Privacy policy

Last updated: November 2026.

The short version

• No account is needed to write stories. Without an account we don't store your prompts or stories; they exist only in your browser tab.
• If you create an account, we store your email address and, if "Keep history" is on, the stories you write, in a private library only you can see. You can turn history off, delete stories, or delete your account at any time.
• Your prompt and settings are sent to our AI provider to write the story. We never use stories to train models, and we never publish a story unless you choose Publish to library.
• Published stories are public: anyone can read them, and once they've received a vote, search engines can index them. Your email and account are never shown; the author appears as "a Smutty reader". You can unpublish at any time.

What we store

• Account (optional): your email address, token balance and token history, and your story library (title, settings and chapters). Sign-in uses one-time email links; we don't have a password to leak. Deleting your account removes all of this.
• Session cookie (sm_sess, HttpOnly) to keep you signed in for 30 days, and a non-secret sm_in cookie that just tells the page to show "Account" instead of "Sign in".
• Purchases: tokens are bought through our store, The Sex Shed (thesexshed.com), which handles payment under its own privacy policy. We only receive the order's email, the pack and an order reference, to add tokens to your account.
• Usage counters to enforce the free daily limit, keyed by a one-way hash of your IP address and a random device ID cookie (sm_did). Counters expire after about a day.
• An age-confirmation cookie (sm_age) so we don't ask you again.
• Votes and reports on public stories, keyed to your account or the random device ID, so each person votes once. They're deleted with the story.
• Refusal counts by category (for example "minor" or "non-consent") and date, with no prompt text, to tune our safety filters.
• Aggregate analytics (page views, no cross-site tracking) to understand which pages are useful.

AI provider

Stories are written by a third-party large language model provider that processes your prompt to generate a response. The provider handles that data under its own API terms.

Bot protection

We may use Cloudflare Turnstile to check that requests come from a person. Cloudflare processes limited technical data for this purpose.

Contact

Questions or deletion requests: see the contact page.