Your words travel. Your email stays private.

What we collect

• Information you provide: your email address, a recipient's email address when you pass a buck, optional pen names, story contributions, prompts, notes to the bill, goals, and email preferences.
• Activity records: bill and hop identifiers, timestamps, story status, forks, rejected word submissions and reasons, sandbox checkout and payout identifiers, statuses, and payment event records.
• Technical information: our infrastructure processes IP addresses, request URLs, browser and network information, and error or security logs to deliver the site and limit abuse. Private links can appear in request URLs.
• Support messages: if you email us, we store the sender and recipient addresses, subject, message content, links in the message, and receipt time. The support inbox does not save attachments for us to review.

We do not ask for or store your card details, bank credentials, or PayPal password. PayPal handles its own checkout and account screens.

What other people can see

Stories are public. Confirmed words, prompts, optional pen names and notes, timestamps, chosen approximate locations, story branches, and the bill's diary, stamps, finale, or eulogy can be read, shared, indexed by search engines, and included in link previews or story emails. Public counters include labeled simulated demo histories during the beta.

Your email address, other people's recipient addresses, private action links, and full payout identifiers are not part of the public story view. Receipts show only a masked identifier and status. Use a pen name and leave personal or sensitive information out of public fields. A note to the bill is public too.

Approximate location

Cloudflare estimates a city, region, country, and approximate coordinates from your network connection. This is not GPS, and the app does not request device location permission. Coordinates saved for a published hop are rounded to one decimal place.

You can turn off the city stamp before releasing a bill or contributing. When you do, we do not save that submission's inferred location to its bill or hop. Infrastructure still processes the network information needed to serve your request, and location information you type into words or notes remains part of that text.

Why we use information

We use information to run stories and sandbox payments, deliver private holder and creator links, send requested updates and service reminders, generate the bill's narration and art, respond to support and privacy requests, moderate content, diagnose failures, and prevent abuse.

Only give us another person's email if they have agreed to receive the buck and its invitation. We use that address for the handoff and related service messages, not to add them to a marketing list. We do not sell personal information or run targeted advertising in this app.

Where applicable law requires a legal basis, these purposes rely on providing the service you request, our legitimate interests in operating and protecting the experiment, your choices for optional features, or compliance with legal obligations. You can change optional choices as described below.

Service providers and external resources

• Cloudflare: hosting, database and image storage, email delivery and routing, security, and Workers AI. These services process information needed to operate the site. Cloudflare privacy policy.
• PayPal: sandbox checkout and payouts receive the details needed for test transactions, including the recipient email and transaction metadata. PayPal's embedded checkout may set its own cookies or storage and process device information. PayPal privacy statement.
• AI providers: Cloudflare Workers AI, and Anthropic when configured, process story excerpts, prompts, bill personality, notes, pen names, and published place labels to produce suggestions, narration, and stamp art. The app does not intentionally include participant emails or action tokens in these AI prompts. Avoid including private information in text. Anthropic privacy policy.
• Maps and fonts: your browser requests map resources from OpenFreeMap and fonts from Google Fonts. Those providers receive network information such as your IP address when resources load. OpenFreeMap · Google privacy policy.

Providers have their own terms, privacy practices, and retention rules. Information may be processed in countries other than yours. We may also disclose limited information when required by law or reasonably needed to protect people, investigate abuse, or defend legal claims.

Browser storage and private links

The app uses session storage for a holder key and local storage for a creator key, so your browser can recognize your private link. The app removes those tokens from the address bar after loading. Holder keys stop working when that buck moves on; creator keys can remain in local storage until you clear site data.

Anyone with a working private link may be able to act as its holder or creator. Do not post, forward, or paste those links into public tools. Clearing site data removes your browser's stored keys but does not delete server records. Keep the original email if you need your key again.

We have not added advertising cookies or a separate analytics SDK. Necessary infrastructure and embedded providers, especially PayPal, may use cookies or similar technologies. Blocking storage or scripts can prevent checkout or private-link features from working.

How long information stays

This beta does not currently run a fixed automatic deletion schedule. Story records, private participant and transaction records, email delivery records, rejected submissions, and support messages remain until we remove them or the experiment is reset. We retain information only for purposes described here and review requests to remove information manually.

You can request deletion or de-identification of private information. We may retain limited records where needed for security, disputes, legal obligations, or the rights of other participants. Public collaborative text may remain where retention is permitted. Search engines, other participants, email recipients, provider logs, and backups can retain copies beyond our direct control; we cannot promise immediate removal of every copy.

Your choices and privacy requests

Use an optional pen name, turn off your city stamp before posting, and keep sensitive information out of stories and notes. Follow emails include a link to change their frequency or stop them. Unfollowing removes that subscription; it does not erase earlier messages or separate participation records. Holder, creator, and handoff messages are service messages rather than a marketing subscription.

To request access, correction, deletion, or help stopping service messages, email support@fourwordpass.com from the address you used, if possible. Include a public bill serial and explain the request. We may ask for reasonable verification that you control the relevant address. Never send a password, card number, identity document, or private action token in your first message.

Depending on your location and applicable law, you may have additional rights to access, correct, erase, restrict, object to, or obtain a copy of personal information, withdraw consent for optional processing, or complain to a data protection authority. We handle requests in accordance with applicable requirements.

Adults only

Participation in this beta is for people 18 or older. We do not knowingly invite children to submit personal information. If you believe a child has provided information, contact support@fourwordpass.com so we can investigate and take appropriate steps.

Security and changes

We use HTTPS, private capability links, protected administrative access, and rate limits. No online service or email system can guarantee complete security. Tell us privately at support@fourwordpass.com if you find a vulnerability; do not publish working keys or another person's information.

We will update this page when our practices change. The date at the top identifies the current version. Material changes may also be announced in the app. A move to real-money payments will require updated disclosures before that launch.