Privacy Policy
Effective date：2026-09-11 Last updated：2026-10-22
Narracore (narracore.cn) is a writing and narrative-analysis workbench for screenwriters. This policy explains how we handle your personal information: what we collect, why, where it lives, how long we keep it, and what rights you have.
The principles behind this policy are the same as the product itself: your writing belongs to you. We never use your scripts to train models, never show them to other users, never sell your information, and we run no advertising or behavioral tracking in this product.
This policy is published in Chinese, English, and Japanese with substantively identical content; in case of divergence, the Chinese version prevails.
1. Who we are
The operator of this service (data controller) is the Narracore project (an individual developer based in Shanghai, China). The site is ICP-registered in China (沪ICP备2026043904号-1).
Privacy contact: huiyicd@foxmail.com. GDPR-related matters can also be addressed to this mailbox; we have not appointed an EU representative or DPO because we are a very small operation and do not engage in large-scale monitoring.
2. What we process, why, and for how long
We only process what is necessary to provide the service. The purposes, categories, retention, and legal bases are itemized below:
Account registration
When you create an account we collect your email address and store a cryptographic hash of your password (bcrypt; we can never see your plaintext password).
Purpose: create and secure your account and sync your projects after sign-in. Legal basis (GDPR): performance of a contract (Art. 6(1)(b)); (PIPL): necessity for contract formation/performance (Art. 13). Retention: for the life of your account.
Phone numbers and third-party sign-in (pre-disclosure): we plan to support phone-number verification and third-party sign-in (e.g. WeChat, QQ) in the future. When enabled, we will collect the phone number or third-party platform nickname/unique identifier you authorize, used solely for sign-in and account linking; the phone number also supports identity verification required under Chinese law. Email-only registration remains fully usable without providing any of the above.
Terms acceptance records: when you confirm this Privacy Policy at sign-up or sign-in, we record the acceptance time and terms version to evidence your consent. This record is immutable; retention: for the life of your account.
Your creative content
Content you write and save in the editor: projects, screenplay text, version history, storyworld records (characters/locations/props), and the deterministic statistics you explicitly request (word counts, dialogue ratio, etc.).
Purpose: storing, displaying, and editing your work (the core service). Legal basis: performance of a contract. Retention: for the life of your account or until you delete it; version history keeps at most 200 versions per project, automatically trimming the oldest.
Please do not enter other people’s sensitive personal information (e.g. ID numbers, health data, financial accounts) into your projects. You decide what to write; we do not actively screen content for such data.
Display preferences and settings
Editor display preferences (e.g. ruled-line toggle, block-icon style) and similar settings.
Purpose: remembering your working environment. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — a continuous, consistent experience. Retention: for the life of your account.
Guest mode (no sign-in) on-device data
When you write without an account, your draft and display preferences are stored only in your own browser (localStorage) and are never sent to our servers. Clearing browser data deletes them; when you register or sign in, you may choose to migrate the draft into a cloud project.
Session cookie and server logs
After sign-in we set one strictly-necessary first-party cookie (__Host-narracore_session, HttpOnly) to keep you logged in. Our servers keep minimal operational logs (request time, path, error summaries) for security auditing and troubleshooting, retained for no more than 6 months (China’s Cybersecurity Law requires at least 6 months).
Purpose: maintaining your session and keeping the service secure. Legal basis: performance of a contract + legitimate interest (secure operation).
3. Your writing is never used for training — our explicit promise
Your project data (scripts, settings, everything you create) never enters any global knowledge base, is never shown to other users as examples, and is never used by us to train any model.
The AI features (rolling out gradually) send the relevant text to the model provider configured on our servers (currently Alibaba Cloud Bailian, located in mainland China) for a single processing run in these cases: when you start a scene analysis, a multi-scene or whole-project analysis, a consistency check, or an emotion analysis from the analysis hub — the text of the selected scope; and when you use AI cleanup in screenplay import — the full imported draft. Results are returned only to you.
