Privacy notice
Version 2026-10-15 · Updated 15 October 2026
Membership and login
Email and password accounts use Supabase Authentication. Supabase processes your email, password and authentication records; passwords are not stored in the Writers Supply community database. Secure session cookies keep you signed in. Existing accounts can still use hosted ChatGPT sign-in, which supplies an account identifier and email to the service. Email accounts and existing hosted accounts are separate; their posts and favourites are not automatically merged. Writers Supply does not collect or store your ChatGPT password. We use the identifier to link membership, content and moderation actions. We store your chosen display name, membership status, terms version and acceptance time. Your email is not published as your profile name. The verified site owner’s sign-in identity is used to authorise moderation.
Photos, videos and forum posts
We store submitted text, media, your member identifier, timestamps and optional social links. For new uploads and forum posts, we also store the content agreement version and server acceptance time with each submission. This records your checkbox declaration; older submissions are not backfilled as accepted. These records are restricted to the service and authorised administration and may be retained to handle disputes or legal obligations. Images may be resized and videos converted. Approved content is visible to people who have access to the app; sharing or downloading by others is possible. Do not upload private information. Pending and removed content is restricted to its author where permitted and the administrator, rather than appearing in public lists.
Automatic and owner moderation
New wall photos, their artist names and social links, and forum text are sent through a protected Supabase function to OpenAI for automatic safety checks. Photos submitted with forum posts are checked too. Content that passes can be published automatically. Flagged content and failed checks remain pending for owner review. Videos require the owner’s approval and are not sent to OpenAI by this moderation flow. We store the check outcome, flagged categories, model name and check time with the submission. Automated checks can make mistakes; use Report a concern to request review.
Reports and moderation
Reports contain the item or account reference, the reason you provide, a timestamp and optional contact details. A signed-in reporter’s identifier may be associated with the report. To limit abuse, the report service stores a daily-changing hash derived from the member identifier or network address rather than storing a raw network address in the report table. Reports are available to the administrator and are not published to the reported member. Account actions and restricted content can be retained for investigation, abuse prevention or legal obligations.
Location and external services
Location access is optional and requested through your device. You can search an area instead. The directory does not store your GPS history. If you explicitly submit a wall-location correction, we retain the coordinates you submit, any reported GPS accuracy, your notes and your account identifier for owner review. Approved coordinates become the public wall pin; your account identifier and review notes are not included in the public location feed. Map, geocoding and routing providers receive the requests needed to return map tiles, search results or route previews; route previews include your selected start and destination. External websites have their own privacy practices.
Saved favourites
We store the shop or wall identifier, the time you saved it and your account identifier so you can access your favourites across devices. Favourites are not displayed to other members. Remove an entry from Favourites to delete that saved record.
Storage and preferences
Supabase manages email-account sessions; hosted authentication manages legacy login sessions. Your interface language is saved locally on your device. Membership, posts, media and reports use the app’s hosted database and object storage. Platform and hosting providers may process technical logs and authentication information under their own policies. No advertising profile or third-party translation service is added by these community features.
Optional promotion analytics and live activity
We ask before collecting these usage statistics. If you allow analytics, we use a random browser identifier (renewed after 30 days) and a session identifier to count visits, sections viewed, submitted searches, directory shop-link and directions clicks, membership completions, and sponsored-card views and clicks. Sponsored-card events include a booking identifier; advertisers receive aggregate reports, not browser identifiers. We do not record your search text, name, email, precise location or raw IP address in these analytics tables. Campaign labels from promotional links and a broad referral category help us understand where visits come from. Device operating system is inferred from the browser; it does not identify a particular person.
While a visible page is open, it sends a heartbeat about every 30 seconds. The owner dashboard estimates active browsers using the previous two minutes. Different devices and browsers may count separately; offline use and visits without consent are not counted. Recognised owner sessions are excluded. Analytics records are retained for up to 90 days of reporting and older records are removed when the owner opens the full dashboard. Choose Analytics preferences in the footer and No thanks to stop collection and request deletion of analytics associated with this browser identifier. If the deletion request cannot reach the server, retained records remain until the retention cleanup runs. Clearing browser storage removes your ability to associate earlier analytics with this browser. Campaign financial totals entered by the owner are separate business records.
Requests and retention
Use Report a concern in the app to request access, correction, content removal or account deletion, or to appeal moderation. Include a contact address if you want a reply. The administrator may need to verify that you control the account. Deletion is handled by request, not an automatic button. Information reasonably required for legal obligations, security or unresolved complaints may need to be retained. Other than the analytics cleanup described above, no fixed automatic deletion schedule is currently configured.
For a complaint about online harm, you can also visit eSafety.