Privacy policy
Lanternwright makes software that keeps people's data on their own devices. This policy covers this website and, in one section per product, what each Lanternwright product handles.
The short version
- This website sets no cookies, runs no analytics or tracking, and loads nothing from other companies' servers.
- Lanternwright products are built to keep people's data on their own devices. Each product's section below lists what it keeps and every time it can use the network.
- Personal data is never sold, rented or used for advertising.
Who this policy is from
This policy is published by Lanternwright LLC, which runs lanternwright.com and makes the products listed on it. It can be reached at support@lanternwright.com.
What this website collects
- Nothing from simply browsing. No cookies, no analytics, no fingerprinting and no third-party scripts, fonts or images.
- Standard request data that every web host receives (the visitor's IP address, browser type and the page requested). Cloudflare Pages (Cloudflare, Inc.) handles it to serve and protect the site.
- The light or dark theme choice, only if the theme switch is used. It is saved in the browser's own storage, never sent anywhere, and clearing the browser's site data removes it.
- Joining a waitlist by email means sending an email from your own email app. The address and message arrive in the studio's inbox like any other email.
- If you join a waitlist with the form, three things are stored with Cloudflare Workers KV (Cloudflare, Inc.): the email address, the product chosen and the time of signing up. Nothing else is stored with them: no name, no IP address.
- Anything you choose to send by email to support@lanternwright.com.
Services that handle data
These services process data for the website. Each one has its own privacy policy.
- Cloudflare Pages (Cloudflare, Inc.)
- Hosts and serves this website. Like any web host, it receives each visitor's IP address and browser details with every request. Its privacy policy.
- Migadu (Migadu-Mail GmbH, Switzerland)
- Receives email sent to support@lanternwright.com and delivers it to the studio's inbox.
- Resend (Resend, Inc., United States)
- Sends the email this site generates automatically, such as the license code after a purchase. It receives the address the message is going to.
- Cloudflare Workers KV (Cloudflare, Inc.)
- Stores the email address, product choice and signup time of each person who joins a waitlist with the form on this site.
How it is used
- Waitlist addresses: to send one email when the chosen product launches. Nothing else is sent to them.
- Email sent to the studio: to read and answer it.
- Request data: so the host can deliver pages and keep the site secure.
How long it is kept
- Waitlist emails: until the launch email for that product is sent, then deleted, or sooner on request.
- Waitlist entries from the form: until the launch email for that product is sent, then deleted, or sooner on request.
- Email sent to the studio: as long as needed to answer it, and deleted on request.
- Request data: kept by Cloudflare Pages (Cloudflare, Inc.) under its own policy. This site keeps no logs of its own.
Purchases
Chapterglass is sold on this site, with payments processed by Stripe (Stripe, Inc.). The payment processor takes payment and handles card details directly; Lanternwright receives only the buyer's email address and what was bought, to deliver the license and give support. The payment processor also handles tax calculation and collection automatically through Stripe Tax. Lanternwright contributes 1% of revenue to carbon removal through Stripe Climate.
Weregild is sold through GitHub. That store handles the purchase under its own privacy policy, and Lanternwright sees only what it shows to sellers, to deliver the product and give support.
What is never done
- Selling or renting personal data.
- Advertising or ad tracking.
- Sharing data with data brokers.
- Sending email nobody asked for.
Products
Every product below is in development and not yet available, so none of them has collected anything yet. Each section describes the product as it is built today and will be checked again before that product launches.
Netkeep
Sales, costs, receipts and trips stay in the browser's storage on your device. There's no Netkeep server, so the records have nowhere else to go.
What it keeps on the device
- Sales, order lines, fees, refunds, shipping labels and marketplace-collected sales tax from imported reports (only the columns Netkeep needs)
- Purchases, lots and items, with costs, sources, dates and statuses
- Receipt photos, re-encoded on save with location and camera data removed
- Expenses and trips (dates, purposes, places and miles)
- Custom fee and mileage rates, saved column layouts, import history and settings
- The license, if one is added. It holds a one-way fingerprint of the email it was issued to, never the email itself.
What it never keeps
- Buyer names, usernames, emails, phone numbers and addresses found in marketplace reports. They are dropped before anything is saved.
When it uses the network
These are the only times Netkeep uses the network. Anything not listed here never leaves the device.
- Update check
- When: Off until you turn it on.
- What is sent: A plain request for one small file, about once a week or on Check now, with no cookies, no identifiers and none of the records. Like any web request, the host can see the IP address.
- Sent to: The Lanternwright update host.
What reaches Lanternwright
Nothing. Netkeep sends no data to Lanternwright.
