Privacy policy

versuscraft researches, writes, checks and publishes posts about developer products. This page lists what we store, why, who processes it, how long we keep it and how to delete it.

What we store

• Your account: email address, whether and when you confirmed it, and either a password hash (scrypt - we never see or store your password) or your GitHub/Google account ID. The display name you choose for your byline, if you set one. We don't ask for your real name.
• What you create: product names and websites, briefs, drafts, published posts, the sources and claims behind them, code samples and their run results, the run log of each AI step (model, token counts, cost) and the results of monthly AI checks.
• Keys you give us: test API keys and dev.to/Hashnode tokens, encrypted at rest (AES-256-GCM), used only for what you added them for and never shown again.
• Security records: failed sign-ins, sign-ups, emails sent and feedback sent, with the email address and IP address, to stop password guessing and abuse. Single-use confirmation and password-reset links (we store only a hash of each link).
• Error reports: when a page breaks, the error message, the page address and a reference number go to our server logs so we can fix it.
• Read counts: how many times each published post is viewed, as a number per post. No cookies, no IP addresses and no profile of who read what.
• Billing (when paid plans open): your plan, subscription status and renewal date. Card details go to Stripe and never touch our servers.
• Waitlists: your email address and position, if you join one.
• Topics and autopilot: topic ideas found for your product (the queries, their demand and the pages that rank for them), and your autopilot settings and run history, if you turn it on.
• Feedback: the messages you send through the feedback form, with your email if you give one (or your account email when you're signed in), and the page you sent it from.

Who processes it

• AI providers receive your brief, the public pages we research and your draft, to write, check and polish posts, and the prompts for the monthly AI check: OpenAI, Anthropic, Google (Gemini), Perplexity and OpenRouter (which routes requests to the model provider it serves). Some research steps can use free models through OpenRouter; providers of free models may keep prompts and use them to improve their models, so don't put anything confidential in a brief.
• Infrastructure: Vercel (hosting, and the sandbox that runs code samples with any test key you added), our Postgres database host, Inngest (background jobs, if enabled), Brave Search (search queries for topics and ranking research, if enabled), Google Search Console (aggregate search clicks and queries for published pages, if enabled), Resend (sends confirmation, password-reset and autopilot emails) and Stripe (payments, when paid plans open).
• Public sources we read: the product websites in your brief, plus Reddit, Hacker News and GitHub for user reports. We only read public pages; we don't send them your personal data.
• Where you publish: dev.to and Hashnode, only when you choose to cross-post there.

We don't sell personal data and don't use it for advertising.

Cookies

One session cookie keeps you signed in, plus the short-lived cookies sign-in needs. No advertising or tracking cookies.

How long we keep it

• Account data and posts: until you delete them or your account.
• Security records: deleted after about a day. Confirmation links expire after 24 hours, reset links after 1 hour.
• Server logs: kept by our hosting provider for a limited period, then deleted.
• Database backups held by our database host may keep deleted data for a limited period before they roll off.

Deleting your data

Delete a draft or a post from its page. Remove stored keys in Settings. To delete everything, use Delete account in Settings: it removes your account, products, posts (including published pages, which stop working straight away), keys, AI check results, feedback and subscription record. Copies you cross-posted to dev.to or Hashnode live on those sites - delete them there. To get a copy of your data or ask anything about it, email us.

Depending on where you live (for example the UK or EU), you may have rights to access, correct, delete or move your data and to complain to your data protection authority.