Privacy Policy

Last updated: 1 June 2026

Autonomy is a self-publishing platform operated by Ever After Press ("we", "us", "our"). This policy explains what personal data we collect when you use Autonomy at https://autonomy.everafterpress.co.uk, how we use it, and the rights you have over it.

For the purposes of UK data protection law, including the UK GDPR and the Data Protection Act 2018, Ever After Press is the data controller for the personal data described here. If you have any questions, you can contact us through the contact form on our Support page at https://autonomy.everafterpress.co.uk/support, or by email at hello@everafterpress.co.uk.

1. What we collect

Account information. When you create an account we collect your name, email address, password (stored in hashed form by our authentication provider), and basic profile details you choose to add.

Manuscripts and book files. We store the manuscripts, book files, cover images, metadata, and other content you upload or create so that we can provide our editing, formatting, distribution, and publishing features.

Payment data. Subscriptions and one-off payments are processed by Stripe. We do not store your full card details. We receive limited billing information from Stripe, such as your billing name, country, the last four digits of your card, and the status of your payments.

Connected social accounts. If you choose to connect a Facebook, Instagram, or TikTok account so that Autonomy can publish or schedule posts on your behalf, we collect and store the OAuth access token and, where the platform provides one, the refresh token that lets us post the content you have created or scheduled, along with basic profile information from that platform such as your account ID, username or handle, display name, and the list of pages or business accounts you have authorised. We only ever request the permissions needed to publish the content you ask us to publish. We do not collect your private messages, your contacts, or your followers' personal data.

Usage and technical data. We collect basic logs and analytics such as your IP address, device and browser type, and how you interact with the service, so that we can keep Autonomy secure and working.

2. How we use your data

We use your data to:

  • create and manage your account and provide the Autonomy service;
  • store, edit, format, and prepare your manuscripts and covers for publication;
  • distribute your books to the retailers and aggregators you select;
  • process payments and manage your subscription;
  • publish or schedule the posts you create to the social accounts you have connected, at the time you choose, on the accounts you control;
  • communicate with you about your account, support requests, and service updates; and
  • keep the platform secure, prevent abuse, and meet our legal obligations.

Platform data from Meta and TikTok is used only to provide the publishing features you have requested. We use the tokens and profile information described above solely to post and schedule content on your behalf to your own connected accounts. We do not sell this data, and we do not use it for advertising, profiling, or any purpose unrelated to the features you asked for.

3. Legal basis for processing

Under the UK GDPR we rely on the following legal bases:

  • Contract. Most processing is necessary to provide the service you have signed up for, including storing your content, processing payments, and publishing to the accounts you connect.
  • Consent. Connecting a social account and authorising us to post on your behalf is based on your consent, which you give through the platform's own authorisation screen. You can withdraw this consent at any time by disconnecting the account (see section 7).
  • Legitimate interests. We rely on our legitimate interests to keep the service secure, prevent fraud and abuse, and improve Autonomy, balanced against your rights.
  • Legal obligation. We process some data to meet legal and accounting requirements.

4. Storage and security

Your data is hosted on Google Cloud and Firebase infrastructure, within data centres operated by Google. Connections to Autonomy use HTTPS encryption in transit. Social account tokens and other sensitive credentials are encrypted and stored using managed secret storage with restricted access. We limit access to personal data to those who need it to operate and support the service.

5. Third parties and processors

We share data only with the service providers needed to run Autonomy, and only as far as necessary: Stripe (payment processing); Google Cloud / Firebase (hosting, database, authentication, and file storage); Resend (transactional and account emails); Meta (Facebook and Instagram) and TikTok (where you connect those accounts, so we can publish the content you create to them). These providers act as our processors or as independent controllers under their own terms. We do not sell your personal data to anyone.

6. Data retention

We keep your account data and content for as long as your account is active. If you close your account, we delete or anonymise your personal data within a reasonable period, except where we must keep certain records (for example payment and tax records) to meet legal obligations. Social account tokens are deleted as soon as you disconnect the account (see section 7) or close your account.

7. Your rights and how to disconnect a social account

Under the UK GDPR you have the right to access the personal data we hold about you, ask us to correct inaccurate data, ask us to erase your data, restrict or object to certain processing, request a copy of your data in a portable format, and withdraw consent at any time where we rely on consent.

Disconnecting a social account. You can disconnect any connected Facebook, Instagram, or TikTok account at any time from within Autonomy (in your account or connections settings). When you disconnect an account, we delete the stored OAuth access and refresh tokens and the associated profile data for that connection, and we stop posting to it. You can also revoke Autonomy's access from within the social platform's own app settings.

To exercise any of these rights, contact us through the contact form on our Support page at https://autonomy.everafterpress.co.uk/support, or by email at hello@everafterpress.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. International transfers

Some of our providers (such as Stripe, Google, and the social platforms) may process data outside the UK. Where data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses, so that your data remains protected.

9. Cookies

We use a small number of essential cookies and similar technologies to keep you signed in and to keep the service secure. We do not use cookies for third-party advertising.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you.

11. Contact

Autonomy is operated by Ever After Press. You can reach us through the contact form on our Support page at https://autonomy.everafterpress.co.uk/support, or by email at hello@everafterpress.co.uk.