Telemetry
None. Netkeep has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Records stay in the browser's storage until they are deleted, and Netkeep asks the browser not to clear them; a browser can still clear best-effort storage on its own, and Safari cannot be asked not to. Delete everything removes it all. Backups and exports are files saved wherever you choose.
Caption Glass
Audio is processed in memory on the PC and never written to disk or sent anywhere. Captions are saved only if history is turned on, and only on that PC.
What it keeps on the device
- Settings and the license
- Caption history, only if it's turned on. It stays on the PC and expires automatically after a chosen length of time.
What it never keeps
- Audio from the microphone or from what the PC plays
When it uses the network
These are the only times Caption Glass uses the network. Anything not listed here never leaves the device.
- Speech model download
- When: Only when you ask for it.
- What is sent: A download request for the chosen speech model. The file is checked against a pinned checksum. Nothing personal, and no audio, is sent.
- Sent to: The host of that speech model.
- Dictation cleanup (Pro)
- When: Off until you turn it on.
- What is sent: Dictated text, to be tidied before it is typed
- Sent to: A chosen server, on the same PC unless another is explicitly allowed.
What reaches Lanternwright
Nothing. Caption Glass sends no data to Lanternwright.
Telemetry
None. Caption Glass has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Caption history, if turned on, expires automatically and can be cleared at any time. Nothing else about use of the app is kept.
Counter
Nothing leaves the device. The numbers are typed in by hand, so the offer letter itself is never uploaded.
What it keeps on the device
- Offers and the current job as typed, ask inputs and display preferences
- Settings
- The private outcome log
What it never keeps
- Anything typed on the Practice page. It stays in the page's memory for that visit only.
When it uses the network
These are the only times Counter uses the network. Anything not listed here never leaves the device.
- Update check
- When: Not active in current builds.
- What is sent: In a build that has an update address, a plain request for one small file at most once a day, with no identifiers. It can be turned off in Settings.
- Sent to: The Lanternwright update host.
- Rewording with a local language model
- When: Off until you turn it on.
- What is sent: The text of one script and the model name
- Sent to: A model running on the same device (only local addresses are accepted).
What reaches Lanternwright
Nothing. Counter sends no data to Lanternwright.
Telemetry
None. Counter has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Everything stays in the browser until it's deleted. Delete everything removes it all after a confirmation.
Kindstart
Tasks, steps, notes and focus sessions stay in one file on the PC, and it doesn't send crash reports or usage data anywhere.
What it keeps on the device
- Tasks, steps, notes, lists, focus sessions, settings and routines, in one file on the PC
- The Pro license, if one is added. It holds a one-way hash of the email used to buy it, never the address.
- Window positions and the time of the last update check
When it uses the network
These are the only times Kindstart uses the network. Anything not listed here never leaves the device.
- Update check
- When: On by default, and you can turn it off.
- What is sent: A request for the newest version number, with no identifiers. It never installs anything. It is explained on the first-run screen and turns off with one switch.
- Sent to: The Lanternwright update host.
- Try local AI (Pro)
- When: Off until you turn it on.
- What is sent: One task's title and notes, only when the button is pressed
- Sent to: The chosen AI server, such as Ollama, LM Studio or KoboldCpp on your own PC.
What reaches Lanternwright
Nothing. Kindstart sends no data to Lanternwright.
Telemetry
None. Kindstart has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Everything stays on the PC until it's deleted. Delete everything removes every task, step, session and setting, and uninstalling offers to remove the data folder.
Also worth knowing
- Kindstart has no fields for health information and never asks for any.
Readglass
Readglass works inside the browser and collects nothing about the reader or what they read.
What it keeps on the device
- Settings: font, spacing, line focus, colors, theme, voice and speed, pronunciation dictionary, and the simplify address and model name
- The list of sites set to always on or with their own settings
- Profiles
- The Pro license key, if one is entered. It holds a one-way hash of the email used to buy it, not the address.
What it never keeps
- Anything about sites visited in private windows
When it uses the network
These are the only times Readglass uses the network. Anything not listed here never leaves the device.
- Online read-aloud voices
- When: Off until you turn it on.
- What is sent: The text being read aloud. The browser sends it to the voice's provider. Online voices are labeled and need a one-time opt-in.
- Sent to: The provider of the chosen online voice.
- Simplify a paragraph (Pro)
- When: Off until you turn it on.
- What is sent: The chosen paragraph, only on request
- Sent to: A language model server you run or choose.
What reaches Lanternwright
Nothing. Readglass sends no data to Lanternwright.
Telemetry
None. Readglass has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Everything is kept in the browser's extension storage until it's reset or the extension is removed.
Prop Press
Nothing made in it leaves the device, and the page's security policy blocks every network connection it doesn't need.
What it keeps on the device
- The current draft, images included, in the browser's storage
- Theme and printing preferences
- The license and any installed template packs
When it uses the network
These are the only times Prop Press uses the network. Anything not listed here never leaves the device.
