ProselonPrivacy Policy
Last updated 17 October 2026.
Proselon is made by Holstein Creations LLC. This policy covers this website and the Proselon app. In short, your books stay as plain files in a folder you choose, and Proselon never uploads them. We hold what an account and a subscription need, the usage data described below, and, where session recording is on, recordings of the app’s window that are deleted after a month. We never sell any of it.
What we never collect
Your books’ files. When Proselon first runs it asks where your books should live, and it offers five answers: a folder in iCloud Drive, Dropbox, Google Drive or OneDrive, or any other folder on this computer. Wherever you point it, the books remain plain files in a folder you can open yourself. Proselon does not upload those files, back them up to us, index them, or train anything on them. If your library sits in a synced folder, the service that syncs it can read those files as it reads anything else you keep there, under its terms rather than ours. If you delete Proselon, your books are still sitting there in plain files.
Proselon sees your writing only in a session recording. Where recording is on, the app records its own window, and your pages and co-writer chats appear in the recording as they do on your screen. The section on session recordings below says when that happens, who watches, and how long a recording is kept. Nothing else Proselon collects carries your writing, apart from any words you choose to type into an answer to one of the app’s questions.
Your passwords, API keys or sign-in codes, in a recording or in a setup report. The app hides them before anything is recorded, and removes codes, tokens and keys from a setup report’s text before it is sent.
Proselon sees your writing only in a session recording. Where recording is on, the app records its own window, and your pages and co-writer chats appear in the recording as they do on your screen. The section on session recordings below says when that happens, who watches, and how long a recording is kept. Nothing else Proselon collects carries your writing, apart from any words you choose to type into an answer to one of the app’s questions.
Your passwords, API keys or sign-in codes, in a recording or in a setup report. The app hides them before anything is recorded, and removes codes, tokens and keys from a setup report’s text before it is sent.
What we do collect
- Your email address and password, to make the account work. The password is stored hashed by our authentication provider, and we never see it in the clear.
- Your IP address and browser/app user agent, recorded when you sign up and when you sign in, and also when an attempt to do either is refused — a wrong password, a confirmation code that does not match, a request for a reset. The refusals are recorded because they are what a limit has to be counted from: too many of them against one address, or from one place, and we make the next attempt wait. We keep all of it to spot abuse of the free trial and to investigate suspicious sign-ins. It is not used for advertising or profiling, and the password itself is never written down, whether it was right or wrong.
- The address you write from, when you send us a message. Writing through the form on our contact page leaves a line recording that a note arrived from your IP address, and writing through the help form inside Proselon leaves one recording that a note arrived from your account. The note itself is stored in neither case: it becomes an email to us and the request is over. A note from inside Proselon carries a few details beside your message, added by the app so that a fault can be answered without a second letter, and they are the version of the app and its build, your operating system and the kind of processor it runs on, the version of Electron (the software Proselon is built on), the writing engine you use, and whether each category of collection described below is on for you and whether by default or by your own choice, or that the app could not tell. They travel in that email and nowhere else, and none of them says where you are or which computer you wrote from. What the line is for is the same limit as above, since each of those forms sends mail from our own domain and a cap on how often it may do so has to be counted from something. The email address typed into the contact form travels in the message so that we can reply to it, and is not written into our database.
- Your agreement to the Terms of Service, recorded when you create your account, meaning the date and which version of the terms you accepted. This is the record that the agreement was made.
- How you found us, recorded once at signup. If you arrived through a campaign link, a tagged link, or from another site, that channel’s label and the campaign’s name are stored with your account, and a first-touch cookie holds the label for up to ninety days beforehand so the signup can record it. Channel labels only, never your browsing history. This record is separate from the usage counts below and their switch, because it is made once at signup rather than counted over time.
- Subscription state, meaning which plan you are on, whether you are trialing, active, past due or cancelled, and the relevant dates. Your card number is never sent to us or stored by us. It goes directly to Stripe.
- A device list. Each computer you sign in on registers itself with your account, recording whether it is a Mac or a Windows machine, its OS and app version, its computer name, and when it was last seen. This is what enforces the five-device limit and what lets you sign out a device remotely from your account page on the web.
