Privacy & Data FAQ

Where Your Data Lives

Where is my manuscript stored?

On the Wonderthrough desktop app, your manuscript lives on your local hard drive — in a project folder you can see in your file system. If you enable cloud sync, a copy is stored in our cloud database (Supabase). On the web app, your manuscript is stored in the cloud database. You can always export your full manuscript as .docx or .epub regardless of where it’s stored. If you want the whole project rather than just the manuscript, you can also export a .wt archive.

What should I know before sharing a `.wt` archive?

A .wt archive is Wonderthrough’s full-project export format, not a manuscript-only export. It’s meant for backup, restore, or moving a project with its surrounding context intact.

Because of that, a .wt can carry more than just the manuscript itself. Depending on the project, it may include things like notes, sources (including files you attached to a source and the original files of your imports), AI tool outputs, and search-index data tied to the project. It does not include your writing activity history or AI usage records. Those are personal data about you rather than project content, so they never ride a shareable project archive. If you want a copy of that data, it comes through a personal data request (covered in our privacy policy) — scoped as your own data, not something you hand to someone else.

That’s useful when you’re backing up your own work, but it also means a .wt can reveal more project context than another person actually needs. If your goal is simply to share the manuscript, .docx or .epub is usually the better choice. We plan to add a safer sharing-oriented export mode later. For the workflow side of when to use each export format, see Export & Backup.

Does Wonderthrough read my writing?

We never read, review, or analyze your manuscript content for our own purposes. If you use the web app or have cloud sync enabled, your manuscript and project data are stored on our servers so you can access them — but that stored content exists purely to deliver the service back to you. We do not mine, scan, or use it for any other purpose.

AI tools: when you run an AI tool on the Standard preset, your prompts, writing, and responses pass through our servers on the way to the AI provider — purely in transit; the content of those calls isn’t stored, cached, or logged, though we keep a brief usage record (tool, model, tokens, cost, duration) for billing and cross-device summaries. On the Private AI preset (desktop app, your own API keys), AI tool calls go directly from your device to the provider regardless of Cloud Sync. Cloud Sync separately controls whether project content and eligible results are stored on our servers. On the Local-only preset, AI work goes to your configured local model server. On the web, AI tool calls pass through our servers even when you’ve added your own provider keys, since the browser can’t safely call providers directly. World Search follows its own routing, described below.

World Search: to let you ask questions across your own writing, Wonderthrough builds a searchable index of your manuscript passages, entity profile sections, and memory entries. The index lives where the project’s content lives: if cloud sync is on for the project, the index is in our cloud database alongside it; otherwise it’s local to that device. It’s retrieval infrastructure, not reading or analysis: your index isn’t queried for analysis, ranking, recommendations, or anything except serving your own searches. Engineering may access it only under support requests you initiate or under legal process, with the safeguards described in our Privacy Policy.

Availability: World Search requires a Pro or Pro+ subscription, or a top-up credit balance, regardless of which preset you use. Your search index builds automatically in the background as you write — if you subscribe later, search is ready immediately.

Is my content used to train AI models?

No. Wonderthrough does not use your content to train any AI models. The AI providers we use (Anthropic, OpenAI, Google) also do not use API-submitted content for model training under their current API terms of service.

Privacy Settings

How does privacy work in Wonderthrough?

Privacy is expressed through four independent settings in Settings → Privacy & Data:

Available AI engines (per-device): which AI sources this device can use — Wonderthrough’s keys, your own keys (BYO), and/or a local model.
Cloud Sync (per-device master toggle; per-project opt-in underneath): whether project content syncs to our cloud database.
Writing activity details (per-account, Off / Minimal / Robust): how detailed your writing activity log is. Minimal strips entity/scene references at write time so the activity log carries only the minimal fields (tool, model, tokens, cost, duration); Robust keeps the references.
Sync activity between desktop and web (per-account): bridges your desktop app’s local activity log with your account so it shows up alongside your web activity. See the dedicated entry below for what this controls (and what it doesn’t, on each platform).

