What we collect, and what we don't.

Last updated: 6 May 2026 · Effective: 6 May 2026

WhatToWrite.co is operated as part of an independent sole-proprietorship business based in Toronto, Canada. This policy explains what data passes through the site, why, and what your rights are. We've kept it as plain-English as possible.

1. The short version

We don't ask you to sign up. We don't sell data. We don't track you across the web. We collect the bare minimum needed to keep the site running, prevent abuse, and (if you choose) hear from you via the contact form. The AI calls you make are processed by Anthropic's API to generate your message and aren't stored by us in a way that's tied to you.

2. What we collect

The site collects a small amount of technical and submitted information:

• Generator inputs: the occasion, tone, relationship, length and any optional context you type. These are sent to our server and to Anthropic's API to generate your message. They're not linked to your identity.
• IP address (temporarily): stored briefly (up to one hour) for rate limiting — to stop bots and abuse. Not used for advertising or profiling.
• A short-lived session cookie: a random ID stored in a cookie that lasts up to one hour, used to count generations per visitor for rate limiting.
• Contact form submissions: if you use the contact form, we receive the name, email and message you provide.
• Aggregate usage data: if analytics are enabled, we see anonymised counts of page visits, referrers and country-level location. No personal identifiers.

3. Why we collect it

• To run the service — generate messages, prevent abuse, keep the site fast.
• To respond to you if you contact us.
• To understand what's working — page visits and basic usage signals so we can improve the tool.
• To meet legal obligations — basic record-keeping required of a Canadian sole proprietor.

We do not use your data for advertising profiling or sell it to third parties. Ever.

4. Third-party services we use

Running a small website means relying on a few specialist providers. Each handles a narrow slice of data:

• Netlify (hosting and contact form processing) — sees IP addresses for hosting purposes; processes contact form submissions on our behalf. Netlify privacy policy.
• Anthropic (AI generation) — receives the inputs you provide so Claude can generate your message. Anthropic does not retain prompts long-term for training when accessed via the API in the configuration we use. Anthropic privacy policy.
• Google AdSense (advertising — once approved) — may set cookies and use limited data to show ads. See section 7. Google privacy policy.
• Google Fonts (typography) — Google may log font requests including IP address as part of standard CDN operation.
• Affiliate partners (Moonpig, Papier, Vistaprint, Canva, Zazzle, Redbubble, Amazon Associates) — only see you if you click an affiliate link. See section 8.

5. Cookies and similar technologies

We use the smallest set of cookies and storage we can:

• Session cookie (essential): wtw_session — random ID for rate limiting. Expires after 1 hour. No tracking.
• Cookie consent preference (essential): stored in your browser's local storage so we don't show the banner again.
• Advertising cookies (optional, AdSense): if you accept, ads may set cookies to limit ad repetition and measure ad performance.
• Analytics: if we use Plausible or Netlify Analytics, no cookies are set. If we ever switch to Google Analytics, we'll add a separate consent prompt.

You can clear cookies any time in your browser. Doing so won't break the site.

6. Your messages and the AI

The AI generation is powered by Anthropic's Claude. When you click "Write my message," the inputs you've selected are sent to Anthropic's API along with our system prompt. Anthropic processes the request and returns the generated message. To keep costs low and the site fast, we may briefly cache common combinations of inputs (a few hours) so identical requests get a cached response — this is anonymous and unrelated to you.

Anthropic does not use API inputs to train its models in the configuration we use. We do not store your generations in any way that's tied to your identity.

7. Advertising

Once Google AdSense approves the site, you may see ads here. Google and its partners may use cookies and similar technology to show ads based on your visit to this and other sites. You can opt out of personalised ads via Google's Ads Settings or visit aboutads.info to opt out of third-party advertising cookies more broadly. EU and UK visitors will see a cookie consent banner before any non-essential cookies are set.

8. Affiliate links

Some outbound links on this site are affiliate links. If you click one and make a purchase from the partner site, we may earn a small commission at no extra cost to you. This is an important part of how the site stays free. Our affiliate partners may currently include Moonpig, Papier, Vistaprint, Canva, Zazzle, Redbubble, and Amazon Associates. Affiliate links never affect the content or recommendations we publish.

9. Your rights

If you're in the European Economic Area, the United Kingdom, Canada, or California, you have rights over your personal data — including the right to access, correct, delete, restrict, or object to processing of your information, and to data portability where applicable. To exercise any of these rights, email hello@whattowrite.co with the subject line "Privacy Request" and we'll respond within 30 days.

10. Children

WhatToWrite.co is not directed at children under 13 (or under 16 in some jurisdictions). We do not knowingly collect personal data from children. If you believe a child has submitted information through the site, please contact us so we can remove it.

11. How long we keep things

• Rate-limit data (IP, session ID): up to 1 hour, then deleted automatically.
• Generator inputs: not stored after a generation completes (cached responses are stored anonymously, by input combination only, for up to 4 hours).
• Contact form submissions: retained as long as needed to respond and fulfil legitimate business correspondence — typically up to 2 years.
• Server logs: retained by Netlify per their policy (typically 30 days).

12. Changes to this policy

If we make material changes, we'll update this page and the "Last updated" date at the top. Continuing to use the site after changes means you accept the updated policy.

13. Contact us

For privacy questions or data requests, email hello@whattowrite.co. We aim to respond within a few business days.