Skip to content
MarginaliaSign in →

Privacy Policy

Last updated: October 15, 2026

Marginalia is a workspace for checking story continuity. This policy explains the information processed when you create an account, add chapters, and run checks. For a locally hosted instance, the person running that instance controls its storage and configuration.

Information we process

  • Account information, including your name, email address, and a password hash if you use password sign-in.
  • When you choose Google sign-in, your Google account identifier, name, email address, and email verification status. The sign-in flow requests basic identity information, not access to Gmail or Google Drive.
  • Story content you submit, including chapters, drafts, extracted facts, continuity findings, source passages, and review decisions.
  • Model provider settings and API keys you supply, along with job status and errors needed to operate and troubleshoot checks.

How information is used

This information is used to authenticate you, maintain your workspace, check drafts against approved story history, save results, and protect the service from misuse. Verification and password reset emails use your email address.

AI providers and other services

When you request an AI operation, the story text and context needed for that operation are sent to your selected provider: OpenAI, Google Gemini, or Groq. Your API key authenticates these requests. Each provider applies its own terms, privacy policy, and data retention practices. Only submit content you are comfortable sending to that provider.

The configured hosting, database, and email services also process information needed to deliver the application. Which services are used depends on the deployment. Google processes authentication information when you choose Google sign-in.

Cookies and security

Marginalia uses cookies to maintain your signed-in session and secure the Google sign-in flow. Blocking these cookies can prevent sign-in from working. Passwords are stored as hashes, and saved provider API keys are encrypted on the backend. No system can guarantee absolute security.

Storage and your choices

Workspace information is stored on the server and its configured databases. Retention and backups depend on the instance you use. Signing out ends your session; it does not delete your account or stories.

You can remove saved provider keys in Model providers and stop using the service at any time. To request access, correction, or deletion of account and story data, contact the operator of the instance through the channel where they provided you access. There is currently no self-service account deletion screen. Removing a key from Marginalia does not revoke it with its provider; revoke it there if needed.

Policy updates

This page may be updated as the service changes. The date above identifies the latest revision. See the Terms of Service for conditions of use.