Three quick-set presets configure all four at once:

Standard — Wonderthrough manages your AI keys and billing. Cloud Sync is on by default; activity details are Robust; cross-device sync is on.
Private AI — Your own OpenAI and Anthropic keys, on the desktop app. AI tool calls go directly from your device to the provider regardless of Cloud Sync. Cloud Sync is off by default for the active project, which keeps project content and eligible results off our servers; you can turn it back on for cross-device project access without changing the AI tool route. World Search follows its own routing. Activity details are set to Minimal so the few records you choose to sync carry only minimal fields (no per-entity context). Sync activity between desktop and web is also off by default — activity and usage rows stay on this device; you can turn this on in Settings if you want cross-device activity rollups. Requires both keys and the desktop app (macOS).
Local-only — Everything runs through a local model server on your machine (Ollama by default; LM Studio and custom servers work too). With the server on this device — the default, which the app verifies — AI calls, project content, and activity records all stay here. Picking this preset also turns off the “Help us improve Wonderthrough” telemetry toggle; you can manually turn it back on in Privacy & Data if you want to. Requires a local model server with embedding and generation models, on the desktop app — see Local LLM Setup.

Defaults at a glance (Pro tier, non-EU):

Preset	Allowed AI sources	Cloud Sync	Writing activity details	Sync activity between desktop and web	Optional telemetry
Standard	All three on	On	Robust	On	On
Private AI	BYO + Local on, Wonderthrough off	Off	Minimal	Off	On
Local-only	Local only	Off	Minimal	Off	Off

EU users see Sync activity between desktop and web and Optional Telemetry default off on the Standard preset to match local consent expectations. Cloud Sync and Sync activity between desktop and web become available when you upgrade to Pro. What that means depends on where you’re working. On the desktop app, Cloud Sync is what mirrors a project to our cloud — without it, that project stays on your machine. On the web app there’s nothing to turn on or off: the web app keeps your work in our cloud because that’s where a browser has to keep it, so Cloud Sync there is about reaching your other devices, not about whether your writing is stored with us. If you want writing that never reaches our servers, that’s the desktop app. Private AI and Local-only also require Pro.

You can also customize the four settings independently — the presets are just shortcuts. The Privacy & Data picker shows an asterisk on the active preset if you’ve diverged from its defaults.

Tradeoff for desktop without cloud sync, and for Local-only: the search index sits on the device, so it doesn’t sync across computers. Opening the same project on a second machine will re-index from scratch there.

Switching to Private AI or Local-only turns Cloud Sync off, and won’t silently leave your writing on our servers. If a project was already synced, the desktop app asks whether to keep the cloud copy for your other devices or delete all of that project’s cloud data (its synced content, images and attached files) — the same choice as the manual Cloud Sync toggle. (The project’s cloud search index is always cleared and rebuilt on the device either way, since it belongs wherever the content lives.) On the web there’s no local-only mode and Cloud Sync is read-only, so this choice doesn’t apply there.

What happens when I use Wonderthrough’s AI keys with Cloud Sync off?

This is the default setup on the Free plan, and a common deliberate choice on Pro: Wonderthrough supplies the AI keys and billing, and none of your project content is stored on our servers.

Both halves are true at once. When you run an AI tool, the parts of your project that tool needs — scene prose, entity profiles, and so on — travel with that one request, our server uses them in memory to build the call, and the AI provider’s answer comes straight back to your computer, where it’s saved. The content is not stored in our database, not cached, and not written to our logs. Nothing about the project is left behind after the request finishes.

What we do keep is the same brief usage record described above: which tool ran, the model, token counts, cost, and duration. That record carries no manuscript content, and it uploads regardless of your other settings — it’s what we bill from, and we’re required to retain it (see What about my Wonderthrough billing charges? below).

Turning on Cloud Sync changes only where the content lives, not who can use AI tools. With it on, your project is already in our database, so a request just points at it instead of carrying it.

