SteelPen Privacy Policy

Plain-language privacy and security summary for SteelPen as currently built.

1) What SteelPen collects

• Your email address, which is stored in plaintext for account access, login codes, billing, and support.
• User-authored content, including notes, outputs, bucket state, workspace state, writing samples, and uploaded context.
• Device and usage metadata needed to operate the app, such as registered devices, app version, locale, and billing status.
• Control-plane resolution data used to determine feature access, curriculum, banners, offers, and rollout behavior, including identifiers such as person, workspace, device, session, and anonymous IDs plus traits like plan, subscription status, and email domain.
• Server-side event metadata used for analytics and controller-side measurement, including event names, timestamps, product context, and identifiers such as bucket or output IDs when relevant.
• Marketing-site analytics data, including a first-party session cookie used to understand visits to the public website.
• If you use the Chrome extension, the extension may collect the active tab title, URL, selected text, and fallback page text when you open it and run the capture flow.

2) What we use it for

• Authenticate you and send login codes.
• Save, organize, search, and return your notes and outputs to you.
• Generate requested outputs such as Steel Man, reports, emails, and other note-based drafts.
• Transcribe audio you explicitly upload or record.
• Resolve plan-level policy, curriculum packs, messaging, offers, and rollout controls across the web app, iOS app, and public website.
• Run billing, support, abuse prevention, and operational analytics.

3) Security model

SteelPen encrypts user-authored content at rest at the application layer. In practice, notes, outputs, workspace state, bucket state, writing samples, and uploaded context are encrypted per user before they are stored.

• Each user gets a per-user data encryption key.
• That key is wrapped by a server-side key management layer before storage.
• Traffic to the service is sent over HTTPS.
• Logging is configured to avoid logging decrypted user text, prompts, or outputs.

Important: SteelPen is not a zero-knowledge system today. The service must be able to decrypt content in order to return it to the authenticated user and to generate requested outputs. That means SteelPen operators with sufficient privileged server access could theoretically access decrypted content. The truthful claim is encrypted at rest, not operator-proof secrecy.

4) Third-party processing

• OpenAI processes content that you explicitly send through generation or transcription features.
• Stripe processes billing information for web-based paid plans.
• Apple may process billing and subscription transactions for in-app purchases made through the iOS app.
• Your configured mail provider processes login-code and transactional emails.
• The SteelPen controller service at escapespeed.net processes configuration-resolution requests and server-side event batches used for policy, curriculum, messaging, rollout, and measurement.

We do not use your content to train SteelPen itself.

5) Cookies and analytics

• The public marketing site sets a first-party session-style marketing cookie to measure visits and page flows.
• The web app also uses normal application session/authentication cookies needed to keep you signed in.
• When available, anonymous or session identifiers may also be used during controller resolution so SteelPen can return the right public banner, in-app messaging, plan rules, and rollout state.

6) Retention and deletion

Content expires automatically after 1 day by default. You can choose 6 hours, 1 day, or 3 days in your privacy settings. Cleanup runs every 15 minutes and covers notes, generated outputs, uploaded context, subgoals, writing samples, background jobs, and associated audio. Export anything you need to keep.

If you delete content or delete your account, we intend for that content to be removed from the active product systems, subject to operational backups and legal obligations.

7) Your choices

• You can choose what content to upload, dictate, paste, or capture.
• You can avoid Chrome extension capture entirely and use only the web or iOS apps.
• You can manage privacy-related settings in your account area inside the app.

8) Contact

Privacy and support questions can be sent to support@steelpen.app.