Privacy Policy

What we collect

Account details — your name, email, byline, avatar, and sign-in methods.

Content — the manuscripts, outlines, and samples you upload or paste, and the projects, drafts, and voices you build.

Usage and billing — the records a paid service must keep: run costs, credit movements, and invoices.

What an integration exposes

Substack reads your public archive or an export zip — never your cookies, and a paywalled item is never fetched with a credential. Medium reads your public stories or an export zip. Google Drive reads only the files you pick, under the drive.file scope, for export only.

Disconnecting an integration removes its credential immediately; imported samples stay unless you remove them on the voice's Samples tab.

What happens to your words

Rhema does not train models on your content. Model providers process it under their commercial API terms: Anthropic. During a review the Editor searches the web to check your claims; Rhema limits and monitors what those searches can carry, but a search query is text that leaves Rhema.

Sharing

We do not sell your information. Stripe processes payments; Anthropic processes content under its commercial API terms. Rhēma staff can view your projects only when you grant access — the Settings › Data toggle, per request, 72 hours, with every grant, access, and revocation logged.

Your controls

Settings › Data exports everything — every project, voice, draft, and figure as one zip whose download link arrives by email and lives for 7 days.

The same page carries the privacy toggles — “Exclude my usage from product analytics” and “Allow Rhema staff to view my projects for support (per request, 72 h)” — both off by default, and the delete-account control described below.

Retention and deletion

Deleting your account starts a 14-day grace period — cancel any time before it ends. After that, Rhēma hard-deletes your content and personal information; anonymized ledger rows and the Stripe customer record are retained as tax law requires — nothing else.

A deleted project tombstones for 30 days before it is purged. Platform records keep to a fixed schedule — run transcripts 30 days, internal events 30 days, audit records 90 days, usage records and the credit ledger 7 years — and database backups age out on the platform's backup window.

Cookies and tracking

Rhēma sets the session cookie your sign-in needs and no tracking cookies. Ingestion never asks for or accepts a cookie or any other credential — public endpoints and export zips only.