- The moment you last ended your sessions. Changing your password, or resetting one you have forgotten, now signs out every browser and every computer the account was signed in on, and the time it happened is stored so that any session older than it is refused. It is one date and time, kept only for accounts that have changed a password, and it exists so that a password change is a real remedy if you ever believe somebody else has reached your account.
- Usage data from the app: how often Proselon is opened, how long sessions last, whether the opening setup was finished, which writing engine, theme, export formats and library storage provider get used, and which kind of Template a project carries when you open it, together with the country each count was sent from and the state or province within it. It also covers each step of setting up a writing engine, whether the co-writer replies, a report when an engine setup fails, where you click in the app’s window, and any answers you give to the app’s questions. All of it goes to PostHog, the same measurement service this website uses. The next four sections say exactly what each part can and cannot contain, and the section on your choices says when it is on and how to change that.
- Recordings of the Proselon app’s window, where session recording is on for you. A recording shows your pages and co-writer chats as they appear on screen. The section on session recordings says when recording is on, who watches, and how long a recording is kept.
- Website analytics. This site uses PostHog to count visits, to see which pages are read, and to record which element a visit clicked through on its way to a download or an account. That last measurement runs on the pages that describe and sell Proselon, where the words a click passes through are our own published copy. It is dropped on your account page and on the sign-up, verification and password forms, where what stands on the screen is yours rather than ours. Whether any of it runs for you depends on where you are and on whether you are signed in, as the section on choices below explains. Where it runs in full, the site sets cookies and sends that record to PostHog, whose servers are in the United States, and the record includes the country, and the state or province, from which your connection reached the site. PostHog works that out from your IP address and then discards the address itself. In the United Kingdom a visitor who is not signed in is counted without cookies, which means that PostHog stores nothing in the browser, does not recognize a return visit, and never joins the visit to an account. PostHog makes no lookup of its own on a visit counted that way, so the site attaches the country and region it has already read from your connection, and nothing finer. Where the law requires your agreement first, and wherever the site cannot tell where you are, it sends nothing about your visit at all. Pages are counted by their address, and whatever in an address identifies you is replaced before the count is sent: a password-reset token, a confirmation code, the email address the verification page is opened with. When you create an account on a visit counted in full, the visit that led to it is joined to the account by the account’s own identifier, which is a string of characters and not your email address, and the channel that brought you is kept beside it. Once you sign out, or come back to the site without being signed in, that browser is counted as a new visitor, and what it does from then on is not joined to your account. Nothing on this site records your screen, and nothing reads what you type into it.
- A record of the mail we send to your account. Whenever Proselon emails you, we record which message it was, and afterwards whether it reached you, bounced, or was reported as spam. That record goes to PostHog, the same measurement service named above, and is attached to your account. It holds the message’s name from a short fixed list of our own, the identifier our mail service gives that one message so we can trace it if you tell us nothing arrived, and the time. We never record the subject line, and never a word of what the message said. It exists so that we can see what Proselon has already written to you before we write to you again. Nothing in it records whether you opened a message or followed a link, because we do not measure either. The record is part of analytics, so it is kept only while analytics is on for you, as the section on your choices explains.
Usage data from the app
The app tells us when it is opened, how long a session lasts, which writing engine you picked and whether its setup finished, when you reached the end of the opening setup, which theme you chose, which export format you ran, and which storage provider you keep your library in. While the app is open it reports that length as the session goes along rather than only once you have quit, so a session still counts when the app is closed abruptly or never closed at all. What it measures is the time the window is in front of you and you are working in it. A Proselon window left open behind something else adds nothing. The provider is a name from a short fixed list, never a folder or a path. Two of the engines are configured inside Proselon itself, and for those the app also reports which model you chose. The Local model engine sends the model’s name, and the API Key engine sends that name along with the service the key points at. A model name is a setting of the same kind as your theme, and it carries no word of what you asked the model to write. The subscription engines take that choice inside their own window, where Proselon cannot see it, so for those we report nothing and guess nothing. When you set an engine working, the app reports which of the two co-writer surfaces you were working in, the Proselon chat window or the Terminal. If you choose No AI, the app reports that choice, and while a book is open under it the app reports that time with the engine and the surface both marked none. Each of these is one word from a short fixed list, and none of them says anything about what you asked for, what came back, or what you wrote. When you press one of the buttons on the toolbar that appears over a passage you have selected, whether to put a citation of it in the co-writer’s message box, to set the co-writer rephrasing, expanding, contracting or continuing it, or to write an instruction of your own, the app reports which button that was, as one word from a fixed list of six. The passage itself is no part of that report, nor the page it sits on, nor how long it was.
