Privacy Policy

Last updated: 2026-05-25

Shadow Typer (“the Service”, “we”) is a tool that writes user-provided text into a Google Doc on a schedule. This policy explains what data we collect, how we use it, and how to remove it.

1. Information we collect

When you sign in with Google, we receive and store:

Your Google account email address
Your display name and profile picture URL
An access token and refresh token that let the Service make requests to the Google Docs and Google Drive APIs on your behalf

When you create a writing job, we additionally store:

The title you give the job
The Google Doc ID the job writes into
The full text you paste in — stored encrypted at rest using AES-256-GCM
Your schedule (writing windows, deadline, vacation ranges, day intensity, persona preset, fine-tuning parameters)
Operational logs: which sessions ran, how many characters were written, what typos or revisions were applied, when errors occurred
Your browser-reported timezone, so writing windows happen in your local time

2. Google API Services User Data

Shadow Typer requests the following Google OAuth scopes:

auth/userinfo.email and auth/userinfo.profile — to identify your account
auth/documents — to create, read, and edit Google Docs on your behalf
auth/drive.file — to allow newly-created docs to be owned by your Drive

Shadow Typer’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for advertising. We do not allow humans to read your Google user data except (a) with your explicit consent, (b) for security purposes (investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized.

3. How we use your data

To authenticate you
To create and edit the Google Docs you target with a job
To pace and schedule the writing as you configured
To show you progress, events, and revisions in the dashboard
To prevent abuse and diagnose errors

We do not sell your data. We do not share it with third parties except the unavoidable infrastructure providers below.

4. Where your data lives

Application data is stored in a SQLite database on a server we operate on Fly.io. Job content is encrypted at rest. The Google Doc itself remains in your Google Drive under your account.

Infrastructure providers:

Fly.io — application hosting and persistent volume
Google — OAuth, Docs API, Drive API
Resend (if email notifications are enabled) — transactional email

5. Retention

We keep your data while your account exists. You can request deletion at any time (see section 7), in which case your account, all jobs, stored job text, events, and tokens are removed. The Google Docs themselves remain in your own Drive and are not touched by deletion.

Aggregated, non-identifying usage statistics may be retained indefinitely.

6. Security

We use HTTPS for all traffic, encrypt job content at rest, hash admin passwords with scrypt, and limit administrative access to a small number of accounts. No system is perfectly secure; we recommend you use a strong password on your Google account and treat the OAuth consent decision seriously.

7. Your rights

You can:

Revoke Shadow Typer’s access to your Google account at any time at myaccount.google.com/permissions
Request deletion of your account and all associated data by emailing support@shadowtyper.ca
Request a copy of the data we hold about you by emailing the same address

We honor deletion requests within 30 days.

8. Children

Shadow Typer is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has signed up, please contact us and we will remove the account.

9. Changes

We may update this policy. Material changes will be announced on this page and the “Last updated” date above will change. Continued use of the Service after a change constitutes acceptance.

10. Contact

Questions or requests: support@shadowtyper.ca