- Update check
- When: On by default, and you can turn it off.
- What is sent: Only in builds that include it: one small file at most once a day, with no cookies, referrer or identifiers. It is explained on first run, waits a day before its first check, and can be turned off.
- Sent to: The Lanternwright update host.
What reaches Lanternwright
Nothing. Prop Press sends no data to Lanternwright.
Telemetry
None. Prop Press has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Kept in the browser until removed: Remove license, Remove pack, or clear the browser's site data.
Also worth knowing
- Project files, PNGs, PDFs and Foundry journals are made only when an export is clicked, and go wherever they're saved.
Pacing Companion
Nothing entered in it leaves the device, except a file you choose to save or share. The app doesn't make network requests of its own.
What it keeps on the device
- Check-ins: energy, symptoms, crash or flare marks and notes
- Energy envelope plans and activity costs
- Settings, and the supporter code if one is added
When it uses the network
Never. Pacing Companion makes no network requests of its own.
What reaches Lanternwright
Nothing. Pacing Companion sends no data to Lanternwright.
Telemetry
None. Pacing Companion has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Kept on the device until it's deleted. Delete everything removes it all.
Also worth knowing
- A separate consumer health data policy will be published on this site before Pacing Companion launches.
Shelfmend
Shelfmend runs locally, collects nothing, and only ever talks to your own Audiobookshelf server, and only when asked.
What it keeps on the device
- The config file, if one is created
- Plans, the undo journal and reports, in its state folder
- Quarantined copies, until purged
- metadata.json files in book folders, only when an author or series plan is applied to a folder library
What it never keeps
- The Audiobookshelf API token, in any file. It is read from an environment variable and never printed or logged.
When it uses the network
These are the only times Shelfmend uses the network. Anything not listed here never leaves the device.
- Audiobookshelf API mode
- When: Only when you ask for it.
- What is sent: Requests to read the libraries and, when a plan is applied, to edit metadata or remove duplicate records
- Sent to: Your own Audiobookshelf server, and no other address.
- Series name lookups
- When: Off until you turn it on.
- What is sent: Search terms only: a book title and an author
- Sent to: Your own Audiobookshelf server, which asks its metadata provider as it does for its own matching.
What reaches Lanternwright
Nothing. Shelfmend sends no data to Lanternwright.
Telemetry
None. Shelfmend has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Everything is on your own disk. Delete the state and quarantine folders to remove it.
Also worth knowing
- Reports can contain folder and file names. A redact option replaces every path, title, name and ID before one is shared.
Vault Herald
Vault Herald reads your files and writes plain files. It never touches the network.
What it keeps on the device
- Only the output it builds (the Foundry module and wiki folders), wherever it's told to write them
When it uses the network
Never. Vault Herald makes no network requests of its own.
What reaches Lanternwright
Nothing. Vault Herald sends no data to Lanternwright.
Telemetry
None. Vault Herald has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
The output files are yours. Delete them at any time.
Thingstead
Thingstead runs on your machine, reads transcripts without changing them, and keeps its index in the home directory. It sends nothing anywhere until something that needs to is set up, and everything it sends passes one redaction gate first.
What it keeps on the device
- Its search index and settings, in the home directory
- Tracker tokens, digest secrets and the hub key, in the operating system's keychain or a private credentials file
- The Pro license file, checked offline
What it never keeps
- Changes to transcripts. They are opened read-only and never written, locked or renamed.
When it uses the network
These are the only times Thingstead uses the network. Anything not listed here never leaves the device.
- Tracker linking
- When: Off until you turn it on.
- What is sent: Links and new cards, written only after you confirm the exact redacted payload
- Sent to: The connected tracker (GitHub Issues, Jira or Trello).
- Daily digest (Pro)
- When: Off until you turn it on.
- What is sent: A redacted summary of what the sessions did
- Sent to: The chosen destination, such as a Discord thread or an email address.
- Multi-machine hub (Pro)
- When: Off until you turn it on.
- What is sent: Redacted, signed session metadata
- Sent to: A hub you run.
- Language model titles and summaries (Pro)
- When: Off until you turn it on.
- What is sent: Redacted session text, under a daily cost cap
- Sent to: Your own command or API key.
What reaches Lanternwright
Nothing. Thingstead sends no data to Lanternwright.
Telemetry
None. Thingstead has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
The index lives on the machine until it's deleted. Rebuilding it re-reads the transcripts.
Also worth knowing
- Redaction is best-effort. Sessions you mark private never leave the machine.
Mimir
Mimir runs on your computer and turns speech into text there, so the table's voices stay in the room. Nothing about the game leaves that computer except through a feature that says so and has been turned on.