Two practical limits come with sending content per request:

Very large projects. There’s a size limit on a single request. If a project outgrows it, you’ll get a clear message saying so before anything is sent or charged, naming what to trim.
Full runs. The multi-step “full run” — where the app works through your book making many AI calls in sequence, each building on the last — needs the project’s content to stay available between calls, so it isn’t available with Cloud Sync off. Every single-step AI tool works normally. The run configuration screen says this before you start one.

If you’d rather AI tool content never reached our servers in transit, use the Private AI preset: your own provider keys on the desktop app, with AI tool calls going directly from your computer to the provider. Keep Cloud Sync off if you also want project content and eligible results to stay off our storage; World Search follows its own routing.

What does “Sync activity between desktop and web” control?

This setting bridges your desktop app’s activity log with your account. With it on, what you do on the desktop app shows up in the same activity history as what you do on the web, and vice versa. With it off, your desktop app keeps its activity log private to that device.

Web activity is always part of your account history — the web app stores everything in our cloud database (there’s no local-only mode for any data on web; if there were, closing the browser tab would mean lost work). So this setting really controls the desktop side of the bridge: whether your desktop app participates in the unified history, or stays siloed.

State	What flows	What you see
On	Desktop activity log uploads to our cloud; web pulls it back. Web activity always flows to our cloud either way.	A unified history on every surface — desktop + web in one timeline.
Off (desktop)	Desktop activity log stays in local files on this device.	Desktop heatmap and history show only this device’s work.
Off (web)	Web activity still flows to our cloud (no local-only mode).	No change on the web — this setting has no web-side effect; your web view always shows your full account activity. It only changes whether your desktop app uploads.

Two things to know about how this interacts with Writing activity details:

Writing activity details governs what’s in each row. Minimal strips entity/scene references at write time; Robust keeps them. Sync activity between desktop and web doesn’t change row content — it controls the desktop’s participation in the bridge, and has no effect on the web (your web view always shows your full account activity).
The two settings answer different questions. Writing activity details = “how detailed should my activity log be?”. Sync activity between desktop and web = “should my desktop app and web see each other’s activity?” — independent of detail level.

One exception (billing carve-out): when you run an AI tool on Wonderthrough’s platform keys, a usage record uploads regardless of this setting — those records are billing truth and we keep them for tax/audit purposes. The setting governs your activity and your BYO usage records, not records about calls Wonderthrough is billing on your behalf.

Carve-out for BYO usage on the web: when you use your own API keys on the web app, the usage record is logged by the server that forwards your call to the provider — there’s no local-only mode for that. So BYO usage records from the web reach our cloud regardless of this setting. On the desktop app, BYO usage records are gated by this setting normally (off keeps them in your local file).

To get the most-private posture for behavioral records: use the desktop app, set Allowed AI sources to Local-only or BYO-only, turn Cloud Sync off for the project, set Writing activity details to Minimal, turn Sync activity between desktop and web off, and turn off the “Help us improve Wonderthrough” telemetry toggle. That combination is the only path where your behavioral records stay strictly on your machine.

Can I use the Private AI preset on the web?

The Private AI preset itself is desktop-only — its direct-call promise depends on calls going from the desktop app to your AI provider, which the browser can’t safely do (it can’t store provider keys without exposing them). On the web, you can still add your own provider keys to be billed directly to your provider account, but AI tool calls pass through our proxy. Use the desktop app for direct AI tool calls; Cloud Sync separately controls project storage, and World Search follows its own routing.

What metadata does Wonderthrough collect when I’m using the Private AI preset?

On the Private AI preset on desktop, AI tool prompts, writing, and responses go directly to your AI provider — we never receive them as part of the call. A minimal usage record is still written locally for each run: which tool ran, the model, token counts, cost, duration, and timestamp. Because the preset sets Writing activity details to Minimal, entity/scene references are stripped at write time, so any record you choose to sync contains no per-book, per-character, or per-result context. Cloud Sync may separately store project content and eligible results, and World Search follows its own routing.

If you want even those minimal records to stay on the device, turn off Sync activity between desktop and web in Privacy & Data (desktop only — on web, the record is logged on our servers and can’t be kept local), or turn off Cloud Sync for the specific project.

