Your essays are yours.

What we collect

• Account info from your sign-in provider. Your name and email address, received from Microsoft or Google when you sign in (details below).
• Essay content. The drafts, versions, notes, and review feedback you create in the product.
• Profile info. Optional details (grade level, interests, target colleges, background) you provide to personalize theme generation.
• Billing metadata. Subscription status, plan, and renewal dates. Payment details (card number, billing address) are handled by Stripe — we never see or store your card.
• Usage and diagnostic data. Standard server logs (request paths, error traces, response times) used to keep the service running and debug issues, plus aggregated analytics (page views, feature usage) via Google Analytics and Microsoft Application Insights.

Sign-in with Microsoft

When you sign in with Microsoft, we receive the following information from Microsoft's OAuth service:

• Your display name (e.g., "Jane Smith")
• Your email address (or User Principal Name)
• A stable account identifier (object ID) used to recognize you on return visits

We use this information solely to:

• Create and identify your EssayStory account
• Display your name in the app UI (e.g., "Welcome back, Jane")
• Send transactional emails related to your account (billing receipts, password-less sign-in confirmations) if applicable

We request only the openid, email, and profile permissions. We do not request, receive, or access any other Microsoft service data, including OneDrive, Outlook mail, Calendar, Contacts, Teams, or your organization's directory.

Sign-in with Google

When you sign in with Google, we receive the following information from Google's OAuth service:

• Your display name
• Your email address
• A stable Google account identifier (the sub claim) used to recognize you on return visits

We use this information solely to:

• Create and identify your EssayStory account
• Display your name in the app UI
• Send transactional emails related to your account

We request only the openid, userinfo.email, and userinfo.profile scopes. We do not request, receive, or access any other Google service data, including Google Drive, Gmail, Google Calendar, Google Contacts, YouTube, Photos, or any other Google APIs.

EssayStory's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer, sell, or use this data for advertising or other unrelated purposes, and we do not allow humans to read it except where we have your explicit consent, where necessary for security purposes (e.g., investigating abuse), or to comply with applicable law.

How we use your essay content

• Storage. We store your essays, versions, and notes in our database so you can return to them across sessions and devices.
• Review generation. When you explicitly request an AI review of a version, the text of that version is sent to our language-model provider (currently Microsoft Azure OpenAI Service) solely for the duration of generating your review. Azure OpenAI processes the content under Microsoft's data protection terms and does not use it to train any models.
• Inline suggestions. Suggestions are generated as part of the same review request; accepting or rejecting them updates only your own version.
• Nothing else. We do not display your essays to other users, share them with any third party (other than the LLM provider above for reviews you request), or use them for any purpose beyond providing the product to you.

What we don't do

• We do not sell your data — ever, to anyone.
• We do not use your essays, profile data, or sign-in information to train any AI models (ours or any third party's).
• We do not share your essays with anyone except the AI provider that processes reviews you explicitly request.
• We do not run third-party advertising networks or behavioral retargeting on the app.
• We do not access any data from Microsoft or Google services beyond your name and email.
• We do not let humans read your essays except where you explicitly request support that requires it, or where required to investigate abuse or comply with applicable law.

Third-party processors we use

To operate EssayStory we rely on the following service providers. Each is contractually required to handle your data only on our instructions:

• Microsoft Azure — web hosting, database (Cosmos DB), AI inference (Azure OpenAI Service), application monitoring (Application Insights).
• Microsoft Entra (Azure AD) — "Sign in with Microsoft" provider.
• Google — "Sign in with Google" provider; Google Analytics (aggregated usage data).
• Stripe — payment processing. Stripe receives your card and billing details directly; we receive only a customer ID and subscription status.

Cookies and tracking

EssayStory uses cookies only for essential functionality:

• An authentication cookie set when you sign in, so you stay signed in across sessions.
• Anti-forgery and session cookies used by the application framework.
• Aggregated analytics cookies set by Google Analytics and Microsoft Application Insights to help us understand which features are used. These do not identify you personally and can be blocked by your browser's "Do Not Track" settings or an ad-blocker without affecting the app's functionality.

We do not use cookies for behavioral advertising or cross-site tracking.

Data retention

• Active accounts: Your essays, versions, and profile data are retained for as long as your account is active.
• Cancelled subscriptions: If you cancel your subscription but do not delete your account, your data remains available so you can resume later. After 24 months of account inactivity (no sign-ins), we will email you and then delete the account if you do not respond.
• Deleted accounts: When you request account deletion, your essays and profile data are deleted within 30 days. Billing records required for tax and accounting purposes are retained as required by law, typically up to 7 years.
• Server logs: Diagnostic logs are retained for up to 90 days, then deleted.

Your rights and how to exercise them

• Access & portability. You can view all your essays directly in the product. To request a machine-readable export of your data, email support@essaystory.com.
• Correction. You can edit your profile data anytime from the Profile page.
• Deletion. You can delete individual essays and versions from the product UI. To delete your entire account and all associated data, email support@essaystory.com with the subject "Delete my account" — we will confirm and complete the deletion within 30 days.
• Subscription management. You can manage or cancel your subscription anytime through the Stripe Customer Portal linked from the Billing page.
• Withdraw consent. Disconnecting your Microsoft or Google sign-in does not delete your EssayStory account. To remove EssayStory's access from the provider side, visit your Microsoft account settings or Google account permissions.

Children's privacy

EssayStory is intended for users who are at least 13 years old (or the equivalent age of consent in your jurisdiction). We do not knowingly collect data from younger children. If you believe a child under 13 has created an account, please contact support@essaystory.com and we will delete the account promptly.

International users

EssayStory is operated from the United States. By using the product, you understand that your data may be processed in the United States and other countries where our service providers operate. We rely on industry-standard safeguards (including the Microsoft Azure data protection terms and the Stripe Data Processing Agreement) when data is transferred outside your home jurisdiction.

Changes to this policy

We will update this page when our practices change. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced via an in-app notice and, where appropriate, an email to your account address.

Contact

Questions about privacy, requests to delete your data, or anything else? Email support@essaystory.com. See our Support page for response-time expectations.