Transmission and retention, stated plainly: your text reaches the provider over encrypted connections, and the provider’s official statement is that data in transit is encrypted with AES-256. As required by applicable laws and regulations, the model provider stores the data generated by model calls — Alibaba Cloud Bailian publicly promises that “your data will never be used for model training”; the exact data-processing terms are governed by the Alibaba Cloud Bailian Service Agreement. We do not build, and do not promise, any automatic deletion mechanism beyond the provider’s agreement.
The data is yours: take any work away anytime via “Print / Export PDF”, export everything in your account as JSON in one click from the settings page, and when you close your account we delete it module by module and verify zero residue (how to exercise these rights: Section 7).
The AI never rewrites your text on its own — every suggestion follows the flow "generate suggestion → show the diff → you confirm → only then it is written".
6. Storage location and cross-border transfer
Your account and creative data are stored in Alibaba Cloud’s Hangzhou facilities in mainland China. We do not proactively transfer your personal information outside China.
If you access the service from outside China, your data travels over an encrypted connection (HTTPS) between you and the China-based servers — this is remote access initiated by you, not a transfer of your personal information abroad by us.
If we launch an international site or engage overseas processors in the future, we will update this policy first; any cross-border provision of China users’ personal information will be disclosed and subject to separate consent as required by law.
7. Your rights and how to exercise them
Wherever you are, we honor the same standard of rights:
- Access and copy: after sign-in you can view all your projects and records in the interface; your script text can always be taken away via "Print / Export PDF".
- Rectification: projects and records can be edited directly in the interface.
- Deletion: you can delete an individual project at any time; to delete your entire account and all associated data (version history, records, statistics, and notification delivery records), email huiyicd@foxmail.com — we will complete deletion within 15 working days after verifying your identity and confirm by reply. Deletion counts as complete only after each module is re-checked to hold no residual data.
- Account closure: handled via the same mailbox; after closure your personal information is deleted or anonymized — including in-app notifications and email delivery records (with the recipient address). Immutable ledger records that accounting and legal duties require us to keep (they contain no manuscript content) are retained in a form detached from you; operational logs that law requires us to retain are deleted when their retention period expires.
- Withdrawal of consent: you may stop using the service and close your account at any time; withdrawal does not affect the lawfulness of processing carried out before it.
- Portability: if you need your projects in a machine-readable format (structured export), contact the mailbox above.
8. Jurisdiction-specific notes
China: under the PIPL you may access, copy, correct, delete, withdraw consent, and request an explanation of our processing rules; if you believe our handling infringes your rights, you may complain to us or report to the authorities (e.g. the CAC channel 12377).
European Union: you have the right to lodge a complaint with your member state’s data-protection authority; we answer requests within one month (extendable by two months for complex ones, with reasons given); exercising rights is free of charge. Withdrawing consent is as easy as giving it (closing your account suffices).
Japan: under the APPI you may request disclosure, correction, suspension of use, or deletion of your retained personal data; in the event of a reportable leak, we will notify the Personal Information Protection Commission (PPC) and inform you as required by law.
United States: we do not sell or share your personal information (including "sharing" in the cross-context behavioral-advertising sense), so no "Do Not Sell or Share" link is required; we will not discriminate against you for exercising your privacy rights (no denial of service, no differential pricing).
9. Security measures and breach response
Our measures include: hashed password storage (bcrypt), HTTPS everywhere, a database reachable only on the internal network with least-privilege per-service roles, all production changes via migrations and audited pipelines, and server access limited to the operator.
If a personal-information security incident may affect your rights, we will take remedial action promptly and notify you and/or the regulator as required by applicable law (72-hour report under the GDPR; report to the PPC and notice to you under Japan’s APPI; statutory notification and reporting duties under Chinese law).
10. Children and minors
This service is intended for adult creators and is not directed at minors under 14 (China), under 13 (United States), or below the applicable age in your jurisdiction. We do not knowingly collect personal information from such minors; if you believe a minor has provided us information, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. Updated versions are posted on this page with a revised "Last updated" date; material changes (new categories of information, changed purposes, new cross-border transfers) will be announced via in-product notice or email before taking effect, and where the law requires fresh consent we will obtain it.
Contact us
For any question, request, or complaint about this policy or your personal information, contact: huiyicd@foxmail.com. We respond within 15 working days (GDPR requests within one month).
Address: Shanghai, China (the Narracore project).