When you set up a writing engine, whether in the first-run setup, in Settings or from the co-writer pane, the app reports where you started and each step you reach: installing the engine’s program, signing in, entering an API key, connecting to a local model’s server, and the final check. It reports each problem the setup shows you, with its reason from a fixed list, and whether the setup finished or you backed out. The reports from one attempt share a random identifier, made for that attempt and carrying nothing else, so that the steps of one attempt can be told apart from another’s.
When you use Proselon chat, the app reports each reply the co-writer finishes and how long it took, with the engine and, where Proselon knows them, the model and the API service. It also reports each failure the chat shows you, by its kind from a fixed list. The engine could not start, a usage limit was reached, the engine was signed out, its sandbox was not ready, its server could not be reached, the model refused, or something else went wrong. The reports from one conversation share a random identifier, made for that conversation and carrying nothing else, so that we can count replies per conversation. None of these reports carries a word of what you asked or what came back. In the Terminal the app reports none of this, because the engine runs its own screen there.
The app also reports whether session recording is on for you, and whether that is the default where you are or your own choice, so that we know how many writers the recordings represent. Each report carries the identifier PostHog gives the app session it happened in, so that a report can be matched to the recording of the same session where one exists.
When you open a project, the app reports that it happened and which kind of Template the project carries, meaning a Fiction Book or Series, a Nonfiction Book or Series, an Essay or Article Collection, the Blank Template, or one you installed yourself, which is reported as your own and never by name. That category is all of it. Nothing about the writing travels with it: not the project’s name, not its files, not its length, not how many projects you have, and no identifier of the project that would let one opening of it be matched to another, so these counts cannot be gathered into a picture of any book of yours. Each count, as the app sends it, is a named event with a timestamp and a few short values. Each value comes from a fixed list, unless it is a model name or one of the random identifiers described above. Values outside those lists are dropped before anything is sent, so this channel cannot carry prose, chat, titles or paths even by accident. We use it to answer questions such as how many writers are on Windows, which engines get used in practice, and whether people come back. These counts go to PostHog, whose servers are in the United States. As each one arrives, PostHog looks up the IP address it was sent from and records the country, the state, province or region within it, and the continent, and nothing finer. PostHog then discards the address itself and keeps no copy of it with the record. We use the place for two purposes: to establish which law governs what may be collected from you, since that depends on your country and, in the United States, on your state, and to learn where the writers who use Proselon are. Nothing here is sold, shared, or used for advertising. Whether the counts are sent before you have chosen depends on where you are, as the next section explains, and you can turn them off, or on, at proselon.com/account/privacy, which the app’s Settings point to. The switch governs the whole account rather than any particular computer, and a computer already running picks up a changed answer the next time it checks, as the section on session recordings below describes. Each change you make there, in either direction, is recorded with its date, the version of this page then in force, and the country and state or province you were in together with the default that applied there, so that we can show what you chose and when.
When you set up a writing engine, whether in the first-run setup, in Settings or from the co-writer pane, the app reports where you started and each step you reach: installing the engine’s program, signing in, entering an API key, connecting to a local model’s server, and the final check. It reports each problem the setup shows you, with its reason from a fixed list, and whether the setup finished or you backed out. The reports from one attempt share a random identifier, made for that attempt and carrying nothing else, so that the steps of one attempt can be told apart from another’s.
When you use Proselon chat, the app reports each reply the co-writer finishes and how long it took, with the engine and, where Proselon knows them, the model and the API service. It also reports each failure the chat shows you, by its kind from a fixed list. The engine could not start, a usage limit was reached, the engine was signed out, its sandbox was not ready, its server could not be reached, the model refused, or something else went wrong. The reports from one conversation share a random identifier, made for that conversation and carrying nothing else, so that we can count replies per conversation. None of these reports carries a word of what you asked or what came back. In the Terminal the app reports none of this, because the engine runs its own screen there.
The app also reports whether session recording is on for you, and whether that is the default where you are or your own choice, so that we know how many writers the recordings represent. Each report carries the identifier PostHog gives the app session it happened in, so that a report can be matched to the recording of the same session where one exists.
