Privacy policy

Kerouac is a writing studio. We only collect what we need to run the product for you:

• Account. Email address (magic-link sign-in) or Google account details when you use Google sign-in. Auth is handled by Supabase Auth.
• Profile. Username, optional bio and profile links, avatar, weekly writing goal, digest and streak-reminder preferences, and whether your profile is public.
• Connected platforms. Feed or site URLs you connect (Ghost, Substack, Medium, Micro.blog, YouTube, or any RSS feed) so we can sync your publishing activity.
• Synced posts. Metadata pulled from those public feeds: title, URL, publish date, platform, a stable post id, and word count. We do not store full post bodies from your external blogs.
• Writing studio content. Drafts on your kanban board, idea-inbox cards (including link previews you save), research notes and images, and tags. This content stays private to your account.
• Social graph. Who you follow, and share-link snapshots of your activity graph when you create one.
• Billing. Subscription status and Stripe customer / subscription ids. Card numbers and payment details are collected and stored by Stripe, not by Kerouac.
• Local preferences. Theme and a few UI flags (for example, skipping onboarding) live in your browser's localStorage.

We use your data to:

• Authenticate you and keep your session signed in
• Sync and display your publishing heatmap, streaks, and insights
• Power the writing board, idea inbox, and research shelf
• Show your public profile at /u/username when you leave it public
• Process subscriptions and enforce the free trial / paywall
• Send optional digests and streak reminders via email (only when you opt in)
• Operate and secure the service (crons, webhooks, abuse prevention)

We do not sell your personal data. We do not run third-party ad trackers on Kerouac.

Data is processed by a small set of infrastructure providers:

• Supabase — database, authentication, and file storage (avatars, idea and research images)
• Vercel — application hosting and scheduled jobs
• Stripe — checkout, billing portal, and payment processing
• Resend — transactional email (digests and streak reminders), when those features are enabled

When you connect a platform, Kerouac fetches that platform's public feed or sitemap over HTTPS. We pull publishing metadata in; we do not push your drafts or account data back to those platforms.

• All traffic to Kerouac is served over HTTPS.
• Database access is gated with Supabase Row Level Security: private rows (drafts, ideas, research, connected feeds, raw post rows) are readable and writable only by their owner.
• Public profile pages expose only what you choose to publish — username, optional bio and links, aggregated activity, and recent post metadata — never your drafts or inbox.
• Subscription writes come from the Stripe webhook with a service role key; the browser cannot grant itself paid access.
• Session cookies are managed by Supabase Auth. An httpOnly entitlement cookie caches a short-lived positive access check and is HMAC-signed with a server secret.
• Payment card data never touches Kerouac servers; Stripe handles it end to end.

If your profile is public, anyone can view your activity graph, totals, and recent published-post metadata at your profile URL. Share links you create for a graph snapshot are also reachable by anyone with the link. Uploaded avatars and idea/research images are stored in public storage buckets so the product can display them; treat uploads as potentially discoverable by URL.

You can set your profile to private from Profile settings. Private profiles are not shown on the public profile page.

We keep your account data while your account is active. Connected-platform and studio content is stored until you remove it or delete your account. Billing records may be retained as needed for accounting and fraud prevention, in line with Stripe's retention practices.

To delete your account and associated personal data, email joan@joanwestenberg.com from the address on your account. We will confirm and remove your Kerouac data from our systems.

Kerouac is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.

If this policy changes in a material way, we will update this page and revise the "Last updated" date below. Continued use of Kerouac after an update means you accept the revised policy.

Questions about privacy, data access, or deletion: joan@joanwestenberg.com. Kerouac is operated by Westenberg at kerouacapp.com.