World Search performance telemetry is controlled only by your optional-analytics choice, not by a preset or AI-source combination. If you opt in, we may receive aggregate counts, timings, model, and outcome; never the question, a fingerprint or length of it, or source identifiers. If you opt out, no diagnostic row is written.

No — they’re two separate choices. The website (wonderthrough.com) asks about analytics cookies in its banner; the app asks about the “Help us improve Wonderthrough” usage-data toggle the first time you use it, and you can change it any time in Settings → Privacy & Data. Browsers keep each site’s preferences separate, so declining on one does not decline on the other. If you want both off, set both.

Where is my behavioral data stored?

If you use Wonderthrough on your computer, your writing-activity and AI-usage records are stored both on your computer and — if you have “Sync activity between desktop and web” turned on — also on our servers. World Search performance telemetry is cloud-only and is written only when you accept optional analytics. BYO API keys are stored in your operating system’s keychain plus an encrypted server-side copy when sync is on. If you use Wonderthrough in your web browser, behavioral records live only on our servers. Settings → Privacy & Data → Manage your data shows you how much is in each place.

World Search

What is World Search?

World Search is semantic search across your own writing — manuscript passages, entity profile sections, and author memory entries. When you ask a question in worldbuilding chat, it finds the most relevant material and cites specific sources in the response.

What does Wonderthrough store about World Search?

Two things, gated independently:

(1) Your search index — chunk text and vector embeddings. On desktop, cloud-disabled projects use the local index. Cloud-enabled projects normally use the cloud index, except when the live AI-source settings are Wonderthrough off + your own keys off + Local on; that atomic configuration stays local because local-model embeddings cannot share the OpenAI embedding space. This is based on the current settings, not the preset name. The web app uses the cloud index.

(2) A small performance-only diagnostic row — tab scope (which view you searched from), aggregate retrieval and citation counts, source-type counts, timings, the model used, and outcome. It contains no query text, query-derived fingerprint or length, or source identifiers.

The diagnostic row is cloud-only and governed solely by optional analytics. Cloud Sync, Writing activity details, Sync activity between desktop and web, and named presets do not govern it. If you have not accepted optional analytics, no row is written; if the cloud write cannot complete, it is simply dropped rather than buffered locally.

Can I delete my World Search index?

Yes:

Delete the project — when cloud sync is on for the project, this also deletes the cloud-stored index rows; in all other configurations, the local index stays on disk until you remove it.
Remove the local index directory — for desktop users, delete the project folder under the Wonderthrough userData directory at search-index/[projectId]/.

AI Providers

Which AI provider processes my content?

By default, most AI tools use Anthropic’s Claude. Image generation uses OpenAI’s DALL-E. You can change the AI model for each tool in Settings → AI Models. That choice applies when you run the tool directly. If a larger feature includes the tool, all of its included AI work follows the larger feature’s source instead. If you use your own API key, the provider is whoever issued that key.

What does the AI provider do with my content?

Under their current API terms, Anthropic, OpenAI, and Google do not use API-submitted content for model training. Your content is processed to generate the response and then discarded. Check each provider’s current API terms for the most up-to-date policy.

Cloud Sync

Is cloud sync required?

No. The Wonderthrough desktop app works fully offline with local data. Cloud sync is optional and is available on Pro and Pro+ plans. If you enable it, your project data (entities, scene metadata, worldbuilding) syncs to our cloud database so you can access it from the web app.

What gets synced to the cloud?

When cloud sync is enabled for a project: project metadata, entity profiles, scene cards (structured analysis results), worldbuilding data, and AI tool results. Your raw scene prose is included if you use the web app (since the web app reads from the cloud database). If cloud sync is off for the project (the default under the Private AI and Local-only presets), none of this leaves your machine for that project.

Can I delete my behavioral data?

Yes. Go to Settings → Privacy & Data → Manage your data, click Remove… next to the category you want to clear (AI usage, writing activity, World Search history, or BYO API keys), and choose which layers to clear: your device, our cloud, or both. By default, both are checked. You’ll be asked to type your email to confirm when our cloud is one of the layers. There’s also a “Also remove from my other devices” option that propagates the delete to your other devices immediately on next sync — otherwise (default) those devices will prompt you before clearing their local copies.

