloud AI use, and update version. No persistent user/device identifier is deliberately included in those event properties.
Analytics metadata and limitations
The installed SDK attaches a temporary session identifier, timestamp, locale, operating-system name/version, Chromium engine name/version, application version, SDK version and debug-build flag. The SDK replaces the session identifier after more than one hour of inactivity; it is not a persistent installation identifier.
Validated analytics events exclude manuscript text, titles, entity names, notes, research, comments, search/mention queries, AI prompts/responses, license/customer identity, API keys and file paths. Network transport still exposes technical metadata to the recipient. Aptabase's published policy describes a server-side identifier based on IP address/user agent and a daily rotating salt, and analytics retention up to five years. These service practices are distinct from the temporary SDK session ID; do not interpret 'anonymous' UI wording as a guarantee of no IP processing. See https://aptabase.com/legal/privacy.
Updates
Update checks request public version/download information from the distribution service; the server can receive IP address, request time and network headers. Windows supports the existing automatic-update flow. macOS and Linux AppImage updates use manual downloads. Backup checks occur before supported automatic installation.
Installing the app should preserve the separate workspace, but no software can guarantee freedom from data loss. Keep independent backups. Update requests do not contain manuscript content. Hostinger serves distribution and licensing; technical requests can be logged. Hosting account locations and all log settings have not been independently verified; no zero-logging or EU-only guarantee is made.
Pro licensing
Activation and verification send the signed license token, installation ID, platform, device name and app version to the License API. A token may contain customer/license identity, issue/expiry dates, plan and version. Local license state is stored in the application-wide license store, not solely in a book workspace.
The Hostinger-hosted licensing service records licenses and associated installations/activations to enforce validity and device slots and support renewals/reissues. License processing is separate from analytics. Relevant administrative access and hosting logs/backups support operation; not every access or provider setting has been independently verified. Removing the local license is not a request to delete purchase/accounting records.
Local and cloud AI
AI runs only through a provider you configure and requests you initiate. A local Ollama or LM Studio endpoint can process prompts on your computer, but a remotely hosted endpoint, even one labelled local in configuration, sends data over the network. Downloading models is governed by the model service. Do not assume every custom endpoint is private.
Cloud requests send your prompt and selected context, which may include manuscript excerpts, structure, entities, notes, research, style information and opted-in Story Memory. Book context uses structure and selected excerpts, not necessarily the complete manuscript. Review scope and memory controls before sending sensitive writing. Providers may process API keys, IP addresses, usage and request content under their own terms; a Pro license does not include provider billing.
Settings, keys and device security
AI configuration is local. API-key protection uses the existing platform secure-storage mechanism where available, with a plain-text local fallback when secure storage is unavailable; it is not an unconditional encryption guarantee. Protect your user account, devices and backups. Do not publish configuration files or tokens.
The workspace is not represented as an encrypted vault. Operating-system permissions and your own encryption/backup choices matter. No payment details are collected in the app; purchases and donations open the chosen service in your browser.
Errors, logs and support
The inspected app does not configure an automatic third-party crash-reporting service. Local/runtime logs and error messages may contain technical details. Do not assume a log file is anonymous. Review and redact diagnostics, paths, names, tokens and writing before voluntarily sending support information.
If you contact Panos, the message, contact details and attachments are processed to answer and investigate your request. Contact Form 7 runs on the separate WordPress Contact page and received email is read through Hostinger Webmail. Additional storage/SMTP plugins and all administrator access have not been independently verified; no promise of a single email copy is made. Send minimal information and fictional reproduction examples. Provider infrastructure may involve international processing; see the Website Privacy Policy for the separate Contact page and its observed integrations.
Backups, exports, retention and deletion
You control local workspaces, backups and exports. They remain until you or your tools remove them; uninstalling the app need not remove these files. Deleting an entity is not the same as deleting copies in backups, exports or synced folders. Restoring a backup can replace current workspace data: preserve a fresh copy first.
Current practice: support messages, server logs, customer/license records and server backups have been kept for at least two years and may remain indefinitely; a maximum period and automatic deletion procedure have not yet been verified. Planned improvements, approved on 10 October 2026 but not yet operational: support messages 24 months after case closure; routine logs 30 days; operator-controlled backups at most 90 days; license administration records while needed for the license plus 24 months afterward. Required accounting records and documented legal holds are separate. These planned limits are not a promise that existing records are already being deleted on that schedule. Contact info@panossakalakis.com about a specific record or deletion request; necessary legal or service obligations may limit deletion. Provider-controlled records follow the relevant provider terms. Panos cannot remotely erase files held only on your computer.
Purposes, rights and policy changes
Pro/purchase administration supports performance of the service contract, optional app analytics rely on consent, support/security may rely on legitimate interests and accounting duties on legal obligations. Provider responsibilities and transfer safeguards depend on the actual service/account; no blanket GDPR certification or EU-only processing guarantee is made.
Where applicable, you may request access, correction, erasure, restriction, portability or object to processing, and withdraw consent without affecting earlier lawful processing. Some requests are limited by legal duties or inability to identify nonpersistent analytics records. You may complain to the Hellenic Data Protection Authority, https://www.dpa.gr/, or your relevant authority. Contact Panos through the contact page. Material changes will be reflected in the policy date; the website policy separately explains website processing.