Privacy Policy

1. Scope and platform differences

The NovelKit iOS app uses a BYOK (Bring Your Own Key) model: you select a provider and supply your own API key. The app does not sell digital credits or direct you to external checkout. NovelKit Studio on the web is a separate service that may offer NovelKit-managed AI and optional transactions through a payment partner.

2. Data we process

• Account and contact: email, display name, account identifier, and Google or Apple OAuth identifiers when you choose those sign-in methods.
• User content: prompts, Project DNA, story bible, manuscripts, chapters, cover images, UGC reports, block/hide choices, and artifacts needed to create, store, review, or publish content.
• Provider settings: provider, model, base URL, connection status, and an API key you enter. Stored API keys are encrypted and are not displayed back in full.
• Usage and diagnostics: access time, IP address, browser or device type, app version, session cookie/token, feature actions, model usage, run logs, and error logs needed for operations, security, and troubleshooting.
• Optional web transactions: plan, amount, currency, invoice number, order reference, and payment status. NovelKit does not need to store your full card number or online-banking credentials.
• Support: your email, request, and files you choose to send.

On iOS, NovelKit's first-party product analytics may record feature events, app version, locale, and limited attribution parameters after sign-in. This pipeline does not accept email addresses, API keys, story titles, or manuscript content.

3. How we use data

NovelKit uses data to create and manage accounts; authenticate users; store, sync, and publish content at your direction; connect to AI providers; create spoken audio when requested; measure usage; process web transactions; provide support; prevent fraud and abuse; investigate reports; maintain safety; and comply with legal obligations.

4. Providers and third-party services

When you test a connection or request generation, NovelKit sends the necessary prompt/context and credentials to the endpoint you selected. The current catalog may include:

• AI: OpenAI (api.openai.com), OpenRouter (openrouter.ai), Google Gemini (generativelanguage.googleapis.com), C-PROVIDER (api.xah.io), S-PROVIDER (api.shopaikey.com, api-v2.shopaikey.com), or a compatible endpoint you enter.
• Sign-in: Google (accounts.google.com) and Apple (appleid.apple.com) when you choose the corresponding method. The Google Sign-In SDK privacy manifest declares name, email, phone number, account/device identifiers, coarse location, and usage data for app functionality or analytics; none is used for tracking.
• Text-to-speech: Zall (zall.app) receives text, voice, speed, and pitch when you actively use spoken playback. Generated audio may be cached temporarily to avoid repeat generation and is automatically purged within seven days.
• Web payments: SePay (pay.sepay.vn, pgapi.sepay.vn) processes checkout or confirms optional web transactions.

Each party processes data under its own terms and privacy policy. Do not place secrets, sensitive data, or material you do not have the right to share in a prompt.

5. Choice, consent, and withdrawal

You actively consent to each flow when you choose a sign-in method, save a provider and submit an AI request, start spoken playback, publish content, or begin a web transaction. You may withdraw by stopping the feature, replacing or asking us to remove a provider credential, unpublishing content, or deleting your account. Withdrawal does not affect processing already completed and may make a feature unavailable.

6. Sharing, sale, and tracking

NovelKit shares data only with your selected provider; infrastructure vendors needed to operate the service; the sign-in, payment, and TTS services above; authorities when legally required; or a lawful organizational successor subject to appropriate protections. We do not sell or rent personal data and do not use it to track you across apps or websites for personalized advertising.

7. Retention and deletion

• Accounts, content, and provider settings are kept while the account is active or until you delete them. In-app account deletion removes active account data; emailed requests are completed after ownership verification.
• Routine diagnostic and security logs are kept for up to 90 days unless longer retention is needed to investigate an incident, prevent fraud, or comply with law.
• Support correspondence may be kept for up to 24 months to track requests and prevent abuse.
• Residual backups are overwritten through the normal backup cycle and are not restored into active service except for disaster recovery. Temporary TTS audio cache is automatically purged within seven days.
• Transaction records may be retained for the period required by applicable accounting, tax, chargeback, or fraud-prevention law; retained data is used only for those purposes.

8. Security and international processing

NovelKit uses HTTPS, account-based access controls, and encryption for stored API keys. No system is completely secure. Providers or infrastructure may process data outside your country; data is transferred where necessary to carry out your request under applicable safeguards.

9. Your rights and controls

Depending on applicable law, you may request access, correction, export, restriction, or deletion; object to certain processing; or withdraw consent. You may delete your account in the iOS app or follow novelkit.cc/en/delete-account. Send other requests from the account email to Mrdee0428@gmail.com.

10. Younger users

The service is intended for users age 13 and older and is not directed to children under 13. If we learn that we collected data from someone under 13 without valid consent, we will delete it. Users below the age of majority where they live must have consent from a parent or guardian when required by law.

11. Changes and contact

The update date appears at the top. The current version is always at novelkit.cc/en/privacy. Privacy questions, complaints, or rights requests: Mrdee0428@gmail.com.