Can I remove my data from this device only, not from the cloud?

Yes — uncheck “Wonderthrough’s cloud” in the Remove dialog, leaving only “This device” checked. You skip the email-confirmation step entirely — that field only appears when our cloud is part of what you’re removing. If you’re using Wonderthrough in your web browser, you won’t see a “This device” option — web browsers don’t keep these records on your computer, so there’s nothing local to remove.

What if I’ve had Sync off — do I lose those records?

The Remove dialog shows how many rows in your local copy haven’t yet reached our servers — typically because “Sync activity between desktop and web” was off when they were written. Removing those is permanent: they never reached our cloud and can’t be recovered. To preserve them, turn Sync on, wait one sync cycle, and then clear.

What does “Export usage history” include?

The Export… button on the AI usage row (in Settings → Privacy & Data → Manage your data) saves your usage history as a JSON file. What it contains depends on where you run it:

In the desktop app, it exports this computer’s usage records — every call made on this device, plus records synced from your other devices when Sync is on.
In your web browser, it exports your cloud usage history: your own usage records across your projects, including projects you’ve since deleted (those appear as “Deleted Project · …”). It does not include usage recorded only on a desktop computer that hasn’t been synced — if you use your own API keys or a local AI with Sync off, those records live only on that computer, so export them from the desktop app instead.

What about my Wonderthrough billing charges?

Charges billed through Wonderthrough’s platform keys (where Wonderthrough provides the AI access) are retained for 7 years as required by US tax and financial audit regulations. They stay visible in Settings → Billing → AI Usage regardless of what you remove from the Manage your data panel, and they survive Delete all cloud data as well. If you delete your account, those records are anonymized rather than deleted. New platform-key calls continue to log to the cloud after a Remove action — only your existing BYO API key and local-LLM rows are removed.

Your Account

What’s the minimum age to use Wonderthrough?

Wonderthrough is not designed for children. The minimum age depends on where you live: if you’re in the European Union, European Economic Area, or United Kingdom, you must be at least 16 years old to create an account (this matches the default under GDPR Article 8). Everywhere else, you must be at least 13 (the US COPPA baseline). We determine the tier from your browser’s timezone at signup and show the matching age attestation on the signup checkbox. We do not collect a date of birth, store your age, or ask for parental consent — the attestation is self-reported, and by creating an account you confirm you meet the minimum age for your region. If you’re a parent or guardian and believe a child under the applicable age has created an account, contact us and we will delete it.

What happens if I delete my account?

To delete your account, go to Settings → Account and use Delete your account. To remove everything from our servers while keeping your account, use Delete all cloud data in Settings → Privacy & Data → Your data. Either way you confirm by typing your email address and signing in again. Deleting the account sends you a confirmation email, and you have 48 hours to reverse the request — from the one-click link in that email, or from the banner shown in the app during the window. You can still email support@wonderthrough.com if you would rather we did it for you.

Your cloud data (manuscripts, entities, projects, AI results) is deleted from our servers. Your Stripe subscription is canceled. Your local data in the Wonderthrough desktop app remains on your computer — we have no access to it and it is unaffected by account deletion.

Some records are kept after deletion. Any feedback you submitted stays with us but has your account identity removed — a bug report is useful for fixing problems long after the person who reported it has moved on. Billing records, subscription history, and AI usage metadata are kept for 7 years for US tax and financial audit compliance, but their account/caller identifiers are replaced and direct Stripe/request lookup identifiers are irreversibly transformed. These records contain no manuscript content. An access-restricted legal-hold audit link is retained for 6 years and is then destroyed. Your Stripe customer record is retained separately by Stripe under its own data retention policy. For full details, see our Privacy Policy.

Who owns my work?

You do. Your manuscripts, characters, worldbuilding, and all creative content belong to you. AI-generated analysis results (synthesis summaries, enrichment findings, arc discovery) are also yours. Wonderthrough retains no rights to your content. Export is always available regardless of your plan status.