Privacy Policy

1. Who we are

Pills of Matrix writes a book for one reader at a time. This page explains what we collect to do that, why we are allowed to, who else sees it and how long we keep it.

We are the data controller for the information described here. Write to hello@pillsofmatrix.com for anything on this page — including a request to see, correct or delete your data.

We sell to customers in the United Kingdom and this policy is written around the UK GDPR and the Data Protection Act 2018. If you are in the EU, the same rights apply to you under the EU GDPR.

2. What we collect and why

Your name and year of birth. The book is written to one person and says their name, which is also printed on the cover of the PDF. The year of birth is used as context — what the world looked like when you were growing up — and never for astrology, star signs or any similar claim. We ask for the year only, not your full date of birth, because the year is enough. You must be 18 or over to order.

Where you live, and (if you tell us) what you do. The city and country you give are used for the world around you — the currency, the market, the institutions you deal with, the pace of the place — so the examples in your book are set where you are rather than somewhere generic. What you do is optional; if you give it, the exercises are set inside your own work. Neither is used to infer nationality, origin, belief or anything else about you, and we say so to the writing system in as many words.

Your email address. So you can sign in, so we can send you the order confirmation and tell you when your book is ready, and so your library stays attached to you.

Your answers to the twenty-one scenes. They stay in your browser until you order. When you order they are stored with that order and used to write your book. They describe working preferences; they are not a medical, psychological or financial assessment and we do not treat them as one.

Your order. What you bought, what you paid, the discount code if you used one, and the reference number. We need this for the sale itself, for support and because UK tax law requires us to keep records of sales.

Your book. The text we write for you, the chapters you have opened, what you told us about the daily move, and the PDF.

We do not collect your full date of birth, your address, your phone number or your payment card details. We never see your card — Stripe handles that.

3. Why we are allowed to (lawful basis)

Performance of a contract. Your name, year of birth, where you live, answers, email address and order details are all needed to produce and deliver the thing you bought. Without them there is no book. What you do is optional and is used only if you give it.

Legal obligation. Sales and tax records are kept because we are required to keep them.

Legitimate interests. Keeping the site secure and preventing abuse of discount codes and free trials. We keep this to the minimum that works.

We do not run advertising profiling and we do not sell your data to anyone, for any price.

4. Who else sees your data

Your book is written by an artificial intelligence system. That system receives your first name, your year of birth, where you live, what you do if you told us, your reading, the book you chose and your language so that the book can address you and set its examples where you are. It does not receive your email address, your surname on its own, your payment details or your order history.

Anthropic (AI writing, United States). Anthropic does not use data sent through its API to train its models. The text of your book is generated there and stored by us.

Supabase (database, accounts and file storage). Your account, your order, your reading and your book live here. Access is restricted by row-level security so that you can only ever reach your own records.

Stripe (payments, Ireland and United States). Stripe receives your email address, your name and the amount, and handles the card itself. We never see or store card numbers.

Resend (email delivery, United States). Receives your email address and the content of the messages we send you about your order.

Cloudflare (hosting and security). Serves the site and sees the technical details of each request, such as your IP address, for security and delivery.

GitHub (United States). The job that writes your book runs there. It reaches your reading and your name through our database while it works.

Google (analytics, United States) — only if you allow it. If you accept analytics cookies, Google Analytics receives the pages you visited, roughly where in the world you are and what kind of device you used. It never receives your name, your email address, your answers or anything from your book. If you decline, or if you have not been asked, nothing is loaded and nothing is sent. Section 8 has the detail and the switch.

Some of these providers are outside the United Kingdom. Transfers are covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, depending on the provider.

5. How long we keep it

Your account, your book and your reading: for as long as you have an account. Your library is meant to stay yours — books you have bought do not expire. Ask us to delete your account and all of it goes, including the PDF and the text of your book.

Order and payment records: six years after the sale, because UK tax law requires it. This is a short record of what was sold and for how much; it does not need your reading or your book, and those are deleted with your account.

Emails we sent you: kept by our email provider for a short period for delivery records.

Anonymous counts of how many people started or finished the test: kept without any identifier — no name, no email address, no IP address, no session. They cannot be traced back to you.

6. Your rights

You can ask us to show you everything we hold about you, correct anything that is wrong, delete it, give it to you in a portable form, or stop a particular use. Write to hello@pillsofmatrix.com and we will answer within one month.

Deleting your account deletes your books with it. We will say so plainly before we do it, because a book written for you cannot be recovered afterwards.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office (ico.org.uk), the UK regulator. We would rather you told us first so we can fix it.

7. Children

This is not a service for children. You must be 18 or over to order a book, and the form asks for your year of birth to check this. If we learn that we hold data about someone under 18, we delete it.

8. Cookies and local storage

The sign-in cookie. We use a cookie to keep you signed in. Without it you would have to sign in again on every page, so it is strictly necessary and does not require your consent. It is removed when you sign out.

Your basket and your unfinished reading are kept in local storage, on your device. They never reach us until you place an order, and clearing your browser data removes them.

Your analytics choice is kept in local storage too, so we do not ask again on every visit. It is stored per browser, which is why a different device asks you afresh.

Analytics — only with your consent. We would like to count visits with Google Analytics, to see which pages are worth writing and where people give up. We ask before anything is loaded: until you accept, no Google script runs in your browser, no analytics cookie is written, and no request goes to Google at all. Decline and that stays true. You can change your mind at any time, in either direction, with the buttons below.

Google Analytics, when you allow it, counts the page you are on, roughly where in the world you are and what kind of device you used. It is set up without advertising features and without personalised advertising signals. It never receives your name, your email address, your answers or any part of your book.

We do not use advertising cookies, tracking pixels, or any third party that builds a profile of you across other websites.

9. Security

Traffic is encrypted in transit. Your book and your reading are stored in a private area that is not publicly addressable; downloads are handed out as links that expire after sixty seconds. Database access is restricted per row, so one customer's records cannot be reached from another's account.

No system is perfect. If a breach ever affects your rights, we will tell you and the ICO as the law requires.

10. Changes to this policy

This policy was last updated on 21 September 2026. When something material changes — a new provider, a new purpose — we update this page and, if it affects you, we say so by email.