Privacy

Last updated: 2026-10-21.

This page covers two different things: the Scrin application, which runs on your machine, and the Scrin website. They handle data very differently, so they are described separately.

Who is responsible

7 Hazart, a French SASU registered in Paris under number 940 775 042. Full publisher details are in the legal notice. For anything on this page, including exercising your rights, write to studio@7hazart.com. This policy follows Regulation (EU) 2016/679 (GDPR) and French law 78-17.

The application

Scrin runs in a web browser, at app.scrin.app, and as an Android app installed from Google Play. Everything in this section holds for both; where they differ, this page says so.

Your writing stays on your own devices

Your manuscript, notes, titles and annotations are written to local storage on your own device. The application asks for no account. A daily safety copy is written on your machine only, as plain text you can read without Scrin.

Nothing leaves that device unless you do one of three things yourself: pair a second device (the “pair a device…” button, then a pairing code you carry over to the other device by hand), share a text with a reader through a link you make for them, or ask for the map of a manuscript, each described below. Until you do, nothing of your writing is sent anywhere; the few requests the application makes on its own, described further down, carry none of it.

Syncing between your devices

Once two devices are paired, your text travels between them so that both hold the same manuscript. It is encrypted on your device before it is sent (AES-256), with a key derived from the pairing code. That code never reaches us: it goes from one of your devices to the other by your own hand. The server in between cannot read your text and cannot tell whose it is. Neither can we.

A relay server carries the encrypted data between your paired devices and keeps it, still encrypted, so that a device that was offline can catch up when it comes back. There is still no account: the pairing is the only thing that ties your devices together.

• Recipient: a hosting provider in Quebec, Canada, on a server we rent. For the sync it only ever holds encrypted data, and the relay keeps no log of IP addresses for these connections.
• Legal basis: performance of the service you asked for (Art. 6(1)(b)) — it runs only once you have paired a device.
• Retention: when nothing has been written on a pairing for 180 days, the relay deletes what it holds for it. Your text stays on your devices regardless.
• Turning it off: “unpair this device” ends the connection. Your writing stays exactly as it is, on every device.

Sharing a text with a reader

You can let someone read a text by making them a reading link, one per person, under the name you give it. The reader needs no account and installs nothing.

The text is encrypted on your device before it is sent; the key sits in the part of the link after the “#”, which a browser never sends to a server. Whoever holds the link can read; the server cannot, and neither can we.

The reader may select a passage and leave a note, signed with a name of their choosing. That name and that note are data the reader chooses to write; they are sealed for you alone, and reach your device when you open the text.

• Recipient: the same hosting provider in Quebec, Canada, on the server we rent for the sync relay. For a shared text it only ever holds encrypted data, and of each link's access token only a fingerprint. A count of uploads per IP address and per day lives in memory only; the address itself is never written down.
• Legal basis: performance of the service you asked for (Art. 6(1)(b)) — it runs only once you have made a link.
• Retention: a share you have not touched for 90 days is deleted by the service. Stopping a share deletes it at once. Your text stays on your device regardless.
• Turning it off: take back one person's link, or stop sharing the text altogether; the link then shows nothing. Your writing stays exactly as it is.

The map of a manuscript

The map is the one feature that sends your text anywhere it can be read, and it runs only when you ask for it. A dialog names what leaves, where it goes and how long it is kept; nothing leaves until you agree.

Each map request carries the following. First, the text of the manuscript: its scenes, in order, with their chapter titles, once the notes you keep for yourself (%%…%%) have been removed. It is sent so that a language model can draw its outline, synopsis, characters, places and threads. Second, the fixed instructions that Scrin gives the model: a genre instruction and a style instruction. They are identical for every user and set by Scrin; you neither write nor choose them.

Third, the memory of the text, if you have written or corrected one: a short note on how the book is told (narration, point of view, tone, scope). Only a memory you have written or corrected is carried, never one proposed by the model in an earlier map. It follows the same path as the text: through the map service, where it is readable, then to the language-model provider, whose model reads it with the text. It is retained by no one beyond what is stated below for the text. Fourth, a random identifier for your installation of the app, generated by the app at its first map and stored on your device. It is transmitted to the map service only and is never passed on to the language-model provider.

The map comes back to your device and is stored there, in your box. The full account is here.

