Privacy & Data FAQ
Where Your Data Lives
Section titled “Where Your Data Lives”Where is my manuscript stored?
Section titled “Where is my manuscript stored?”On the Wonderthrough desktop app, your manuscript lives on your local hard drive — in a project folder you can see in your file system. If you enable cloud sync, a copy is stored in our cloud database (Supabase). On the web app, your manuscript is stored in the cloud database. You can always export your full manuscript as .docx or .epub regardless of where it’s stored. If you want the whole project rather than just the manuscript, you can also export a .wt archive.
What should I know before sharing a .wt archive?
Section titled “What should I know before sharing a .wt archive?”A .wt archive is Wonderthrough’s full-project export format, not a manuscript-only export. It’s meant for backup, restore, or moving a project with its surrounding context intact.
Because of that, a .wt can carry more than just the manuscript itself. Depending on the project, it may include things like notes, sources, AI tool outputs, and search-index data tied to the project. It does not include your writing activity history or AI usage records. Those stay on the device that captured them, and Cloud Sync is the way they move across your devices.
That’s useful when you’re backing up your own work, but it also means a .wt can reveal more project context than another person actually needs. If your goal is simply to share the manuscript, .docx or .epub is usually the better choice. We plan to add a safer sharing-oriented export mode later. For the workflow side of when to use each export format, see Export & Backup.
Does Wonderthrough read my writing?
Section titled “Does Wonderthrough read my writing?”We never read, review, or analyze your manuscript content for our own purposes. If you use the web app or have cloud sync enabled, your manuscript and project data are stored on our servers so you can access them — but that stored content exists purely to deliver the service back to you. We do not mine, scan, or use it for any other purpose.
AI tools: when you run an AI tool on the Standard preset, your prompts, writing, and responses pass through our servers on the way to the AI provider — purely in transit; the content of those calls isn’t stored, cached, or logged, though we keep a brief usage record (tool, model, tokens, cost, duration) for billing and cross-device summaries. On the Private AI preset (desktop app, your own API keys), the AI calls themselves go directly from your device to the provider; your prompts, writing, and responses never touch our servers. On the Local-only preset, nothing leaves your computer. On the web, AI calls always pass through our servers — even when you’ve added your own provider keys, since the browser can’t safely call providers directly. The desktop app is required for content that never touches our servers. If you’ve added your own keys outside the Private AI preset and have Cloud Sync turned on, your calls still briefly transit our servers so we can apply your stored key — the conversation isn’t kept, only the usage record.
World Search: to let you ask questions across your own writing, Wonderthrough builds a searchable index of your manuscript passages, entity profile sections, and memory entries. The index lives where the project’s content lives: if cloud sync is on for the project, the index is in our cloud database alongside it; otherwise it’s local to that device. It’s retrieval infrastructure, not reading or analysis: your index isn’t queried for analysis, ranking, recommendations, or anything except serving your own searches. Engineering may access it only under support requests you initiate or under legal process, with the safeguards described in our Privacy Policy.
Availability: World Search requires a Pro or Pro+ subscription, or a top-up credit balance, regardless of which preset you use. Your search index builds automatically in the background as you write — if you subscribe later, search is ready immediately.
Is my content used to train AI models?
Section titled “Is my content used to train AI models?”No. Wonderthrough does not use your content to train any AI models. The AI providers we use (Anthropic, OpenAI, Google) also do not use API-submitted content for model training under their current API terms of service.
Privacy Settings
Section titled “Privacy Settings”How does privacy work in Wonderthrough?
Section titled “How does privacy work in Wonderthrough?”Privacy is expressed through four independent settings in Settings → Privacy & Data:
- Available AI engines (per-device): which AI sources this device can use — Wonderthrough’s keys, your own keys (BYO), and/or a local model.
- Cloud Sync (per-device master toggle; per-project opt-in underneath): whether project content syncs to our cloud database.
- Writing activity details (per-account, Off / Minimal / Robust): how detailed your writing activity log is. Minimal strips entity/scene references at write time so the activity log carries only the minimal fields (tool, model, tokens, cost, duration); Robust keeps the references.
- Sync activity between desktop and web (per-account): bridges your desktop app’s local activity log with your account so it shows up alongside your web activity. See the dedicated entry below for what this controls (and what it doesn’t, on each platform).
Three quick-set presets configure all four at once:
- Standard — Wonderthrough manages your AI keys and billing. Cloud Sync is on by default; activity details are Robust; cross-device sync is on.