When you open a project, the app reports that it happened and which kind of Template the project carries, meaning a Fiction Book or Series, a Nonfiction Book or Series, an Essay or Article Collection, the Blank Template, or one you installed yourself, which is reported as your own and never by name. That category is all of it. Nothing about the writing travels with it: not the project’s name, not its files, not its length, not how many projects you have, and no identifier of the project that would let one opening of it be matched to another, so these counts cannot be gathered into a picture of any book of yours. Each count, as the app sends it, is a named event with a timestamp and a few short values. Each value comes from a fixed list, unless it is a model name or one of the random identifiers described above. Values outside those lists are dropped before anything is sent, so this channel cannot carry prose, chat, titles or paths even by accident. We use it to answer questions such as how many writers are on Windows, which engines get used in practice, and whether people come back. These counts go to PostHog, whose servers are in the United States. As each one arrives, PostHog looks up the IP address it was sent from and records the country, the state, province or region within it, and the continent, and nothing finer. PostHog then discards the address itself and keeps no copy of it with the record. We use the place for two purposes: to establish which law governs what may be collected from you, since that depends on your country and, in the United States, on your state, and to learn where the writers who use Proselon are. Nothing here is sold, shared, or used for advertising. Whether the counts are sent before you have chosen depends on where you are, as the next section explains, and you can turn them off, or on, at proselon.com/account/privacy, which the app’s Settings point to. The switch governs the whole account rather than any particular computer, and a computer already running picks up a changed answer the next time it checks, as the section on session recordings below describes. Each change you make there, in either direction, is recorded with its date, the version of this page then in force, and the country and state or province you were in together with the default that applied there, so that we can show what you chose and when.
Reports from a failed engine setup
When setting up a writing engine fails, or you back out of the setup, the app sends a report to PostHog’s error tracking. If you quit partway through a setup, the report waits on your computer and is sent the next time Proselon starts. A report names the engine, where you started the setup, the step it stopped at and the reason, your operating system, and the version of the app. It also carries the text that the setup’s install and sign-in panel printed, so that we can see the exact error you met and repair the setup. Before the report leaves your computer, the app removes web links, sign-in codes, tokens and keys, email addresses, and the location of your home folder from that text. Reports are part of the usage data, so the usage data switch governs them, and PostHog keeps them for a year on our current plan, as it keeps the counts.
Where you click in the app
The app records where on its window you click: the position, the size of the window, and the kind of click. It does not record what you clicked on or any text on the screen. PostHog draws these clicks as a heat map of each screen, which shows which parts of the app writers use and which they miss. The clicks are part of the usage data, under its switch, and are kept for a year like the counts.
Questions the app asks
Now and then the app asks a short question. Each one can be dismissed, and your answer is sent to PostHog only if you give one. The app also reports that a question was shown and whether you answered or dismissed it.
- After an engine setup fails or you back out, it asks what got in the way. You pick an answer from a short list and may add a line of your own. It asks once for each engine.
- Once you have used Proselon on at least two separate days, for at least two hours in all, it asks how you would feel if you could no longer use Proselon, with two optional questions about what you get from it and what would make it better. It asks at the start of a session, and at most once every ninety days. The app works out whether you qualify on your computer and sends nothing to do so.
- When you sign out, it offers one optional line asking whether we could have done anything better.
Session recordings
Where session recording is on, the Proselon app records its window as you use it and sends the recording to PostHog. A recording shows what the window shows, including your pages and your co-writer chats as they appear on screen. It never includes passwords, API keys or sign-in codes, which the app hides before anything is recorded. The panel where you set up a writing engine is hidden from recordings entirely, because sign-in links and codes appear there. Only the app on your computer records. This website records nothing.
Megan, who runs Proselon on her own, watches recordings to find where Proselon gets in writers’ way. There is nobody else at Proselon to see them. PostHog stores them on its servers in the United States and deletes each one a month after it is made. Deleting your account deletes your recordings too, as described below. Recordings are never sold, rented or traded, and never used to judge or profile you or to infer anything about you from what you write.