What it keeps on the device
- Live audio, in memory only while it is transcribed
- Recorded audio, only if recording is turned on, deleted after a set number of days
- Transcripts, recaps and a search index built from the vault
- Voiceprints, only when someone is enrolled for Pro speaker ID
- AI spend totals (amounts and counts only, no text)
- The license (a one-way hash of the buyer's email, not the email), and AI keys in the operating system's keyring
When it uses the network
These are the only times Mimir uses the network. Anything not listed here never leaves the device.
- AI answers and recaps
- When: Off until you turn it on.
- What is sent: The question asked, matching passages from the notes, the last few minutes of transcript and campaign context; for recaps, the session transcript. Every call is checked against the spend caps first.
- Sent to: The chosen AI provider, using your own key (Anthropic or an OpenAI-compatible service), or nobody when the model runs on the same PC.
- Discord voice feature
- When: Off until you turn it on.
- What is sent: The Discord user ID, so the bot can join the right channel. No audio is sent.
- Sent to: A Discord bot you run.
- Model downloads
- When: On first use.
- What is sent: Ordinary download requests for speech and search models, with nothing about the game
- Sent to: The model publishers' hosts (Hugging Face and GitHub).
What reaches Lanternwright
Nothing. Mimir sends no data to Lanternwright.
Telemetry
None. Mimir has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Recordings and transcripts can be deleted automatically after a set number of days. One command lists everything Mimir keeps and another deletes it.
Also worth knowing
- Transcribing people is recording them. The person running Mimir is responsible for getting the table's agreement, and Mimir prints a notice to share first.
Chapterglass
Everything stays on your device. There is no account, no server, no analytics and no tracking, and the maps you publish contact no server either.
What it keeps on the device
- Your projects and map images, in the browser's own database
- Your reading position for each book, your settings and which panels are hidden
- Your license code, if you add one
- A published map keeps each reader's chapter in that reader's own browser
When it uses the network
Never. Chapterglass makes no network requests of its own.
What reaches Lanternwright
Nothing. Chapterglass sends no data to Lanternwright.
Telemetry
None. Chapterglass has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Until you delete a project, or clear this site's data in your browser. Nothing is kept anywhere else.
Also worth knowing
- Published zips, pack files and the game master exports are made only when you ask for them, and go wherever you save them.
Weregild
Weregild runs on your own server and Lanternwright receives nothing from it. Every outside connection is off until you configure it.
What it keeps on the device
- The database: your household, people, accounts, transactions, splits, bills, goals, paychecks and settle-ups
- Logins, as salted password hashes; signed-in sessions last 90 days from the last visit
- A generated secret key that signs sessions
- Copies of the database made before an upgrade changes it (the newest three)
- Uploaded statement files only if you turn on keeping them; by default only the transactions, the file's name, size and fingerprint are kept
What it never keeps
- Bank passwords or any bank connection
- Statement files, by default: each is read from a temporary file and then gone
When it uses the network
These are the only times Weregild uses the network. Anything not listed here never leaves the device.
- Automatic categories (LLM)
- When: Off until you turn it on.
- What is sent: One sample description line per uncategorized merchant, and your category names
- Sent to: Anthropic's API, with your own key, only when you ask.
- Statement watch
- When: Off until you turn it on.
- What is sent: Your mailbox login, read-only
- Sent to: Your own mail provider.
- Notifications (webhook, ntfy, Discord, email)
- When: Off until you turn it on.
- What is sent: A title and one line: the institution, the last four digits and the due date; amounts only if you opt in
- Sent to: The webhook, ntfy server, Discord webhook or SMTP relay you set.
What reaches Lanternwright
Nothing. Weregild sends no data to Lanternwright.
Telemetry
None. Weregild has no telemetry, analytics or crash reporting, so there is nothing to opt out of.
Keeping and deleting
Everything is in the data folder on your server. Settings > Your data downloads all of it or deletes every record; stopping the container and deleting the folder removes Weregild entirely.
Also worth knowing
- Web pages load nothing from other servers: no web fonts, scripts or trackers from anyone else.
- Exports hold all of your financial data, so keep them private.
Your rights and choices
Anyone can ask what data is held about them, ask for it to be corrected or deleted, and withdraw consent at any time.
Requests sent to support@lanternwright.com get an answer within 30 days, at no charge.
Depending on where you live (for example the EU, the UK or California), there may be further rights, including the right to complain to a local data protection authority.
Children
This site and its waitlists are not meant for children under 13. If you believe a child has joined a waitlist, email support@lanternwright.com and the address will be deleted.
Changes to this policy
Changes are posted on this page with a new last-updated date. If a change would use your data in a new way, consent will be asked for first.
Contact
Questions or requests about privacy: