Privacy
This page lists what Scrollwork stores, field by field. Not a category of data — the actual columns. If something is not named here, it is not kept.
Accurate as of 23 September 2026
What is collected today
Very little. The public pages keep nothing about you. A message sent through the contact form is kept, and so is an account if you make one. Both are set out below, one row for each place anything is stored.
If you send a message through the contact form
| Stored | Why |
|---|---|
| Your email address | To reply. Nothing else. |
| Your subject and message | It is the message. |
| The time it arrived | To read them in order. |
| A salted hash of your IP address | To rate-limit a flood. It is a one-way hash with a secret salt: enough to count repeat submissions, not enough to work out who you are, and the address itself is never written down. |
The contact form, the registration form and the password reset form are checked by Cloudflare Turnstile, which decides whether a submission is automated; on registration and reset it stops anyone spending the month's mail on invented addresses. It is not loaded when one of those pages opens: a small script of ours, turnstile.js, loads it from challenges.cloudflare.com only once you start filling in the form. Turnstile then keeps one item, cf.turnstile.u, in your browser's local storage under Cloudflare's own address, as part of telling a person from a machine; it sets no cookie. It is the only script on this site that comes from anywhere but Scrollwork itself.
Scrollwork's own scripts run only on the contact page and on the pages where you register, sign in or manage your account. There are three: turnstile.js, above; password.js, which lets you show a password while you type it; and timezone.js, which fills in your timezone from your browser so you need not pick it. None of them sends anything anywhere.
If you visit any page
Cloudflare serves this site and, like any web server, sees the request: the address it came from, the page asked for, and the browser that asked. Scrollwork keeps none of that. There is no analytics of any kind — not Google's, not Cloudflare's, not our own.
Cookies
The public pages set none. You can check that in your browser right now.
Signing in sets three at most. Two are only ever sent to the signed-in part
of the site, under /app: one proves your session and lasts thirty minutes,
the other renews it and lasts until your browser closes. If you tick
Keep me signed in when you sign in, it lasts thirty days
instead, so you stay signed in between visits; the box is unticked unless you
tick it, and ticking it is your consent to that cookie.
Signing out removes both. The third, sw_oauth, exists only when you
sign in with Google: it is set as you leave for Google, sent only to the sign-in
addresses under /auth, lasts at most ten minutes, and is deleted
when you come back. It proves the browser that finishes the sign-in is the one
that started it. Without that box, all three are strictly necessary to a service you asked for,
which is the category that needs no consent banner. We will not add anything
outside that category; if we ever did, the banner would arrive with it, which is
a good reason not to.
What is never collected
- Payment details. Donations are taken by GitHub Sponsors and PayPal. Scrollwork has no merchant account and never sees a card. There is no payment data here to leak, sell, or lose.
- Your card, and nothing about how you paid. Donations go through GitHub Sponsors and PayPal. Scrollwork has no merchant account and never sees a card number, a bank detail or an address.
- Analytics, advertising, tracking. None. No pixels, no third-party scripts, no fingerprinting, no profile of what you read.
- Your reading. When the canvas opens, what you look at is yours. It is not recorded against your account.
- Anything sold or shared. Not to anyone, at any price, in any form.
What is kept when you donate
This section is specific because an earlier draft of it was wrong. It said nobody here knows who gave. That was true of the software and false of the person, which is the worst kind of privacy claim — the sort that reads as a promise nobody can keep.
| Kept | Why |
|---|---|
| Your name and email address | Asked for when you give, and also visible to me at PayPal or GitHub the way they are to anyone you pay. Kept because a gift has to be matched against the platform to confirm it arrived, because money received has to be accounted for, and so a thank-you or a receipt can reach you. |
| Amount, date and platform | The same two reasons: confirming, and records. |
| Your account, if you were signed in | So your own giving history is visible to you, and so a gift can be matched to the person who made it. |
How long: seven years from the gift, then deleted. That is the ordinary retention period for a financial record, and it is stated as a period rather than left open, because "as long as necessary" is the phrasing that lets a record be kept forever.
Deleting your account does not delete the gift record, and this page will not pretend otherwise. The account link is removed, so the record no longer points at you inside Scrollwork — but the gift itself is an accounting record of money received, not a part of your profile, and it stands until its seven years are up. Everything else belonging to the account is erased thirty days after you ask, the time you have to change your mind.
Your name is never published unless you ask. There is an option to have your gift shown publicly, and if you take it you type the name you want shown — which can be your first name, your initials, or anything else. The public ledger shows nothing about you unless you filled that in. Silence means private; there is no setting to get wrong.