Whether recording is on before you choose depends on where you are. It is off in the European Union and the rest of the European Economic Area, the United Kingdom, Switzerland, Gibraltar, Jersey, Guernsey, the Isle of Man, and all of Canada. In the United States it is off in California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania and Washington, and wherever the state cannot be made out. It is also off in Brazil, China, Israel, Nigeria, Russia, Saudi Arabia, South Korea, Turkey and Vietnam, in India from 13 May 2027, and wherever your location cannot be made out. Everywhere else it is on until you turn it off. Either way you can change it at proselon.com/account/privacy, where the switch says whether it follows the default or your own choice. The app picks up a change the next time it checks, which it does when it starts, when you sign in, when its window comes back to the front, when your computer wakes or is unlocked, and at least once an hour. It stops recording as soon as it sees the setting is off.
Megan, who runs Proselon on her own, watches recordings to find where Proselon gets in writers’ way. There is nobody else at Proselon to see them. PostHog stores them on its servers in the United States and deletes each one a month after it is made. Deleting your account deletes your recordings too, as described below. Recordings are never sold, rented or traded, and never used to judge or profile you or to infer anything about you from what you write.
Whether recording is on before you choose depends on where you are. It is off in the European Union and the rest of the European Economic Area, the United Kingdom, Switzerland, Gibraltar, Jersey, Guernsey, the Isle of Man, and all of Canada. In the United States it is off in California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania and Washington, and wherever the state cannot be made out. It is also off in Brazil, China, Israel, Nigeria, Russia, Saudi Arabia, South Korea, Turkey and Vietnam, in India from 13 May 2027, and wherever your location cannot be made out. Everywhere else it is on until you turn it off. Either way you can change it at proselon.com/account/privacy, where the switch says whether it follows the default or your own choice. The app picks up a change the next time it checks, which it does when it starts, when you sign in, when its window comes back to the front, when your computer wakes or is unlocked, and at least once an hour. It stops recording as soon as it sees the setting is off.
Your choices, and the defaults where you are
Everything Proselon collects falls into one of three categories. The first is always on, and each of the other two has a default that follows the law of the place you are in, which a choice of your own outranks.
The first, labeled Necessary on your account page, covers what the service cannot run without, meaning your account and signing in, the device list and its limit, your subscription and what it entitles you to, and the brief check on each request that settles which law applies to you. That check reads the country and the state or province your connection comes from and picks the defaults below by them. It doesn’t store where you are. It stores one fact for your account: whether analytics was on or off by default there, as a yes or a no, for the record of mail described below. When you make a choice, the place in force is written into the record of it, as described above.
The second is analytics, which covers the usage data from the app, meaning the counts, the setup reports, the clicks and the answers described above, with the place each was sent from, this site’s measurement of your visits, the record of mail we send you, and your email address attached to your account in PostHog. Where the law allows these without your agreement beforehand, as it does in the United States and in Canada outside Quebec, they are on until you turn them off. Where it requires your agreement first, as in the European Union and in Quebec, in the few places whose law we have yet to establish, and wherever your location cannot be made out, they are off until you turn them on, and nothing is sent in the meantime. The United Kingdom falls between the two, since the app’s counts start off there while the site counts a visitor who is not signed in without cookies, as described above.
The record of mail is made when a message goes out, not while you are using Proselon, so we can’t tell where you are at that moment. If you have made a choice, it follows your choice. If you haven’t, it follows the default for the place you were in the last time you opened the app, signed in, or visited this site signed in. Until one of those has happened, nothing is recorded.
The third is session recording, meaning a recording of what is shown in the app’s window. It stands apart from analytics because a number of American states, and the United Kingdom, treat a recording differently from a count. The section on session recordings above lists where it is on and where it is off before you choose, and your account page has a switch for it. This site records no sessions, whatever the setting.
A choice you make yourself stands wherever you are, on every computer and in every browser you sign in on, until you change it. A visit to this site while you are signed in follows your account in the same way, so it is counted in full or not at all, and never in the cookieless manner, which is meant for visitors nobody can identify.
Two things held in PostHog sit outside these switches, because they concern our own dealings with your account rather than how you use Proselon. They are the copy of your billing record that PostHog collects from Stripe, and the list of accounts PostHog reads from our database, each described elsewhere on this page. Both carry your email address, and both are kept whichever way you choose.