- Private AI — Your own OpenAI and Anthropic keys, on the desktop app. AI calls go directly from your device to the provider; your prompts, writing, and responses never touch our servers. Cloud Sync is off by default for the active project (this is what keeps your content off our servers — you can turn it back on per-project if you want cross-device project access, but doing so will route your BYO calls through our ai-proxy). Activity details are set to Minimal so the few records we receive carry only the minimal fields (no per-entity context). Sync activity between desktop and web is also off by default — activity and usage rows stay on this device; you can turn this on in Settings if you want cross-device activity rollups. Requires both keys and the desktop app (macOS).
- Local-only — Everything runs on your machine via Ollama. AI calls, project content, and activity records all stay on this device. Picking this preset also turns off the “Help us improve Wonderthrough” telemetry toggle; you can manually turn it back on in Privacy & Data if you want to. Requires Ollama installed with embedding and generation models, on the desktop app.
Defaults at a glance (Pro tier, non-EU):
| Preset | Allowed AI sources | Cloud Sync | Writing activity details | Sync activity between desktop and web | Optional telemetry |
|---|---|---|---|---|---|
| Standard | All three on | On | Robust | On | On |
| Private AI | BYO + Local on, Wonderthrough off | Off | Minimal | Off | On |
| Local-only | Local only | Off | Minimal | Off | Off |
EU users see Sync activity between desktop and web and Optional Telemetry default off on the Standard preset to match local consent expectations. Free-tier users don’t have Cloud Sync or Sync activity between desktop and web — these become available when you upgrade to Pro. Private AI and Local-only also require Pro.
You can also customize the four settings independently — the presets are just shortcuts. The Privacy & Data picker shows an asterisk on the active preset if you’ve diverged from its defaults.
Tradeoff for desktop without cloud sync, and for Local-only: the search index sits on the device, so it doesn’t sync across computers. Opening the same project on a second machine will re-index from scratch there.
What does “Sync activity between desktop and web” control?
Section titled “What does “Sync activity between desktop and web” control?”This setting bridges your desktop app’s activity log with your account. With it on, what you do on the desktop app shows up in the same activity history as what you do on the web, and vice versa. With it off, your desktop app keeps its activity log private to that device.
Web activity is always part of your account history — the web app stores everything in our cloud database (there’s no local-only mode for any data on web; if there were, closing the browser tab would mean lost work). So this setting really controls the desktop side of the bridge: whether your desktop app participates in the unified history, or stays siloed.
| State | What flows | What you see |
|---|---|---|
| On | Desktop activity log uploads to our cloud; web pulls it back. Web activity always flows to our cloud either way. | A unified history on every surface — desktop + web in one timeline. |
| Off (desktop) | Desktop activity log stays in local files on this device. | Desktop heatmap and history show only this device’s work. |
| Off (web) | Web activity still flows to our cloud (no local-only mode). | The web view scopes itself to this browser’s own activity — desktop contributions are hidden. |
Two things to know about how this interacts with Writing activity details:
- Writing activity details governs what’s in each row. Minimal strips entity/scene references at write time; Robust keeps them. Sync activity between desktop and web doesn’t change row content — it controls the desktop’s participation in the bridge (and the web’s view scope).
- The two settings answer different questions. Writing activity details = “how detailed should my activity log be?”. Sync activity between desktop and web = “should my desktop app and web see each other’s activity?” — independent of detail level.
One exception (billing carve-out): when you run an AI tool on Wonderthrough’s platform keys, a usage record uploads regardless of this setting — those records are billing truth and we keep them for tax/audit purposes. The setting governs your activity and your BYO usage records, not records about calls Wonderthrough is billing on your behalf.
Carve-out for BYO usage on the web: when you use your own API keys on the web app, the usage record is logged by our server (the ai-proxy that forwards your call to the provider) — there’s no local-only mode for that. So BYO usage records from the web reach our cloud regardless of this setting. On the desktop app, BYO usage records are gated by this setting normally (off keeps them in your local file).
To get the most-private posture for behavioral records: use the desktop app, set Allowed AI sources to Local-only or BYO-only, turn Cloud Sync off for the project, set Writing activity details to Minimal, turn Sync activity between desktop and web off, and turn off the “Help us improve Wonderthrough” telemetry toggle. That combination is the only path where your behavioral records stay strictly on your machine.
Can I use the Private AI preset on the web?
Section titled “Can I use the Private AI preset on the web?”The Private AI preset itself is desktop-only — the “your prompts never touch our servers” promise depends on calls going directly from the desktop app to your AI provider, which the browser can’t safely do (it can’t store provider keys without exposing them). On the web, you can still add your own provider keys to be billed directly to your provider account, but the call itself still passes through our proxy. For content that never touches our servers, use the desktop app.
What metadata does Wonderthrough collect when I’m using the Private AI preset?
