Privacy Policy

This Privacy Policy explains how Deft collects, uses, shares, and protects information when you use the website, writing console, account features, generation features, and related services.

We will update this policy as the product, infrastructure, or business model changes.

We collect information you provide directly, such as your email address, name, password credentials handled through our authentication provider, prompts, drafts, generated output, profile details, billing and subscription transaction metadata, and messages you send to us. Payment card details are handled by our payment processor rather than stored directly by Deft.

We also collect technical and usage information needed to run the service, such as session data, browser and device information, server logs, approximate request metadata, and information used to enforce signed-out generation limits. For signed-out visits and free generations, Deft applies a secret-keyed HMAC to the request IP address and stores only the resulting pseudonymous network identifier, not the raw IP address, in these ledgers.

We use information to provide the writing console, authenticate users, generate and save drafts, show account history, measure the signed-out audience in aggregate, enforce usage limits, secure the service, diagnose bugs, prevent abuse, respond to requests, and improve Deft. Where applicable, these audience-measurement and security uses are based on Deft's legitimate interests in understanding and protecting the service, subject to rights available under local law.

We may use prompts, drafts, output, and run metadata to troubleshoot and improve model behavior, product quality, safety, and reliability, unless a separate written agreement says otherwise.

When you ask Deft to generate or revise writing, your prompt and related request data are processed by Deft's generation pipeline and model providers. Depending on configuration, Deft may also use supporting model services for prompt optimization, output cleanup, and local developer-only evaluation tools.

Do not submit secrets, payment card data, government identifiers, health information, or other highly sensitive personal information unless Deft explicitly asks for it.

We share information with service providers that help us operate Deft, including hosting, authentication, database, payment processing, model inference, model assistance, scheduling, logging, security, and support providers. These providers may process information only as needed to provide their services to Deft.

We may also disclose information if required by law, to protect Deft or others, to investigate abuse or security issues, or as part of a merger, acquisition, financing, or sale of assets.

We keep account information, saved generations, and related product records for as long as needed to provide Deft, maintain account history, comply with legal obligations, resolve disputes, secure the service, and improve reliability.

Daily signed-out visit rows containing only the date, HMAC-hashed network identifier, and first-seen time are deleted after 90 days. Successful anonymous-generation ledger rows remain for their existing operational lifetime because they enforce the free-use allowance.

If self-serve deletion controls are not available, you can request deletion through the same Deft contact channel you used to reach us. Some records may be retained where needed for security, legal compliance, backups, or legitimate business records.

Deft uses cookies and similar browser storage for authentication, session management, security, and product functionality. The landing page and console may also use browser storage to save a local prompt draft and pass a prompt into the console when you choose to start a generation.

Deft does not use an analytics cookie or store an analytics identifier on your device for the signed-out audience measurement described above. Authentication cookies and functional browser storage remain in use.

Deft does not currently sell personal information or use third-party advertising cookies for targeted advertising.

We use reasonable technical and organizational safeguards designed to protect information, including authenticated access, server-side handling of sensitive generation keys, and role-based database controls.

No online service can guarantee perfect security. You are responsible for keeping your account credentials secure and telling us if you believe your account has been compromised.

Depending on where you live, you may have rights to request access, correction, deletion, portability, or limits on certain uses of your personal information. We will respond to valid requests as required by applicable law.

You can choose not to create an account, but some features may require sign-in. You can also choose not to submit sensitive or confidential material to the writing console.

Deft is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child provided personal information to Deft, contact us so we can take appropriate action.

Deft is operated from the United States. If you use Deft from another region, your information may be processed in the United States or other places where our providers operate.

We may update this Privacy Policy as Deft changes. If a change is material, we will take reasonable steps to notify users through the service or another appropriate channel.