Privacy policy

CritPages is a mobile app and website for feedback on unpublished writing. It is run by CritPages, operated by Chris Dabel. For anything about your data, write to hello@critpages.com.

This policy covers the website at critpages.com and the CritPages app for iPhone and Android. It is written to be read, not skimmed past. If something is unclear, ask.

On the website. If you sign up for early access we keep your email address, the option you picked for how you would use CritPages, the time you signed up, and, if you gave them, your name, a rough headcount, and a note. The sign-up request also passes through automated bot detection and a rate limit, which look at request signals such as your IP address and browser characteristics. We do not store those signals with your sign-up.

In the app. Your account is your email address and a display name. You sign in with a code sent to that address; there is no password. As you use the app we store the workspaces you create or join, the email addresses you invite, the pages and manuscripts you submit, and the marks and comments reviewers leave on them. A manuscript you import from a .docx file is converted to text on your device and stored as text.

What we do not collect. The app has no advertising identifiers and no crash-reporting service that receives your content. The website sets no tracking cookies today. If we add product analytics to the website or the app, this page will name the service and what it sees before it goes live, and it will never see your pages or your reviewers’ notes. We do not buy or receive data about you from anyone else.

• To run the service: sign you in, show your pages to the readers you invited, and show their marks to you.
• To email you about CritPages: sign-in codes, invitations, and, for the early-access list, the launch notice and beta invitations. We do not email about anything else.
• To order beta invitations: the headcount and note you gave help us invite whole groups first.
• To keep the service working and free of abuse: rate limits, bot detection, and server logs kept for a short period.

No person at CritPages reads your pages or your reviewers’ notes as part of running the service. We would only look at specific content to answer a support request you made, to investigate a report of abuse, or when the law requires it. No automated system reads, summarizes, or trains on your writing.

Only the people you invite into a workspace can open the pages in it. Within a workspace, each reviewer sees only their own marks. The author sees every reviewer’s marks. Beta readers in a round do not see each other, each other’s names, or each other’s notes. When you remove a reader or end a round, their access ends.

The reading page is drawn rather than selectable text, so readers cannot select or copy your words inside the app. However, no app can stop a determined person from photographing a screen, and we do not claim otherwise.

We use a small number of providers, each for one job, and none of them is permitted to use your data for their own purposes.

• Supabase hosts the database and sign-in service, in its us-west-1 region (California, United States). This is where accounts, pages, and marks are stored.
• Vercel hosts the website and its sign-up form, and provides the bot detection and rate limiting in front of it.
• Resend delivers our email.
• Amazon Web Services serves our domain name records.

If you are outside the United States, your data is transferred to and stored in the United States. Data is encrypted in transit and at rest with the providers above.

• Early-access sign-ups: until the launch mailing and the beta invitations are done, then deleted unless you have become an app user.
• Accounts, pages, and marks: for as long as your account exists. Ended rounds and groups keep their pages until the author or Lead removes them, so authors can still read their feedback.
• Server and security logs: a short rolling window, typically days, at the providers above.

You can ask us at any time to show you what we hold about you, correct it, delete it, or take you off the early-access list. Write to hello@critpages.com from the address on your account and we will act within thirty days. Deleting your account deletes your pages, your marks, and your memberships. Marks you left on someone else’s pages are deleted with your account too.

If you are in the European Economic Area, the United Kingdom, or another place with a data protection authority, you also have the right to complain to that authority. We would rather hear from you first.

CritPages is not directed to children. You must be at least 16 to create an account or join the early-access list. If you believe a child has given us personal data, tell us and we will delete it.

When the product changes in a way that affects this page, we update the page and the date at the top. For a change that matters, such as a new provider that handles your content, we will also email account holders before it takes effect. See also the terms of use.