The first, labeled Necessary on your account page, covers what the service cannot run without, meaning your account and signing in, the device list and its limit, your subscription and what it entitles you to, and the brief check on each request that settles which law applies to you. That check reads the country and the state or province your connection comes from and picks the defaults below by them. It doesn’t store where you are. It stores one fact for your account: whether analytics was on or off by default there, as a yes or a no, for the record of mail described below. When you make a choice, the place in force is written into the record of it, as described above.
The second is analytics, which covers the usage data from the app, meaning the counts, the setup reports, the clicks and the answers described above, with the place each was sent from, this site’s measurement of your visits, the record of mail we send you, and your email address attached to your account in PostHog. Where the law allows these without your agreement beforehand, as it does in the United States and in Canada outside Quebec, they are on until you turn them off. Where it requires your agreement first, as in the European Union and in Quebec, in the few places whose law we have yet to establish, and wherever your location cannot be made out, they are off until you turn them on, and nothing is sent in the meantime. The United Kingdom falls between the two, since the app’s counts start off there while the site counts a visitor who is not signed in without cookies, as described above.
The record of mail is made when a message goes out, not while you are using Proselon, so we can’t tell where you are at that moment. If you have made a choice, it follows your choice. If you haven’t, it follows the default for the place you were in the last time you opened the app, signed in, or visited this site signed in. Until one of those has happened, nothing is recorded.
The third is session recording, meaning a recording of what is shown in the app’s window. It stands apart from analytics because a number of American states, and the United Kingdom, treat a recording differently from a count. The section on session recordings above lists where it is on and where it is off before you choose, and your account page has a switch for it. This site records no sessions, whatever the setting.
A choice you make yourself stands wherever you are, on every computer and in every browser you sign in on, until you change it. A visit to this site while you are signed in follows your account in the same way, so it is counted in full or not at all, and never in the cookieless manner, which is meant for visitors nobody can identify.
Two things held in PostHog sit outside these switches, because they concern our own dealings with your account rather than how you use Proselon. They are the copy of your billing record that PostHog collects from Stripe, and the list of accounts PostHog reads from our database, each described elsewhere on this page. Both carry your email address, and both are kept whichever way you choose.
Email we send you
Most of what we send is what the account requires: the verification code, a password reset you asked for, and the billing notices described in the Terms. There is one other kind. If your account was made and the app has never run, or if the app ran and no writing engine was ever set up, Megan writes to ask what happened and whether she can help. Those notes are decided by the two things this page has already described, meaning whether a computer of yours ever registered itself and whether the setup counts show an engine finished, and they stop of their own accord once you get going. Every one of them carries a link that ends them for good, and using it leaves the account mail untouched. If you have turned the usage counts off, the note about an unfinished setup is never sent to you, since it rests on those counts.
Your preference about those notes is kept by Resend, our email provider, rather than by us, so that it holds whichever way a message is sent. When you confirm your address it is stored there as a contact, which is what the preference attaches to; the record is your email address and the categories you have or have not turned off, and nothing else. Deleting your account deletes it, along with everything described under “Deleting everything” below.
Your preference about those notes is kept by Resend, our email provider, rather than by us, so that it holds whichever way a message is sent. When you confirm your address it is stored there as a contact, which is what the preference attaches to; the record is your email address and the categories you have or have not turned off, and nothing else. Deleting your account deletes it, along with everything described under “Deleting everything” below.
Who we share it with
Only the services that make Proselon run, and only what each one needs:
- Stripe, for payments and subscription management. It receives your email and payment details directly.
- Supabase, for account storage and authentication.
- Resend, for sending the account and billing emails described in the Terms, and the notes from Megan described above. It also holds your address as a contact, so that your preference about those notes survives however a message is sent.
- PostHog, for measuring how the website and the app are used, and for storing the app’s session recordings where recording is on. Where analytics is on for you, your email address is attached there to the account it belongs to, sent when you confirm the address, whenever you sign in or reset your password, and with the record of mail we send you, so that a person in our measurements can be matched to a person in our records rather than to a bare identifier nobody can look up. Where analytics is off, none of those sends it. Turning analytics off doesn’t remove an address that is already there. Deleting your account does, and so does asking us. Whichever way analytics is set, PostHog also holds a copy of the billing record Stripe keeps for you — the same address, your subscription and your invoices — which it collects from Stripe directly rather than from us, so that what Proselon earns can be read beside how it is used. PostHog also reads a list of accounts from our database every six hours: your email address, when you signed up and last signed in, whether you have confirmed your address, your plan and trial dates, and the campaign that brought you. The list has a row for every account, so that we can count who is on which plan, but it includes your address only after you confirm it. Deleting your account removes all three. The address, and the measurements, reports, answers and recordings attached to it, are erased on request, and the billing copy and the account list go at the next refresh, within six hours. Cancelling a subscription does not: your billing record stays with Stripe, and so does PostHog’s copy of it.
