Privacy Policy

Last updated: July 5, 2026

Centerdraft ("we", "us", "our") is a story-structuring tool for creators. This policy explains what personal data we collect, why we collect it, how we handle it, and the rights you have — wherever in the world you use Centerdraft.

1. Who we are (data controller)

Centerdraft is operated as a sole proprietorship registered in Norway, and is the data controller for the personal data described in this policy. If you have questions about this policy or your data, contact us via our contact form.

2. Using Centerdraft without an account

You can use the planner without signing in. In that case your projects are stored only in your own browser (localStorage) — they never leave your device, and we have no copy of them. Clearing your browser data will delete them. If you later sign in, your local projects are merged into your account so they can sync across devices.

3. What data we collect

Account data: your email address when you sign up. We use passwordless sign-in links, so we never store a password.
Project data: the content you create and save in Centerdraft while signed in (project names, blocks, notes, durations, layers).
Payment data: if you upgrade to Pro, payment is processed by Stripe. We never see or store your card details. We receive limited billing information from Stripe (e.g. subscription status, country, last four card digits) to manage your subscription and comply with tax rules.
Usage data: aggregated, anonymous analytics (page views, session counts) via Plausible Analytics. No cookies, no personal identifiers, no cross-site tracking.
Support data: if you email us, we keep the correspondence so we can help you.

We do not collect sensitive categories of data, we do not build advertising profiles, and we do not use your content to train AI models.

4. Why we collect it, and our legal bases

Under the GDPR (and UK GDPR), we rely on the following legal bases:

Performance of a contract (Art. 6(1)(b)) — providing the service: your account, saving and syncing projects, processing your subscription, and sending transactional emails such as sign-in links and payment receipts.
Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse, and understanding overall usage through anonymous, aggregated analytics.
Legal obligation (Art. 6(1)(c)) — keeping accounting and tax records of payments as required by law.
Consent (Art. 6(1)(a)) — anything optional, such as marketing emails. We do not send marketing emails without your consent, and you can withdraw consent at any time.

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

5. Where data is stored and international transfers

Your account and project data is stored with Supabase on servers in Frankfurt, Germany (EU). Some of our sub-processors are based in the United States. Where personal data is transferred outside the EU/EEA or the UK, we rely on the EU–US Data Privacy Framework (and its UK extension) and/or the European Commission's Standard Contractual Clauses as the transfer mechanism.

6. Data sharing and sub-processors

We do not sell your personal data, and we do not "sell" or "share" personal information as those terms are defined in the California Consumer Privacy Act (CCPA/CPRA). We share data only with the sub-processors needed to run the service, each bound by a data processing agreement:

Supabase — database and authentication (EU region: Frankfurt)
Vercel — website and app hosting (US)
Stripe — payment processing on the web (US; EU–US Data Privacy Framework certified)
Apple — payment processing for in-app purchases in our iOS apps (Apple is the merchant of record and never shares your card details with us)
RevenueCat — in-app purchase management for our mobile apps (US; processes an app user ID and purchase status, not payment details)
Plausible Analytics — cookieless, privacy-friendly analytics (EU)

We may also disclose data if required to do so by law, or to protect our rights, users, or the public, and only to the extent legally required.

7. Data retention

Account and project data is kept for as long as your account is active. If you delete your account, all your data is deleted within 30 days.
Payment and invoicing records are kept longer where accounting and tax law requires it (up to five years under Norwegian bookkeeping rules).
Support emails are kept as long as needed to handle your request and for a reasonable period afterwards.

8. Your rights

If you are in the EU/EEA, UK, or Switzerland

You have the right to access, correct, delete, and export (data portability) your personal data, to restrict or object to processing, and to withdraw consent at any time where processing is based on consent. To exercise these rights, contact us via our contact form — we respond within one month. You can also delete your account and all associated data yourself at any time from your account settings.

You also have the right to lodge a complaint with a supervisory authority — in Norway, that is Datatilsynet (datatilsynet.no); elsewhere, your local data protection authority.

If you are in California or another US state with a privacy law

Depending on your state (including under the CCPA/CPRA in California and similar laws in states such as Virginia, Colorado, Connecticut, and Texas), you have the right to know what personal information we collect, to access, correct, and delete it, and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We will never discriminate against you for exercising your rights. To exercise them, contact us via our contact form; you may use an authorised agent where your state's law allows it.

Everyone else

We extend the same core rights — access, correction, deletion, and export — to all users worldwide, regardless of where you live. Contact us and we will help.

9. Cookies and local storage

Centerdraft does not use tracking or advertising cookies. We use:

localStorage in your browser — strictly necessary, to save your projects locally, remember your preferences, and keep you signed in.
Plausible Analytics — cookieless and anonymous.
Stripe — may set strictly necessary cookies during checkout for payment security and fraud prevention.

Because we use no non-essential cookies or trackers, no cookie consent banner is required.

10. Security

All data is encrypted in transit (TLS) and at rest. Access to production data is restricted and sign-in is passwordless (magic links), which removes password-theft risk. In the unlikely event of a data breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay if the breach is likely to put your rights at risk.

11. Children

Centerdraft is not directed at children. You must be at least 13 years old to use the service (16 in the EU/EEA where local law sets that age for consenting to data processing). We do not knowingly collect personal data from children below these ages; if you believe a child has provided us personal data, contact us and we will delete it.

12. Changes to this policy

If we make material changes, we will notify you by email (if you have an account) before they take effect. The "last updated" date at the top always reflects the latest version.

Questions? Contact us · Terms of Service