Privacy policy

Last updated 11 October 2026

Who we are

The Department of Second Drafts ("we", "us") runs seconddrafts.com, a collection of free writing tools. To ask us anything about your data, email privacy@seconddrafts.com or write to us at [Postal address].

Children

This site is not directed at children, and we don't knowingly collect personal data from children under 13. If we learn that we have, we will delete it.

What we don't do

There are no accounts, and we don't ask for your name or email address.
We don't show advertising or track you across other websites.
We don't sell your data.
We don't use personal data to train AI models.
We don't receive what you write. It stays on your device, and when a tool makes a share link, the link carries your text after the # in the address, which browsers never send to a server.

Hosting

GitHub Pages serves this site. When you visit, GitHub Pages logs your IP address for security and to keep the service running, as described in its privacy statement. Our legal basis is legitimate interest: a website can't be delivered or protected without this. GitHub keeps these logs; we don't receive them.

Analytics

If you accept, we use Google Analytics to understand which tools and settings people use, so we know what to improve. Our legal basis is your consent. Nothing is loaded until you accept, and you can withdraw consent at any time.

In plain terms, we record which tool settings you use, roughly how long your text is (in ranges of word counts), how you reach the site, how long you use a tool, and your device type. We never record what you write. Google also receives what it collects automatically, such as your IP address and browser details. For the cookies involved and how long they last, see the cookie policy.

The exact events we send

tp_completed: duration_s, reached_end, word_bucket
tp_engaged: duration_s, word_bucket
tp_fake_door_clicked: feature
tp_fake_door_interest: email_provided, feature, interested
tp_page_view: landing_source, referrer_domain
tp_play: play_count, word_bucket
tp_prompt_started: font, mirror, speed, theme, word_bucket
tp_script_entered: source, word_bucket
tp_setting_changed: setting, value
tp_share_link_copied: too_long, word_bucket
tp_share_link_opened

Every event also includes: device_type.

Who we share data with

GitHub Pages (Strictly necessary). Decides for its own purposes how it uses the data it receives. Privacy policy
Google Analytics (Analytics). Handles data on our behalf, under our instructions. Privacy policy

We may also disclose personal data:

To comply with the law, a court order or a government or regulatory request.
To protect the rights, property or safety of us, our users or others.
To a successor, if we are part of a merger, acquisition or sale of assets.

International transfers

These companies may process data outside your country. We rely on the following safeguards:

GitHub Pages: EU–US Data Privacy Framework
Google Analytics: EU–US Data Privacy Framework

Your rights

Depending on where you live, you may be able to ask us for access to the personal data we hold about you, to correct or delete it, to restrict or object to how we use it, to receive a portable copy, and to withdraw your consent. If you are in the EU or UK, you can also complain to your local data protection authority. We don't sell personal data or use it for targeted advertising, so there is nothing to opt out of.

To exercise a right, email privacy@seconddrafts.com. Analytics data is linked only to a random ID stored in your browser, not to your name, so we usually can't find one person's data. If you want us to try, tell us the value of the _ga cookie from your browser. Turning analytics off in the cookie settings stops any further collection.

If you are in the EU or UK, our legal bases are your consent for analytics, and our legitimate interest in running and securing the site for hosting. If a browser sends a Global Privacy Control signal, we treat it as a refusal of analytics. We don't respond to Do Not Track, as there is no common standard for it.

Security

We use reasonable measures to protect personal data from loss and unauthorised access. No system is completely secure, so we can't guarantee the security of anything sent over the internet.

How long we keep data

We keep personal data only as long as we need it for the purposes above. The cookies we set last as long as the cookie policy says, and you can delete them at any time in your browser.

Changes to this policy

We update this page when what we collect or who we share it with changes. The date at the top shows the latest change.