- Vercel, for hosting this website and the account service.
- GitHub, which holds the nightly backup of our database. It is encrypted before it leaves us, with a key GitHub does not have and cannot obtain, so what is stored there is unreadable to anyone but us.
Your AI provider is separate from us
Proselon’s co-writer runs on an AI account you sign into yourself, or on a model running locally on your machine. Proselon starts the provider’s own program on your computer, and that program carries what you send: Anthropic’s Claude Code for Claude, OpenAI’s Codex for ChatGPT, xAI’s Grok Build for Grok, and Google’s Antigravity CLI for Gemini. A local model and your own API key run through Codex too, pointed at the server or the service you chose. When you use it, what you send goes to that provider under their privacy policy rather than through us. We receive none of it, except what a session recording shows of the chat on your screen where recording is on. If you use a local model, what you send the co-writer goes to no provider at all.
How long we keep it
Account and subscription records last as long as your account does. Sign-in records (IP and user agent, whether the attempt succeeded or was refused), and the single line kept when a message is sent through the contact form or the help form, last while they are useful for abuse investigation. Usage counts from the app are held by PostHog for a year, after which PostHog deletes them. The record of the mail we sent you is held there on the same terms and goes the same way, and so are the setup reports, the clicks and the answers to the app’s questions. Session recordings are kept by PostHog for a month and then deleted. The counts collected before 24 August 2026 are in our own database instead, kept for 13 months, then reduced to anonymous monthly totals and deleted. A device you sign out stays in the registry, marked signed out, for up to 12 months and is then removed. Stripe keeps its own payment records for as long as tax and financial rules require, independently of us. A backup of our database is taken nightly and kept, encrypted, for thirty days before it is deleted, so a record removed today leaves the backups within a month.
Deleting everything
You can delete your account at proselon.com/account/delete, which Settings inside the app links to. Doing so cancels any subscription immediately, deletes your Stripe customer record, deletes your rows in our database, sign-in records — refused attempts among them — and device list and usage events and consent records included, deletes the contact record and email preferences held by Resend, asks PostHog to erase the person your account identifier names together with the usage data, setup reports, answers, session recordings and record of mail attached to it, and deletes the sign-in itself. PostHog carries that erasure out as a queued job rather than in the moment you press the button. Where the request cannot be made or does not arrive, what stands is the person that request would have erased, your address among it, since 28 August 2026 when we began attaching it there. PostHog deletes the counts a year after they reach it in any case, and each recording a month after it is made, and we will have the whole person removed sooner if you ask us to — by email, to the address at the foot of this page, and it is a thing a person does rather than a job that runs. The copy of your billing record that PostHog holds is a separate thing and goes a separate way: deleting your Stripe customer record, which the same routine does first, removes it from PostHog at the next refresh within six hours, without anyone having to ask. Proselon keeps its record of the offers your address was given and used, such as a longer free trial or a place in a campaign, but replaces the address in it with a one-way code. The record no longer identifies you, and the same address can’t claim the same offer twice. Apart from that record, the nightly backups are the one thing that does not go at once. A deleted account stays in whichever of them were taken before you asked, and goes when each of those reaches thirty days of age and is deleted with it. Deletion does not touch your books. Those are yours, on your machine. If you would rather we did it, email hello@proselon.com.
Your rights
Depending on where you live, you may have the right to see the personal data we hold about you, correct it, have it deleted, or object to how it is used. Email hello@proselon.com and we will act on it. If you are in the UK or EU, you also have the right to complain to your local data protection authority.
Children
Proselon is not intended for children under 13, and we do not knowingly collect their information.
Changes
If we change what we collect or who we share it with, we will update this page and change the date at the top. Material changes are emailed to the address on your account.
Contact
Questions, requests, or complaints: hello@proselon.com.