Your writing is yours.

Who is responsible

nanowrimo.ma is a non-commercial writing platform run by Mehdi Charouh, an individual based in Morocco, who is responsible for your personal data (the “data controller” under Moroccan Law 09-08).

For any question or request about your data, write to contact@nanowrimo.ma.

What we collect

• Your account: email address, display name and language. Your password is stored only as a one-way hash (bcrypt); we cannot see it.
• If you sign in with Google: the name, email address and profile picture of your Google account. We ask Google for nothing else.
• Your writing activity: your projects (title, genre, goal, dates), the word counts you log or the editor counts for you, the challenges you join and the achievements you earn.
• Your manuscripts, if you write them here: scene text, titles, synopses, labels and snapshot names are encrypted in your browser before they reach us. We store them only in encrypted form and cannot read them. Your manuscript password and recovery code never leave your browser, so we also cannot recover your manuscripts if you lose both.
• Your book boards: notes, cards and images you add to a board are stored on our server, private to you. Unlike manuscripts, they are not end-to-end encrypted.
• Your profile, if you fill it in: username, bio, city, interests, favourite books, avatar and banner. It is private by default. It becomes visible to others only if you make it public, and each part (city, project, challenge progress, activity, interests, favourite books) has its own switch. Uploaded profile images are re-encoded and their metadata, including location, is removed.
• Technical data: your IP address, used briefly to limit repeated sign-in attempts, and server logs kept for security, which are rotated automatically.

Why we use it

Only to run the service you signed up for: your account, saving your work, word counts, challenges and achievements; to keep accounts secure (email verification, password resets, limits on sign-in attempts, signing out stolen sessions); and to reply when you contact us.

We do not sell or rent your data, show advertising, build marketing profiles, or use analytics or tracking tools.

Cookies and storage on your device

We use no third-party cookies. What we store on your device:

• A session cookie that keeps you signed in, for up to 30 days.
• A language cookie that remembers English, French or Arabic.
• A cookie that remembers which book your desk shows.
• Interface preferences in your browser's storage (for example board position, collapsed panels, hints you dismissed, tour progress).
• Encrypted crash copies of the scene you are writing, so a closed tab never loses your words, and, only if you choose “keep unlocked on this device”, the key that unlocks your manuscripts on that device. Locking or signing out removes the key.

Who else handles your data

We use a few service providers, each only for the task below:

• Oracle Cloud hosts the site and its database in its data centre in Casablanca, Morocco.
• Brevo (France) sends our emails, such as address verification and password resets. It receives your email address and the content of those emails.
• Google, only if you choose to sign in with Google.
• Open Library (Internet Archive, United States): when you search for a book for your shelf, our server sends the search text to Open Library, without anything that identifies you.
• ImprovMX forwards the messages you send to contact@nanowrimo.ma to our mailbox.

How long we keep it

Your data stays as long as your account exists. You can delete your account yourself at any time in Settings: it is removed at once, with everything attached to it. If you ask us to do it instead, we do so within 30 days. Backups of the database are kept for 14 days and then replaced, so deleted data disappears from them within that time.

Email verification and password-reset links expire after a short time. Server logs are rotated automatically.

Your rights

Under Law 09-08 you can ask us to tell you what data we hold about you, correct it, delete it, or stop using it for legitimate reasons. You can change most of it yourself in Settings and on your profile.

You can delete your account yourself in Settings. For anything else, write to contact@nanowrimo.ma from the address of your account. We reply as soon as we can, and within 30 days at the latest.

You can also contact Morocco's data protection authority, the CNDP (www.cndp.ma).

Security

The whole site is served over HTTPS. Passwords are hashed, manuscripts are end-to-end encrypted, uploads are stored privately, and the database is backed up every night. No system is perfectly secure; if something ever goes wrong with your data, we will tell you.

Changes to this page

nanowrimo.ma is in beta and this page may change as the site does. We will update the date above, and announce significant changes on the site.