Section titled “What metadata does Wonderthrough collect when I’m using the Private AI preset?”On the Private AI preset on desktop, your prompts, writing, and responses go directly to your AI provider — we never receive them. We do receive a minimal usage record for each AI tool run: which tool ran, how long it took, the model, token counts, the cost, and the duration. Because the Private AI preset sets Writing activity details to Minimal, the entity/scene references that would normally accompany that record are stripped at write time, so the upload contains only the minimal fields above — no per-book, per-character, or per-result context.
If you want even those minimal records to stay on the device, turn off Sync activity between desktop and web in Privacy & Data (desktop only — on web, the record is logged server-side by the ai-proxy and can’t be kept local), or turn off Cloud Sync for the specific project.
World Search telemetry: none on Private AI or Local-only. We don’t log World Search queries or results to our servers — no query hashes, no chunk IDs, no timings. Everything related to search stays on the device.
What happens if my own API key isn’t working?
Section titled “What happens if my own API key isn’t working?”If you’re using your own API key with Cloud Sync on and the cloud-stored copy of your key fails (for example, you regenerated the key on the provider’s site and didn’t update Wonderthrough’s copy), we’ll try to use a copy of the same key from your device’s keychain so you can keep working. You’ll see a brief notice in the app letting you know. To fix the underlying issue, go to Settings → Keys & Models and update the key — that updates both the cloud copy and the local copy. If you don’t have a working local copy either, you’ll see an error explaining what to fix.
Where is my behavioral data stored?
Section titled “Where is my behavioral data stored?”If you use Wonderthrough on your computer, your behavioral records (writing activity, AI usage, World Search history) are stored both on your computer and — if you have “Sync activity between desktop and web” turned on — also on our servers. BYO API keys are stored in your operating system’s keychain plus an encrypted server-side copy when sync is on. If you use Wonderthrough in your web browser, all of the above live only on our servers. Settings → Privacy & Data → Manage your data shows you how much is in each place.
World Search
Section titled “World Search”What is World Search?
Section titled “What is World Search?”World Search is semantic search across your own writing — manuscript passages, entity profile sections, and author memory entries. When you ask a question in worldbuilding chat, it finds the most relevant material and cites specific sources in the response.
What does Wonderthrough store about World Search?
Section titled “What does Wonderthrough store about World Search?”Two things, gated independently:
(1) Your search index — chunk text and vector embeddings. When cloud sync is on for the project, the index lives in our cloud database per-project so search works on every device you sign into. When cloud sync is off for that project, or you’re on the Private AI or Local-only preset, the index is on the device only.
(2) A small per-query diagnostic row — a hash of the query (never the raw text), tab scope (which view you searched from), timings, the model used, and (when Writing activity details is Robust) which chunks were returned and cited.
The diagnostic row follows the same rules as your writing activity log:
- Writing activity details governs what’s in each row. Off — nothing is captured at all, on any device. Minimal — behavioral shape (query hash, timings, source-type counts) without per-entity references like which chunks were retrieved or cited. Robust — full per-query detail including those references.
- Sync activity between desktop and web governs how the captured row flows. On the desktop app, it gates whether the row leaves the device — with it off, the row stays in the local file. On the web, the row flows to our cloud regardless (web is cloud-by-construction); this setting then controls the cross-device view at read time.
- Cloud Sync governs whether the project has a cloud home at all. A project with cloud sync off has nowhere project-scoped to put cloud rows, so diagnostic rows for that project remain device-local regardless of the other settings.
When the Search Insights surface ships, it will read these rows back to you — on the web, that view honors the Sync activity between desktop and web setting (cross-device when on, this-browser-only when off); on the desktop, the diagnostic rows have to be uploaded for the cross-device view to materialize.
On the Private AI and Local-only presets, neither the index nor any per-query diagnostic is on our servers. The index is on the device, and diagnostic rows are captured locally (or not at all if you’ve set Writing activity details to Off) — nothing uploads.
Can I delete my World Search index?
Section titled “Can I delete my World Search index?”Yes:
- Delete the project — when cloud sync is on for the project, this also deletes the cloud-stored index rows; in all other configurations, the local index stays on disk until you remove it.
- Remove the local index directory — for desktop users, delete the project folder under the Wonderthrough userData directory at
search-index/[projectId]/.
AI Providers
Section titled “AI Providers”Which AI provider processes my content?
Section titled “Which AI provider processes my content?”By default, most AI tools use Anthropic’s Claude. Image generation uses OpenAI’s DALL-E. You can change the AI model for each tool in Settings → AI Models. If you use your own API key, the provider is whoever issued that key.
What does the AI provider do with my content?
