Tomeholder

Privacy

What this software stores, why, and how to make it stop.

Who is responsible

Quiet Compass LLC is the data controller for Tomeholder.

8 The Green, Suite B, Dover, DE 19901, USA

Questions about any of this, and any request under the rights below, go to support@tomeholder.com.

What Tomeholder stores

Only what it needs to be the thing you bought. There is no analytics, no advertising, no profiling, no tracking cookie, and nothing here is ever sold or shared for marketing.

Your account — your email address, the display name you choose, and your password. The password is stored only as a scrypt hash; it is never written down in a form anyone can read, including us.
What you write — your worlds, folders and folio entries. The working copy lives in your own browser. A copy is stored on our servers so it survives a new device, and it is stored as written: we do not read it, index it or analyse it.
Images you upload, and how many bytes of them you are storing.
Counts — how many worlds and entries your archive holds, so the app can tell you what your tier covers.
Your purchase — the email address on the order and the license key issued against it.
A session cookie, so that signing in keeps you signed in. It is not used for anything else.
Crash reports — when something goes wrong in your browser, the error message, where in our code it happened, which part of the app you were in, which browser you use, and your account's internal number (not your email address), so that a problem you tell us about can be found. Deliberately not the contents of what you were writing.
Server logs, for a short period, to find faults and abuse.

Who else touches it

Tomeholder runs on services that necessarily see some of this. They process it on our instructions and for nothing else:

Railway — hosting, and the disk the database sits on.
Cloudflare R2 — where archives, images and backups are stored.
Sentry — crash reporting, configured to refuse the categories that could carry your writing, your password or your session.
Resend — password reset email, when it is configured.
Our payment provider — takes the payment and tells us which address to issue a key to. We never see your card.
Google Fonts — the typefaces the sign-in pages and the app are set in are loaded from Google's servers, which means Google sees your IP address when a page loads.

Why we are allowed to hold it

Your account, your archive and your purchase are processed to provide the thing you bought — the contract between us. Crash reports, rate limits and server logs are processed because we have a legitimate interest in the software working and in not being abused. We do not rely on consent for any of it, and nothing here is used to make an automated decision about you.

How long it is kept

Your archive is kept for as long as your account exists. Earlier versions of your archive are kept so that work can be recovered after a bad sync — hourly copies for 2 days and daily copies for 30 days.

Your data is removed from Tomeholder immediately. Backups are retained for up to 35 days and are used only for disaster recovery, after which they are permanently deleted.

Your rights

See it — ask us for a copy of what we hold about you.
Take it with you — the app exports your entire archive to a file from Settings, at any time, without asking us.
Correct it — ask us to fix anything that is wrong.
Delete it — Settings → Account → Delete account removes your account and erases your archive and images. You do not have to ask permission and you do not have to go through us.
Object to processing we do on the basis of legitimate interests.
Complain to your data protection authority if you think we have got this wrong.

Any request that does need us goes to support@tomeholder.com, and we will answer within one month.

Where it is

Tomeholder's servers and storage are operated by the providers named above and your data may be processed outside your own country, including in the United States. Where that happens it is covered by the standard contractual protections those providers offer.

Age

Tomeholder is for people aged 16 and over, and the Terms of Use ask for that when an account is made. We do not knowingly hold data about anyone younger. If you believe a child under 16 has an account, write to support@tomeholder.com and we will delete it.

Changes

If this policy changes in a way that matters, the date below changes and we will say so in the app rather than quietly editing the page.

Last updated 5 October 2026.

Back to the archive · Terms of Use