Privacy Policy
Data controller: Bubblecraft AB (Swedish limited company, org. no. 559204-8200), Österkvarn 152, 790 23 Svärdsjö, Sweden.
Data-protection enquiries: privacy@bubblecraft.se · General enquiries: info@bubblecraft.se
Applies to: the writing-coach apps at sakprosa.nu, exposi.app and sachstil.de.
Last updated: 2026-09-12
No data protection officer is designated — Bubblecraft AB's core activities do not require one under Art. 37 GDPR. All data-protection questions, requests and complaints go to privacy@bubblecraft.se.
Your text stays on your computer
Everything you write is stored in your own browser's local storage. Your text and your settings are never saved in any online system of ours. There is no account, no sign-up and no upload of your documents.
To remove everything, clear this site's data in your browser settings.
What happens when you request an analysis
To analyse your text we send it to our server and on to our AI provider, Together AI, which returns the suggestions you see on screen.
- The text is processed to produce that analysis. It is not stored by us, and our Together AI account is configured so that prompts and responses are not stored, not used to improve or train their models, and not routed on to third-party model providers.
- Together AI therefore receives the full text of what you are working on. This is the one thing you should know before using the tool: do not paste in text you would not send to an AI service.
- The analysis also takes into account the language you write in, the type of text you chose, and any sources or reference passages you have added, so the analysis fits your context.
About what you send: the service does not require special-category data — health, political opinions, biometric data. If your text contains such data, submitting it is your responsibility; it is processed only in real time while we fulfil your request and is never stored. If your text contains the personal data of other people — a client, a colleague, a student — you remain the data controller for that data and are responsible for having a lawful basis to submit it.
Hosting
The apps are hosted on Firebase (Google). The frontend is static. Our own server functions run in Google's europe-north1 region (Stockholm), and every request — including the AI call — goes through them. No document content is logged by us; only the standard request data that Firebase logs for HTTP traffic (such as IP address, browser type, request and status) is recorded, and it is used for security, abuse prevention and operating the service.
Statistics
We measure traffic with Firebase / Google Analytics, for product improvement and quality purposes — to understand how the tool is used and where it falls short. This is switched on only after you accept in the cookie banner, and it measures usage, not your text: no document content is sent to analytics. See the Cookie Policy.
Google Analytics does not log or store the IP addresses of visitors from the EU, Switzerland or the UK: the address is used only to derive approximate location (country, region, city) on European servers and is discarded immediately afterwards. Approximate region and device type are the only things we see from it, in aggregate. We do not use the data to identify you, to build a profile of you, or to merge it with anything else.
Experiments
To improve the service we may in future show different versions of a feature or of wording to different visitors, and measure which works better. Your version is chosen locally in your own browser from a random value that we never receive. We measure, in aggregate and without identifying you, which version is used, through the analytics you have allowed and the standard logs of how the service is used. No text of yours is ever part of this.
Feedback you choose to send
When a note seems wrong, you can give feedback and tell us why. To make that useful to us, we send the flagged passage, the note and your description to our AI provider. It writes a short, anonymised summary and is instructed to leave out names, contact details, links, organisations, dates and anything else that could identify a person, a place or a document. You then see the summary and can edit it: you decide what is sent, and whether anything is sent at all. The flagged passage and your description are not stored. We keep the summary you send for at most 12 months, then delete it — or sooner if you ask. Keeping the summary rests on your consent (Art. 6(1)(a)), which you can withdraw by asking us to delete it.
Legal bases (GDPR Art. 6)
| Processing | Basis |
|---|---|
| Storing and restoring your text in your browser | Necessary to provide the service you asked for — Art. 6(1)(b) |
| Sending the text to the AI provider for analysis | Necessary to provide the service you asked for — Art. 6(1)(b) |
| Standard server logs | Legitimate interest in a secure, functioning service — Art. 6(1)(f) |
| Analytics cookies | Consent — Art. 6(1)(a) |
| Turning your flagged passage and description into an anonymised summary | Necessary to provide the feedback you asked for — Art. 6(1)(b) |
| The feedback summary you choose to send | Consent — Art. 6(1)(a) |
Who else sees data
Only our two processors: Google (Firebase Hosting and Cloud Functions; Google Analytics) and Together AI (runs open-weight language models; no other model provider is involved), each bound by the data-processing terms that are part of their standard terms of use. For Google Analytics, Google is additionally bound by its Data Processing Addendum (DPA). Together AI in turn uses the sub-processors listed in its own terms, under contract for the same level of protection and with liability resting on Together AI. Beyond that, personal data reaches the authorities only if we are legally obliged to disclose it — and both vendors have undertaken to tell us about a legally required request for your data before complying, unless the law forbids them to. We never sell personal data and we do not run advertising or track you across other websites.
Transfers outside the EU/EEA
Hosting and server functions are inside the EU. Google and Together AI are US-based companies, so data they process can involve a transfer outside the EU/EEA. We use whichever mechanism fits each recipient:
- Google transfers rely on the EU–US Data Privacy Framework: Google LLC is certified under the framework, so the European Commission's adequacy decision (Art. 45 GDPR) applies.
- Together AI transfers rely on the Standard Contractual Clauses (Art. 46(2)(c) GDPR), which Together AI's data-processing terms incorporate directly — Module 2 (controller to processor), with Swedish law and Swedish courts governing, and IMY as the competent supervisory authority. Together's account settings supply the practical safeguards: no prompt storage, no training, no routing to other model providers.
A copy of the clauses can be requested from privacy@bubblecraft.se. When we end a processing relationship, the clauses require the data to be deleted, and we do not transfer data to any processor whose terms do not give us this protection.
How long we keep things
| Data | Where | Kept until |
|---|---|---|
| Your text, settings, sources, established truths, last analysis result | Your browser only | Until you reset in the app or clear the site's browser data |
| Text sent for analysis | Not stored — in transit only | Ends with the request |
| Analytics data | Google Analytics | Until the property's retention period expires (we set the shortest period available); we do not hold this data ourselves |
| Flagged passage and description sent to make the feedback summary | Not stored — in transit only | Ends with the request |
| Feedback summary you chose to send | Our product records | At most 12 months, then deleted — or immediately on your request |
Your rights
You can ask us to access, correct, delete or restrict the processing of your personal data, to port it, to object, or to withdraw consent you have given. Since almost all of your data is in your own browser, deleting it is usually something you can do yourself in a second — but if you want anything handled on our side, write to privacy@bubblecraft.se and we will respond within one month.
Withdrawing consent is as easy as giving it: use the Cookie settings link in the footer of any page to reopen the banner and change your answer, with no need to touch browser settings or contact us. Clearing this site's data in your browser does the same thing. Withdrawal takes effect immediately and does not affect the period before it.
You also have the right to complain to a supervisory authority. In Sweden that is IMY — Integritetsskyddsmyndigheten (imy.se); in other EU/EEA countries, your local authority.
Children
The apps are not directed at children: if you are under 16, do not use the apps (see also the Terms of Use). We knowingly collect nothing from anyone: there is no account and no profile.
Changes
If we change this policy in a way that matters to you, we will update the date above and say so in the app. See also the Cookie Policy.