Privacy

What this studio is

Atelier is a writing desk for books and scripts. Lessons, coverage, local sketches, and the manuscript itself run in your browser. Sign-in exists so you can use Grok readers, pitch drafts, Imagine frames, and hosted margin partners, and so the publisher can know which account those requests belong to.

What we collect

Account: name, email address, a hashed password if you create one, and the identity token from Google or X if you use those buttons. Sessions store a token, an expiry, and may store IP address and browser user-agent for security.

On this device only: manuscripts, storyboards, pitch packs, submissions, lesson progress, weekly checks, desk language, and any API keys you paste for the Write margin. These are saved in your browser (local storage). They are not uploaded to this site’s database.

When you press a Grok or Imagine control: the text or prompt you attach (capped), plus the generated notes or image URL. That request is sent to xAI. Local coverage, local sketches, and file import never leave this device.

When you use the Write margin with Claude, ChatGPT, or DeepSeek: the passage and your own API key are sent to that provider through this site’s server, which does not store the key. When you choose a local model, the passage is sent from this browser to the address you set and does not go through this site.

Audience analytics, only if the publisher configured them and you accept: page path, referrer, language, screen size, and a truncated IP or similar used to estimate country. Manuscripts, storyboards, and account email are not sent to analytics tools.

Why we process it

To run your account and keep you signed in (contract).

To keep sessions secure and to prevent abuse (legitimate interest).

To send pages or prompts to xAI when you ask for Grok or Imagine (consent, which you can refuse and still write locally).

To forward a margin request to Anthropic, OpenAI, or DeepSeek when you choose that desk and provide a key (consent).

To count visits and see which studio pages are used, if analytics are configured (consent). You can refuse; the desk still works.

We do not sell personal data. We do not run advertising. We do not build marketing profiles.

Who else sees it

Hosting: the site is served from the publisher’s host (typically Vercel).

Database: accounts and sessions are stored in the publisher’s Postgres (typically Neon) when the site is deployed.

Sign-in: Google or X, via the Grok auth broker. This app never holds Google or X app secrets; the broker brokers that handshake.

AI: xAI (Grok and Imagine). xAI states that it does not train on API inputs or outputs without explicit permission, and that it stores API requests by default for about 30 days for abuse review, encrypted at rest, then deletes them. Zero-data-retention is not enabled on this desk.

Bring-your-own desks: Anthropic (Claude), OpenAI (ChatGPT), and DeepSeek, only when you paste a key and send a margin request. Each has its own privacy policy and retention. API keys live in this browser’s local storage; they are not written to the account database.

Local models: the address you configure (for example Ollama or LM Studio on this machine). Those requests do not pass through this site’s servers.

Fonts: this site loads type from Google Fonts, which can see your IP address.

Analytics, only after you accept and only for tools the publisher enabled: Google Analytics 4 (Google), Plausible, Umami, and/or Cloudflare Web Analytics. Each has its own privacy policy. Plausible, Umami, and Cloudflare Web Analytics are designed without advertising cookies; GA4 uses analytics cookies once you opt in.

The host may inject a small Grok App Builder script on every page.

Where it is stored and for how long

Account and sessions: until you delete the account or the session expires. You can delete the account on the Account page.

Writing on this device: until you clear the site data, export and wipe, or delete the account (which also clears the local desk on this browser).

xAI API traffic: according to xAI’s API terms, typically up to 30 days.

Claude, ChatGPT, and DeepSeek traffic: according to those providers’ terms. This site does not keep a copy of the prompt after the response is returned to your browser.

Imagine frames may be hosted at an xAI URL for a limited time; download a PDF if you need a copy you control.

Analytics events: according to the enabled provider (Google, Plausible, Umami, or Cloudflare). Withdrawing consent on Account or Cookies stops new events from this browser; it does not erase history already held by that provider.

Cookies

A first-party session cookie (HttpOnly, Secure, SameSite=Lax) keeps you signed in. It is strictly necessary for the account.

There are no advertising cookies. Audience analytics (GA4, Plausible, Umami, or Cloudflare Web Analytics) run only if the publisher configured them and you accept. See Cookies.

Children

Atelier is for people aged 16 or older. We do not knowingly keep accounts for children. If you believe a child has an account, delete it on the Account page or contact the publisher.

Your rights

Depending on where you live (including the EU/UK GDPR and California CPRA), you may have the right to access, correct, delete, or export your data, to withdraw consent for Grok/Imagine, another margin partner, or analytics, and to complain to a data protection authority.

Use the Account page to export a copy of what this browser holds and of the account record, and to delete the account. Withdrawing Grok consent is on that page; local tools keep working. Analytics consent can be withdrawn there too. Margin keys can be forgotten from the key panel or by clearing the desk.

We cannot reach into another browser or device. Writing saved only there stays there until you clear it.

International transfers

Google, X, xAI, Anthropic, OpenAI, DeepSeek, Cloudflare, and typical hosts are in the United States. If you are in the EEA, UK, or Switzerland, that is a transfer of personal data outside those regions, based on the providers’ own transfer tools (such as standard contractual clauses) where they offer them.

Contact

The controller is the publisher of this Atelier site. Use the email on the account you signed up with, or delete the account on the Account page. This software does not provide a separate support inbox.