Section titled “What does the AI provider do with my content?”Under their current API terms, Anthropic, OpenAI, and Google do not use API-submitted content for model training. Your content is processed to generate the response and then discarded. Check each provider’s current API terms for the most up-to-date policy.
Cloud Sync
Section titled “Cloud Sync”Is cloud sync required?
Section titled “Is cloud sync required?”No. The Wonderthrough desktop app works fully offline with local data. Cloud sync is optional and is available on Pro and Pro+ plans. If you enable it, your project data (entities, scene metadata, worldbuilding) syncs to our cloud database so you can access it from the web app.
What gets synced to the cloud?
Section titled “What gets synced to the cloud?”When cloud sync is enabled for a project: project metadata, entity profiles, scene cards (structured analysis results), worldbuilding data, and AI tool results. Your raw scene prose is included if you use the web app (since the web app reads from the cloud database). If cloud sync is off for the project (the default under the Private AI and Local-only presets), none of this leaves your machine for that project.
Can I delete my behavioral data?
Section titled “Can I delete my behavioral data?”Yes. Go to Settings → Privacy & Data → Manage your data, click Remove… next to the category you want to clear (AI usage, writing activity, World Search history, or BYO API keys), and choose which layers to clear: your device, our cloud, or both. By default, both are checked. You’ll be asked to type your email to confirm when our cloud is one of the layers. There’s also a “Also remove from my other devices” option that propagates the delete to your other devices immediately on next sync — otherwise (default) those devices will prompt you before clearing their local copies.
Can I remove my data from this device only, not from the cloud?
Section titled “Can I remove my data from this device only, not from the cloud?”Yes — uncheck “Wonderthrough’s cloud” in the Remove dialog, leaving only “This device” checked. You skip the email-confirmation step entirely — that field only appears when our cloud is part of what you’re removing. If you’re using Wonderthrough in your web browser, you won’t see a “This device” option — web browsers don’t keep these records on your computer, so there’s nothing local to remove.
What if I’ve had Sync off — do I lose those records?
Section titled “What if I’ve had Sync off — do I lose those records?”The Remove dialog shows how many rows in your local copy haven’t yet reached our servers — typically because “Sync activity between desktop and web” was off when they were written. Removing those is permanent: they never reached our cloud and can’t be recovered. To preserve them, turn Sync on, wait one sync cycle, and then clear.
What about my Wonderthrough billing charges?
Section titled “What about my Wonderthrough billing charges?”Charges billed through Wonderthrough’s platform keys (where Wonderthrough provides the AI access) are retained for 7 years as required by US tax and financial audit regulations. They stay visible in Settings → Billing → AI Usage regardless of what you remove from the Manage your data panel. If you delete your account, those records are anonymized rather than deleted. New platform-key calls continue to log to the cloud after a Remove action — only your existing BYO API key and local-LLM rows are removed.
Your Account
Section titled “Your Account”What’s the minimum age to use Wonderthrough?
Section titled “What’s the minimum age to use Wonderthrough?”Wonderthrough is not designed for children. The minimum age depends on where you live: if you’re in the European Union, European Economic Area, or United Kingdom, you must be at least 16 years old to create an account (this matches the default under GDPR Article 8). Everywhere else, you must be at least 13 (the US COPPA baseline). We determine the tier from your browser’s timezone at signup and show the matching age attestation on the signup checkbox. We do not collect a date of birth, store your age, or ask for parental consent — the attestation is self-reported, and by creating an account you confirm you meet the minimum age for your region. If you’re a parent or guardian and believe a child under the applicable age has created an account, contact us and we will delete it.
What happens if I delete my account?
Section titled “What happens if I delete my account?”To delete your account, email support@wonderthrough.com. We’ll respond within 2 business days with a copy of your data and a confirmation. You have 48 hours from our confirmation to reverse the request if you change your mind.
Your cloud data (manuscripts, entities, projects, AI results, feedback submissions) is deleted from our servers. Your Stripe subscription is canceled. Your local data in the Wonderthrough desktop app remains on your computer — we have no access to it and it is unaffected by account deletion.
Some records are retained after deletion as required by law: billing records, subscription history, and AI usage metadata are kept for 7 years for US tax and financial audit compliance. These records contain no manuscript content. Your Stripe customer record is also retained by Stripe under their own data retention policy — we remove our link to it, but Stripe holds the billing relationship independently. For full details, see our Privacy Policy.
Who owns my work?
Section titled “Who owns my work?”You do. Your manuscripts, characters, worldbuilding, and all creative content belong to you. AI-generated analysis results (synthesis summaries, enrichment findings, arc discovery) are also yours. Wonderthrough retains no rights to your content. Export is always available regardless of your plan status.