Is my data safe?
yazar.io uses Supabase for its database, accounts, and file storage. Thanks to Row Level Security (RLS), every user can only access their own books and content; your book content is also stored encrypted in the database; the content you create is never sent to product analytics.
Row Level Security (RLS)
At the database level, every query checks who's signed in and only returns the rows that user owns; this rule is enforced by the database itself, independent of the application code. No other user can reach your books, characters, or notes, even if they know or guess a link.
There are two surfaces that can become public, both entirely your own choice and off by default: the Author Card you choose to publish (your books' actual content is never shown through that card), and the Shareable Wiki you can turn on per book (when you do, that book's real content, including characters, locations, and lore, becomes visible to anyone; your Notes are never included).
Content encryption
Descriptions of your entities (characters, locations, organizations, and similar), your notes, and your custom field values are not stored as plain text in the database; they're stored encrypted (AES-256-GCM). The keys that unlock this content are kept separately from the database, protected by Google Cloud's key management service (KMS); in case of infrastructure loss, these keys also have a separate recovery path independent of Google.
This is not end-to-end encryption (E2EE); when you sign in to your own account and make an authorized request, our server decrypts the content and shows it to you normally. Elevated access is used only on the server side, narrowly, for a handful of specific necessary cases (e.g. resolving a support request, investigating a security incident, or complying with a legal obligation).
Images and analytics
Book and character images are stored in private storage and are only shown through time-limited links tied to your account; a permanent, public image URL is never written to the database.
Analytics tools only run once you consent to them in your cookie preferences, and the content you create, including books, characters, lore, and notes, is never sent to analytics systems; only categorical information, like how often you use a given section, is collected.
Can another user view my book if they know the link?
Not by default. RLS rules are enforced at the database level; only the book's owner can access it (except the Sample Book, which is deliberately public and read-only). The one exception is the Shareable Wiki you can turn on yourself in Book Settings; as long as you leave it off, your book is never shared with anyone; once you turn it on, visitors can only read it, not edit it.
Is the text I write (lore, notes) sent to analytics?
No. No user-generated content (book titles, character/location names, lore text, notes) is ever sent to analytics systems.
Is this encryption end-to-end (E2EE)?
It's not end-to-end encryption (E2EE). Your creative content is stored encrypted in the database, but when you sign in to your own account, our server decrypts it and shows it to you; the goal is to protect the database in case it's compromised on its own, not to provide a privacy guarantee that's entirely independent of us.
What happens if I turn on the Shareable Wiki?
If you publish a book as a Shareable Wiki from Book Settings, that book's Characters, Locations, Organizations, Lore, and similar sections become visible, as a public, read-only page at yazar.io/@username/book-slug, to anyone; your Notes are never included. You can turn it off at any time, and the page becomes inaccessible immediately.
Related Content
Start building your world on yazar.io
Bring your characters, locations, and every thread of your world together in one place; no credit card required.