• Recipients: our map service, on the server we rent in Quebec, Canada (the same one as the sync relay); the text passes through it readable, it checks the pause switch, the day's spending, the per-installation and per-connection counts and the size of the text, hands the text on and keeps none of it. Then a language-model provider, today Anthropic, in the United States, where the model reads the text and writes the map. Our contracting party is Anthropic Ireland, Limited, which processes the text as our processor under its data processing addendum. Anthropic does not use the text to train its models.
• Legal basis: your consent (Art. 6(1)(a)), given in the dialog for each map and covering that map only. You can withdraw it at any time, as simply as you gave it: close the dialog before you click, or answer “not now” the next time, since each map asks again. Withdrawing does not undo a map already made and cannot recall text that has already left; what happens to that text is under “Retention”. To have a withdrawal on record, write to us.
• Retention: we keep no copy of your text and no copy of the map. Anthropic deletes the text within 30 days. It keeps it longer only where the law requires it or where it needs the text to enforce its usage policy, for up to two years if its automated safety checks flag the text as breaking that policy. Our map service keeps, in memory and for the day only, a count of maps per connection, and never writes the network address to disk. On disk it keeps the day's total cost of maps, with the date, until the first map of the next day. On disk, with no end date, it keeps the number of maps per installation, filed under the SHA-256 hash of a random identifier. The app draws that identifier on its first map, keeps it on the device and sends it to this service alone.
• Outside the European Union: the server in Canada and the provider in the United States are covered in “Data leaving the European Union” below.
• Turning it off: there is nothing to turn off. If you never click “send and map”, no text ever leaves for this purpose.

Anonymous usage statistics

The application records what you do with it — features used, views opened, exports run, version and platform — so we can tell what helps and what gets in the way. It never sends the content of your writing, your titles, your file paths, your name or your email address. Each installation carries a random identifier that is not tied to a person.

Once you have said what you are writing (a novel, for instance), that choice travels with each record. So do the milestones of your time with Scrin: the free trial starting and ending, the getting-started steps you complete, the “what's new” notes you have seen (by version number), a licence activated (which level, never the key or the email address), an update offered, then accepted.

It also measures how smoothly the editor runs: how long it takes to respond when you type (the slowest responses only) and how many times the page was busy. What you typed is never part of it.

It also records how people find their way in, so we can see where the first minutes go wrong. When the application opens: the size of the screen and of the window, and the operating system (Android, iOS, macOS, Windows, Linux or ChromeOS). On the first screen: which way in you choose — import a manuscript, try the example, or start writing. For each click: which button or part of the screen was clicked, by the name it has in our own code — never the words written on it, and never your text; a click inside a field you type in is recorded only as “a text field”. A click after which nothing on screen changes within a second, and three quick clicks on the same spot, are each noted once. The first time you type after opening the application: how many seconds that took — never the key you pressed. Each time the page is hidden or closed: how long it has been open and how long it was on screen. At most 200 clicks are recorded each time the application is opened.

• Recipient: our audience-measurement provider, on servers in the European Union. Each time statistics are sent, they reach it with your device's IP address, as any internet connection does; our settings there tell it not to keep that address, and each record also tells it not to work out any location from it: no country, city, postal code or coordinates are attached.
• Legal basis: legitimate interest (Art. 6(1)(f)) — anonymous audience measurement.
• Retention: 13 months.
• Turning it off: the “anonymous usage stats” checkbox in Settings. On a computer, open the “⋯” menu in the side panel, under the title of the book, then “Settings…”. On a phone, in the browser or in the Android app, use the “Settings & export” button at the foot of the list of the book. Unticking the box stops the statistics at once and erases the installation's random identifier (and the invitation token described below); ticking it again starts afresh with a new identifier. In a browser, a “Do Not Track” setting is respected without you doing anything.

Invitation links

If you opened Scrin from an invitation link, that link carried a random token — never your email address, never your name. Your installation keeps it and attaches it to the usage statistics, so we can tell whether the people we invite actually write with Scrin. The link between that token and your email exists only in our invitation list; the application itself only ever knows the token. The link is cleared from the address bar as soon as it opens. Legal basis: legitimate interest (Art. 6(1)(f)). Turning usage statistics off in Settings (the “anonymous usage stats” checkbox) erases the token.

