Privacy Policy

Last updated 14 October 2026. This describes how Crestmas Write, operated by Crestmas Hub, handles personal data.

What we collect

• Account data: your name, e-mail address and a salted password hash (we cannot read your password).
• Your documents: text you save, its versions, and your protected phrases and dictionary entries. Text you rewrite without saving is processed in memory and not stored, but usage counts are recorded.
• Usage records: the date, writing mode and length of each rewrite or check, used to enforce plan limits and for aggregate statistics. They do not contain your text.
• Security logs: sign-in and administrative events with a shortened IP address (the last part is removed). Audit logs never contain document text. Rate-limit counters use hashed keys.
• Support messages you send us through the contact form.
• A session cookie that keeps you signed in. We do not use advertising or analytics cookies.

How your text is processed

Rewriting and checking happen on the server using local rules. Your text is not sent to any AI model or rewriting service.

Optional internet check. If the operator has switched it on, the "Check the internet" button looks up a few short excerpts of your text (about 12 words each, at most 5) with an outside search service chosen by the operator (Brave Search, OpenAlex, or Google and Google Scholar results through SerpAPI). It runs only when you press the button and confirm, the rest of your text is not sent, and those services have their own privacy policies. Nothing from the check is stored by this application.

Who else sees data

E-mail for account confirmation and password reset is delivered through the mail service configured by the operator (the hosting provider's mail server or an SMTP provider). Those messages contain your name and a link, not your documents. We do not sell personal data.

Retention and deletion

You can delete any document, and your whole account, from your account page. Deleting your account removes your documents, versions, dictionaries and usage records. Backups made by the operator may keep copies for a limited period. Audit entries are kept without your name and with a shortened IP address.

Your choices

You can access, correct, export or delete your data from within the application, or by contacting us. Where the law gives you additional rights, contact us to exercise them.

Security

We use HTTPS, hashed passwords, per-document ownership checks, CSRF protection and rate limiting. No system is perfectly secure; please use a strong, unique password.

Contact

Questions about privacy: contact us.