What the record is never used for. It is not sold, shared or given to anyone. And it changes nothing about the product you get: a reader who gives a hundred dollars and a reader who gives nothing see an identical Scrollwork, for ever.
If you would rather your gift were not connected to an account, give without signing in. The gift record is still kept, with the name and email you gave, for the reasons above — there is no way around that and I will not pretend otherwise — but nothing connects it to an account.
Who else is involved
| Who | What they see |
|---|---|
| Cloudflare | Serves every page and stores the database. They see requests as any host does. They also send the few emails an account needs — the confirmation link, a password reset, a notice of a change — so they see the address each one goes to and what it says. |
| Have I Been Pwned | Only when you choose a password. To check it has not appeared in a known data breach, the first five characters of its SHA-1 hash are sent to api.pwnedpasswords.com, which answers with every breached hash sharing them; the match is made here. Neither your password nor its full hash leaves Scrollwork, and nothing identifies you. |
| Only if you choose to sign in with Google. Google then knows you signed in to Scrollwork, as it does for any site you use it with; Scrollwork is told your verified address, your name and Google's identifier for you, and keeps only the address, the name you confirm, and that identifier. | |
| Cloudflare Turnstile | Only once you start filling in the contact, registration or password reset form. It decides human or machine; it is not told what you wrote. |
| GitHub, PayPal | Only if you choose to donate, and only on their own pages. They do not report back to us. |
That list is deliberately short. The typefaces are served from this domain rather than a font service, so loading a page tells nobody else that you did — which is the kind of thing that usually goes unmentioned because it is usually not true.
If you make an account
Signing in is how a project supported by donation knows who it is for. An account unlocks nothing: a reader who gives nothing sees the same Scrollwork as a reader who gives a great deal.
| Stored | Why |
|---|---|
| Your email address | Encrypted, with a one-way index so you can be looked up without the address being held in the clear. Alongside it: when you created the account, when you confirmed the address, and, if you ask for the account to be deleted, when you asked. |
| Your Bible Study / Community Nickname, if you set one | The name other readers see when you join a Bible study, and in community features. If you leave it empty, they see the first word of your name instead. Removed with the account. |
| The Google account you sign in with, if you do | Only Google's identifier for you and when it was linked, so that signing in with Google finds your account. Not your Google password, contacts or anything else from Google. Removed with the account. |
| Your name and timezone | The name you give when you set your password, and a timezone for dates and your verse for today. You can change both on your account page. |
| A password hash | Never the password. It cannot be reversed into one. You choose the password only after the address is confirmed. |
| Your appearance | The look and brightness you chose for the application, so it looks the same on every device you sign in on. |
| Confirmation and reset links | Stored only as a one-way hash, with when each was issued, when it expires and whether it was used — so a link can work once and a second click can be told it was already used. |
| A change of address you asked for | The new address, encrypted, until you confirm it from that address, with the same kind of one-way link. |
| Your signed-in sessions | When each began, when it expires and whether it was ended, and the first 120 characters of the browser's own description of itself, so you can recognise and end each one on your account page. No location is recorded. |
| Which terms you accepted | The version and when, so you are asked again only when the terms change. |
| Attempts to sign in, register or reset | A one-way index of the address tried, what was tried, and when — to slow down someone guessing. It holds no address that can be read back, and each is deleted after a day. |
| How much mail was sent each month | A count per month and nothing else — no address, no subject, nothing about you — so that mail stops at the amount our plan includes rather than running up a bill, and so we are warned before it runs out. |
Signing in with Google, Apple or Microsoft, a second factor and saved preferences are planned and not built. Each is added to this page before it ships.
What you can do
Delete your account, yourself, at any time — without asking anyone or explaining why. You are signed out here, and no other session can be renewed, so any still open elsewhere ends within thirty minutes. The account is kept for thirty days, in case you change your mind, and signing in with your password in that time restores it; after that it is erased, and your email, sessions, confirmation links and accepted terms go with it. The address is then free to register again.
A message you sent through the contact form is not part of an account. Write and ask and it will be deleted.
Why this page is short
A privacy policy is usually long because the company is describing a great deal of collection in language chosen to make it sound reasonable. This one is short because there is little to describe, and the plan is to keep it that way.
Everything above is a promise rather than something you can verify, and that is true of every privacy policy you have ever read. This one tries to earn it by being specific — naming the actual fields rather than categories, and telling you where it knows more than the software does. If it ever says something untrue, it will be because it changed and this page did not, which is the failure to watch for.