Published privacy notice · Updated 10 October 2026
Website Privacy Policy
Effective and last updated 10 October 2026. This policy describes The Novelist website, downloads and Knowledge Base at /the-novelist/. The desktop application and independently operated payment services have separate policies.
Operator
Panos Sakalakis (Panagiotis Sakalakis), based in Greece, operates The Novelist website as an independent project.
Contact
For privacy requests, email [email protected] or use https://panossakalakis.com/contact/. The Contact page is separately operated in WordPress with Contact Form 7; support email is received and read through Hostinger Webmail.
Scope and dates
This policy covers browsing, documentation search, downloads, public supporter credits and links to support/payment services. Contact messages sent through the separate WordPress page are also described below. It is not a privacy audit of every page on panossakalakis.com. Read the Application Privacy Policy for desktop writing, licensing and optional app analytics.
Information you provide
The inspected static pages do not collect accounts, manuscript uploads or on-page payments. If you contact the operator, your message, contact details and attachments are processed to respond. Send only information needed for your request.
Technical requests and hosting logs
Hostinger hosts the website and License API. Page, asset and download requests expose an IP address, request time, URL, browser headers and potentially a referrer to the serving infrastructure. The serving infrastructure includes an hcdn layer. The operator has not verified every log, server country or hosting subprocessor setting; this policy makes no EU-only processing or zero-logging promise. Hosting providers may process technical records for operation and security under their terms. See https://www.hostinger.com/legal/privacy-policy.
Cookies and local preferences
The inspected site stores language and light/dark preferences using tn-site-lang and tn-site-theme in browser localStorage. It does not deliberately set analytics/advertising cookies. Clear site data in your browser to remove these preferences. This does not guarantee the absence of hosting-injected cookies or cookies on the separate WordPress Contact page.
Analytics and tracking
The website uses Umami Cloud analytics on the Free Hobby plan, whose published Cloud retention is six months (https://umami.is/pricing). Website analytics are separate from optional Aptabase analytics in the desktop app. Umami receives page-visit/browser/device metadata and network requests; technical network information is visible to the recipient. Umami describes its analytics as cookieless. The account data region and any exported-copy retention have not been independently verified; no universal anonymity or EU-only guarantee is made. See https://umami.is/privacy. Knowledge Base search filters bundled articles in your browser without sending the typed query to a search service. Ordinary page visits can still generate analytics and hosting requests. The separate WordPress Contact page includes OneSignal and Cloudflare Turnstile scripts and Google Tag Manager/Microsoft Clarity references. These observations do not establish whether every service is active or its configuration; this website policy does not claim that the Contact page is tracker-free.
Fonts, images and embedded services
The website uses local images/assets and system fonts; the new pages embed no payment widgets, videos, social tracking or remote fonts. Following an external link makes a separate request to that service, which may process its own cookies and network metadata.
Contact and support
Messages and attachments you choose to send are processed to answer and investigate your request. Do not send passwords, full license tokens, API keys or complete manuscripts with an initial request. Contact Form 7 handles the form and Hostinger Webmail handles the received email. Contact Form 7 itself does not store submissions, but plugins such as Flamingo can add database storage (https://contactform7.com/save-submitted-messages-with-flamingo/). Additional storage/SMTP plugins and all administrator access have not been independently verified; no promise that email is the only copy is made. Ask [email protected] about access or deletion.
Downloads
The installer is a public file request, not a workspace upload. Distribution servers can log technical requests. Downloading software does not enroll you in analytics; app consent is separate. Application binaries and update metadata are outside the scope of the website implementation changes.
Donations and payments
Ko-fi and Buy Me a Coffee process donations on their own services. The microsite does not collect card details. The operator may receive donor/payment records according to the platform and your choices. Review https://more.ko-fi.com/privacy and https://buymeacoffee.com/privacy-policy. Donations do not automatically activate Pro.
Public supporter credits
The Donate page displays supporter names or abbreviated display names, contribution amounts and the donation platform to acknowledge support. It does not publish customer email addresses, addresses, payment-card details or complete transaction records. You can object to a public credit or request correction/removal at [email protected]. Removing a public credit is separate from retaining necessary purchase or accounting records.
Gumroad purchases and affiliates
Gumroad handles Pro purchases and referral attribution/payouts under its rules. The operator may receive purchase/license administration information. Affiliate cookies or tracking on Gumroad are separate from this microsite. See https://gumroad.com/privacy. Affiliate participation, commission and payouts depend on the actual Gumroad product and program terms; no fixed commission is guaranteed by this policy.
Purposes and legal bases
Purposes include providing the website and downloads, answering support, protecting the service, acknowledging contributions and administering purchases/licenses. Contract-related processing supports purchased services; accounting obligations may require records; optional app analytics use consent. For support, security and public recognition, the operator relies on legitimate interests where applicable, subject to your rights and the circumstances of processing. Nonessential tracking must have an appropriate lawful basis and any required consent. This notice is not a certification of legal compliance.
Recipients and processors
Relevant recipients include Hostinger for hosting and support email, Umami for website analytics, the support-form infrastructure, and the payment platform you choose. Hosting/support administrators may have access needed for their duties; a full access roster is not independently verified. Provider responsibilities, subprocessors and safeguards depend on the service and contract; payment platforms also act for their own purposes. No claim is made that all third parties are interchangeable processors.
International transfers
Provider data locations and transfer safeguards depend on the actual service/account configuration. Hostinger, Umami and external support/payment providers may use international infrastructure. The operator has not independently verified every account region or transfer arrangement; this policy does not promise that all data stays in the EU. Consult provider terms and contact the operator for information about your processing.
Retention
Browser language/theme preferences persist until you clear site data. Current practice: support messages, server logs, customer/license records and server backups have been kept for at least two years and may remain indefinitely; a maximum period and automatic deletion procedure have not yet been verified. Planned improvements, approved on 10 October 2026 but not yet operational: support messages 24 months after case closure; routine logs 30 days; operator-controlled backups at most 90 days; license administration records while needed for the license plus 24 months afterward. Required accounting records and documented legal holds are separate. These planned limits are not a promise that existing records are already being deleted on that schedule. Contact [email protected] about a specific record or deletion request; necessary legal or service obligations may limit deletion. Provider-controlled records follow the relevant provider terms.
Security
HTTPS is used for public and supplied payment links; access controls and hosting protections support operation. Security is not absolute. Do not send secrets in URLs or public bug reports. Backups and administrative access require appropriate protection and operator verification.
Your rights
Where GDPR applies, rights may include access, correction, erasure, restriction, portability, objection and consent withdrawal, subject to applicable limits and lawful retention obligations. Contact the operator through the contact page, explaining the processing concerned; requests may need proportionate identity verification.
Complaints
You can complain to the Hellenic Data Protection Authority at https://www.dpa.gr/ or your relevant supervisory authority. This policy does not waive legal rights or certify compliance.
Changes and related policies
Material changes will be reflected in the updated date and policy text. Read the separate Application Privacy Policy for local writing, licensing, AI and optional usage analytics. Planned retention improvements will be described as operational only after they are put into practice.