Questions, errors, licence, support

• Scrin may ask one short question at a well-chosen moment (at most one per session, never the same one twice, with a week's rest). Only the question's identifier and the letter of the answer reach us — never free text.
• When you rate a feature, the rating travels with the name of that feature. A replace-all sends the number of replacements made, never what you searched for or what you put in its place.
• When something breaks, the application sends the kind of error, how long its message was (never the message itself) and only the lines that point to where in our code it happened, with the version and platform — never the text you are writing.
• A licence key contains the email address it was issued to. It is checked offline, by signature: the check itself makes no network call, and there is no activation server. Once you activate a licence, that moment and the licence level join the usage statistics; the key and the email address never do. The free trial is counted locally.
• The “write to support” button prepares an email with a diagnostic block — a request reference, the screen the request comes from (editor, plan, export…), version, platform, recent technical messages, the word count of your manuscript (a number, never a line of it) and when you can expect our answer. You see it before sending and can delete it.

Questions, ratings, error reports and licence milestones travel with the usage statistics: the same “anonymous usage stats” checkbox in Settings stops them all, immediately.

Fonts and updates

Besides the statistics described above, the application connects to the network for two more things, fonts and updates. Neither carries your writing or any identifier. Fonts: only when you open “More fonts…” in Settings does the application ask the Fontsource catalogue (api.fontsource.org) for its list of free fonts, and only when you add a font are that font's files downloaded from jsDelivr (cdn.jsdelivr.net); the screen says so next to the button. Like any connection, these requests show your device's IP address, and the file request shows which font you chose. Once downloaded, the font stays on your device and works offline. Fontsource and jsDelivr are public services: we have no contract with them and do not control them.

Updates: when the application opens, and every six hours while it stays open, it reads a small signed file from this site, scrin.app/channel.json, to learn whether a newer version is offered or required. The request carries no identifier, no cookie and nothing about you or your writing; like any visit to this site, it reaches our hosting provider with your device's IP address. If the file cannot be read, nothing changes in the application.

• Recipients: Fontsource (api.fontsource.org) for the list of fonts and jsDelivr (cdn.jsdelivr.net) for the files of a font you add, each only on your gesture; our hosting provider for the update file, as for any page of this site.
• Legal basis: fonts — performance of the service you asked for (Art. 6(1)(b)), since the request happens only on your gesture; updates — legitimate interest (Art. 6(1)(f)), keeping the application you use current and safe.
• Turning it off: fonts — do not open “More fonts…”; the fonts already on your device keep working. Updates — there is no switch: the request contains nothing personal.

The website

Audience measurement relies on one tool, PostHog, on its European Union instance (eu.posthog.com), under our own account. It uses no cookie and writes nothing on your device. The identifier of a visit exists only in memory, for as long as the page is displayed; each new page receives another one, drawn at random, so we cannot follow you from one page to the next. For each page viewed, PostHog receives the address of the page without its parameters; the site you came from, reduced to its domain name; your browser and system, major version only; the type of device, the size of the screen and of the window, the language of the browser and the time zone; the clicks on elements of the page; how far you scrolled (25, 50, 75, 100 %); and the moment you leave the page. PostHog derives an approximate location (country, city, postal code) from your IP address; the address itself is not kept. There is no session recording, no survey, no heat map.

The legal basis is legitimate interest (Art. 6(1)(f)). No prior consent is asked: Article 82 of the French Data Protection Act (loi Informatique et Libertés) exempts trackers whose only purpose is audience measurement. You can turn it off at any time, in this browser, on every page of the site. No advertising cookies are set: no ad network writes anything on this site. The cookie described under “The newsletter form” below notes where a visit came from, including, when the address carries one, the ad platform of a click. If we ever ran paid campaigns, you would be asked first.

The button below stops the measurement in this browser, on every page of this site. It shows only once the tool has loaded.

You can unsubscribe at any time from the link in every message, or by writing to studio@7hazart.com.

The newsletter form

On the pages that carry the newsletter sign-up form, the form is supplied by our newsletter provider, Beehiiv (United States), and shown in a frame loaded from Beehiiv's own domain. On every other page of this site, nothing from Beehiiv is loaded and Beehiiv receives nothing.

