Privacy Policy

1. Who this is from

This policy is from First Verse ("we", "us"), which operates firstverse.app. It explains what personal information we collect, why, who else gets to see it, and what you can do about it. It applies to everyone who uses the site, whether or not you have an account.

2. What we collect

2.1 What you give us

• Account details. Your email address, and a hashed password if you set one. If you sign in with Google we receive your name, email address, profile picture and Google account identifier — never your Google password.
• Profile information. Your name, a short bio or title, a profile photo, a city and country, and any website or social links, if you add them. All of this is optional except a name.
• Your writing. The poems you post, their titles, and any comments you leave.
• Messages. What you send us through the contact form, and our replies. Both sides of that thread are shown back to you on your account page.
• Payment details. If you buy evaluation credits or pay to expedite a poem, Stripe collects and holds the card details. We receive a customer reference, the amount, and whether it succeeded. We never see or store your full card number.

2.2 What we record as you use the site

• Activity. Which poems you star, who you follow, which poems you save, and which poem pages you have opened (poets can see a count of readers on their own poems, not who they were).
• Technical logs. Your IP address, browser and device type, and the pages you request, in ordinary web-server logs. We store the IP address attached to a contact-form message as an anti-abuse measure.
• Email delivery records. For each email we send you, we log what kind it was, the address, the subject and whether it was accepted for delivery. We do not use tracking pixels to record whether you opened it.
• Referrals. If you arrive through someone's referral link, we record who referred you.

2.3 What we don't collect

We don't ask for your postal address, your phone number, your date of birth, or your government ID. We don't buy personal data about you from data brokers, and we don't build advertising profiles on you.

3. Why we hold it

• To give you an account and keep you signed in.
• To publish your poems and show them to readers.
• To run the automated checks described in section 4, so the site isn't a dumping ground for other people's work.
• To email you about things that happen to your account and your poems (section 7).
• To take payment for the optional paid features, and to keep records of those payments.
• To answer you when you write to us.
• To keep the site up, spot abuse, and understand roughly how it is being used.

If you are in a jurisdiction that requires a legal basis for each of these (such as the UK or EU), ours are: performance of a contract for running your account and publishing your work; legitimate interests for security, abuse prevention, moderation and basic analytics; consent for optional marketing email; and legal obligation for payment and tax records.

4. AI processing of your poems

Every human submission goes through automated checks before it can publish. Those checks look for content that breaks our posting rules, and for work that appears to be somebody else's.

Those checks are carried out by a third-party AI service — currently Anthropic's Claude API. To run them, we transmit the poem's title, text and the author name attached to it to that provider. We do not send your email address, your account identifier, or your IP address with it.

The same applies if you request a craft evaluation in the Studio: the poem is sent to the same provider to generate the evaluation, which is returned to you and shown to nobody else.

Under our agreement with the provider, this content is processed to return a result and is not used to train their models. We keep the check outcomes (scores, flags, a short note) attached to the poem in our own database so a person can review a decision later.

If you would rather your writing were never sent to an AI provider, please do not post it here. The checks are not optional — they are how the site stays usable.

5. Who else sees it

We do not sell your personal information, and we do not share it for anyone else's marketing. We share it with service providers who run parts of the site for us:

• Amazon Web Services — hosting, the database, file storage, and the sending of our email (Amazon SES). Your data lives on AWS infrastructure.
• Anthropic — the AI checks and evaluations described in section 4.
• Stripe — card payments for evaluation credits and expedited publishing.
• PayPal — where it is used to route a tip to a poet.
• Google — Sign-In (if you use it), Google Analytics (section 8), and Google Fonts, which receives your IP address as part of loading the page's typefaces.
• Content delivery networks (Google Hosted Libraries, cdnjs, unpkg) that serve a handful of JavaScript libraries, and which therefore see your IP address.

We may also disclose information if we are legally required to, or where we believe in good faith it is necessary to protect someone's safety or to investigate abuse of the site. If we are ever acquired or merged, account data would transfer with the business, and we would tell you before that happened.

6. What is public

Some things are public by design, and it is worth being clear about which:

• Your published poems, their titles, and the star counts on them.
• Your display name, profile photo, bio and any links you added.
• Comments you leave, with your name and photo attached.
• Who follows you, and how many people you follow.

Your email address is never shown publicly. You can switch your profile to private from your profile page, which also keeps it off the Poets list.

7. Email we send you

We send two kinds of email.

Service email is part of having an account and cannot be switched off while the account is open: confirming your address, resetting your password, telling you a poem published or is being reviewed, telling you someone commented on your work, and receipts for anything you paid for.

Optional email — anything promotional — is controlled by the subscription setting on your account page, and every one of those messages can be unsubscribed from.

8. Cookies and analytics

We use a small number of cookies:

• a session cookie, so the site knows you are signed in;
• a "remember me" cookie, so you stay signed in between visits;
• a dismissal cookie, recording that you closed the "install the app" prompt so we stop asking.

We use Google Analytics to see roughly how many people visit and which pages they read. It sets its own cookies and receives your IP address. We do not use it to identify you individually, and we do not run advertising or retargeting pixels anywhere on the site.

You can block or delete cookies in your browser. If you block the session cookie you will not be able to sign in.

9. How long we keep it

• Account and profile data — while your account exists.
• Poems and comments — until you delete them or your account.
• Contact messages — up to 3 years, so we have the history of a conversation if you write again.
• Moderation records — for the life of the poem, plus a short period after, so a decision can be reviewed.
• Email delivery logs — 12 months.
• Server logs — typically 90 days.
• Payment records — as long as tax and accounting law requires, usually 7 years.
• Backups — deleted data can persist in routine backups for a short period before those rotate out.

10. Deleting your data

Go to your account page and use Delete account in the Danger Zone. It clears your personal details and takes your poems down with it. It cannot be undone, so save anything you want to keep first.

A few things survive, and you should know which: anonymised aggregate counts, records we are legally required to keep (payment and tax records), and content other people have already saved or shared outside the site.

If you want something deleted without closing your whole account, write to us and we will do it.

11. Your rights

Depending on where you live, you may have the right to ask us for a copy of the personal information we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. If you are in the UK or EU you also have the right to complain to your data protection authority.

If you are a California resident: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.

To exercise any of this, use the contact form or write to support@firstverse.app. We reply within 30 days.

12. Security

Traffic to the site is encrypted with HTTPS. Passwords are stored hashed, never in plain text. Database credentials and API keys are held outside the public web root. Access to production data is limited to the people who run the site.

No system is perfectly secure. If we discover a breach affecting your personal information, we will tell you and the relevant regulator as the law requires.

13. Children

First Verse is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, tell us and we will delete it.

14. Where your data is held

Our servers and database are hosted in the United States on Amazon Web Services. Our service providers may process data in other countries. Where personal data is transferred out of the UK or EEA, that transfer relies on the appropriate safeguards (typically Standard Contractual Clauses) put in place with the provider.

15. Changes and contact

We will update this policy when what we do changes. The date at the top always reflects the current version, and we will tell registered users by email before a material change takes effect.

Questions, requests or complaints: use the contact form, or write to support@firstverse.app. Formal privacy notices can go to legal@firstverse.app.

Questions about your data? Use the contact form — it goes to a person.