As soon as the form is displayed, before you sign up, Beehiiv receives the full address of the page you are on, with its parameters, and, when they are known, the source, medium and campaign of your visit. On a direct visit, or when moving from one page of the site to another, Beehiiv receives the source, medium and campaign held by the bhv_attribution cookie, described below, if it was set on an earlier arrival in the last 30 days; without that cookie, there are none. This tells Beehiiv which campaign or which site a subscription came from.

The frame sets cookies on Beehiiv's domain (beehiiv.com), not on this site, to keep bots away: __cf_bm (less than a day), cf_clearance (one year), _pxvid (one year), _px3 (less than a day) and pxcts (for the browser session). Some browsers block these third-party cookies.

If you land on one of these pages with campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_term, utm_content), with an ad-click identifier (gclid, gclsrc, dclid, wbraid, gbraid, gad_source for Google; fbclid for Facebook; msclkid for Bing; li_fat_id for LinkedIn; ttclid for TikTok; twclid for X), or from another site (a search engine, a social network or any other site), one cookie is set on this site for 30 days: bhv_attribution.

It holds the source, medium and campaign (and the campaign term and content, when present), the address of the site you came from as your browser gives it, usually its domain name only, the full address of the page you landed on with its parameters, and the date and time. Another such arrival within 30 days updates it and restarts the 30 days. A direct visit, or moving from one page of the site to another, does not create it.

Once you have subscribed, the form sets a cookie on this site that remembers for one year that you are subscribed, so that the forms for this newsletter are no longer shown to you.

No consent is asked for any of these cookies. To avoid them: come to the site directly, refuse or delete the cookies of this site and of beehiiv.com in your browser, or block third-party cookies. Questions: studio@7hazart.com.

Who else sees your data

We use a small number of service providers, each bound by a processing agreement under Art. 28 GDPR: a hosting provider for this site, a hosting provider in Canada for the sync relay, our sharing service and our map service (the relay and the sharing service only ever hold data encrypted on your device; the map service passes the text of a manuscript through readable and keeps none of it), a form provider, a newsletter provider, an audience-measurement provider hosted in the European Union, and, once purchases open, a payment provider. We never sell or share your data for anyone else's commercial purposes.

The language-model provider that draws the map of a manuscript sees the text only when you ask for one. It is named in “The map of a manuscript” above; what we have and have not been able to read of its terms is said in “Data leaving the European Union” below.

We are happy to name any of them: ask at studio@7hazart.com and we will tell you.

Data leaving the European Union

Some of these providers process data in the United States. Those transfers rely on the European Commission's standard contractual clauses (decision 2021/914) and, where the provider is certified, on the EU-US Data Privacy Framework. A copy of the safeguards is available on request.

The map of a manuscript is the only case in which the text itself goes to the United States, and only when you ask for one; everything else that crosses the Atlantic is an email address, usage data, or where a visit to the newsletter form came from.

For that provider, Anthropic, the safeguard we rely on for that transfer is the European Commission's standard contractual clauses (decision 2021/914). Anthropic's data processing addendum, which its commercial terms incorporate, incorporates those clauses and states that the parties are deemed to have executed them. We have not read Anthropic's security certifications, nor whether it is certified under the EU-US Data Privacy Framework, so we claim no certification for it.

The sync relay, our sharing service and our map service run on a server we rent from a hosting provider in Quebec, Canada. Canada holds a European Commission adequacy decision (decision 2002/2/EC) for organisations subject to its federal privacy law, PIPEDA, under which data may go there without further safeguards. What the sync and a shared text send there is already encrypted on your device and cannot be read there, by the provider or by us. The text of a manuscript being mapped is the exception: it passes through that server readable, is handed on at once, and is not kept there.

Your rights

Under Articles 15 to 22 GDPR you can ask for access to your data, correct it, have it erased, restrict or object to its use, take it with you, and withdraw your consent at any time (without affecting what came before). French law also lets you leave instructions about your data after your death (law 78-17, Art. 85).

Write to studio@7hazart.com and say what you want. We answer within one month. If you are not satisfied, you can complain to the French data protection authority, the CNIL — cnil.fr.

Security and changes

We use appropriate technical and organisational measures to protect your data — encrypted transport, access control, encrypted backups. If this policy changes in a way that matters, we will tell you by email where we have your address, or on the site. The date at the top says when it last changed.