Privacy Policy

The operator decides how your personal data is used: the “controller” under the EU and UK General Data Protection Regulation (GDPR), and the “business” under US state privacy laws where they apply. Write to [email protected] about anything in this policy.

Your account

Username, email address, password (stored only as a bcrypt hash, never readable), gender (you can hide it), country (optional, you can hide it), role, ban status and reason, your settings (look, reading preferences, notification choices and the time zone your browser reports, for email digests and the days of the reading game), and when and which Terms of Service you agreed to.

Your profile

Your picture (a Gravatar address made from a hash of your email address, or a picture you upload), banner, bio, links to your other pages, the usernames you had before, and your premium cosmetics.

What you post

Books, chapters, covers, glossaries, announcements, comments (with the paragraph they are about), reviews, reactions, votes, reports and ticket messages, and what you write when you ask to become an author, with the staff's answer (kept until your account is deleted).

Feedback you send (a bug, an idea or anything else, from the Send feedback button or menu): its kind, title and details, the screenshots you attach to it or to your later messages, and, sent with it, the address of the page you were on (this site's path and query, without the secret codes some links carry) and your browser (its user agent), as the form says before you send it. Only you and the staff see it; screenshots are never public, and staff can remove one. Feedback stays as long as its ticket; its screenshots are deleted with your account (the text stays for the staff), and stay in the backups for their 90 days. What you have written but not sent stays in your browser until you send or discard it, or sign out or delete your account there.

With it goes a log of what went wrong on the site in your browser before you sent it: error messages, the requests to the site that failed (their method, path and status, with the site's answer) and the paths of the pages they happened on, with the secret codes some links carry left out; never your name, your email address or what you typed. It describes how the site failed, not you. Only staff see this log, never you, and it is kept with the ticket, also after your account is deleted. It is not part of your data download. Until you send feedback, the log is only in your browser's memory (the last 100 entries), and it is emptied when you send it, sign out or close the page.

Comments and reviews can earn reading rewards. Each one you post is checked automatically for substance (its length, how varied its words are, letters rather than symbols, links, phrases such as “thanks for the chapter”) and for repetition of what you wrote before; the result is kept, with the first 1,000 characters of what was checked as evidence for staff. Your account has a risk score, worked out from signals: repeated or generic posts, posts past the day's limits again and again, many posts at once, a rewarded post deleted and posted again, a rewarded post removed or hidden by staff or a book's author, the AI provider judging a post spam, reward farming, off topic or empty, a post that tries to give the AI provider instructions, and reading that looks automated. Each rewarded post or chapter lowers it, and the score fades over time. Staff see the score and its signals. As the score rises, the site watches your account by itself: it lowers your daily limits for rewarded comments and reviews and sends to the AI provider, when one is set up, every comment and review the checks do not refuse, until the score fades. A high score holds the rewards of your comments, reviews and chapters for staff to check. Staff may also watch an account, restrict its rewards and write notes about it. The checks, the score, its signals and the staff's notes are in your data download.

When the administrators have set up an AI provider, the comments these checks do not settle and the reviews that pass the first checks are sent to it to judge whether they are relevant, specific and original: the text, with the book's title and genres, the chapter's title and the paragraph the comment is about (or the chapter's opening) and the comment it answers, or the book's synopsis and how many of its chapters you read, and your last few comments and reviews, shortened, with how many you posted in the last hour. Your username, account id, email address and IP address are never sent. Its answer is kept with the check, and each request is logged (when, which model, its size and cost, never what was sent); the AI requests about your posts are in your data download.

What you read

The chapters you open and finish, where you stopped in each book, your library shelves, the books and readers you follow, the reading circles you start or join (with the invitations and set nudges you send and receive), the accounts you block and the site announcements you dismiss. While you read a chapter signed in: where you are in the chapter (every half second while it changes), your window's size, the kind of device (phone, tablet or computer), your reading settings, whether the tab is in view and whether Listen is on, the moments you scroll, tap or type (at most every 10 seconds) and your answers to "Still listening?", so that a chapter counts as read only when it was read (at a pace a person can read, a little faster while Listen reads aloud); and the chapters that counted, with the reading rewards worked out from them (starlight, experience and levels, streaks, badges, stars and shards, your sky's stardust and buildings, challenges, rewards given). Your level, title, badges, streak, stars, constellations and sky show on your profile, your name and the words you read on the leaderboards and to the readers of your weekly league, your name and the days you read in the last 30 days on the days-read board, your Year in the sky (a page of your year's reading: chapters, words, days, streak, levels, constellations, books finished and titles, with its three most-read books and top genres, and an image card for sharing, each year while it is open), and by your name on a book's comments and reviews how much of it you read and whether you were one of its first readers, unless you turn off Show my reading progress (your streak alone: Show my streak); your balances, challenges and rewards stay private. Your reading speed is worked out from your active time on a chapter and shown to you; staff checking a reading session see that session's pace. Staff look at the readers at the top of each week's leaderboard and record that they did, and when (never who).

Payments

What you bought, the amount, its status, Stripe's references and receipt, and a gift recipient's email address. You type your card details, name and billing address on Stripe's checkout page: they go to Stripe and Link (which sells premium and works out its tax) and never reach us.

Patreon

When you connect Patreon for premium, the site reads from Patreon, when you connect, when you open Settings → Premium or press Check again, and every day after: your Patreon member id; your membership of the library's campaign: whether you are an active, declined or former patron, whether it is a free trial or a gift, the result and date of its last charge, the date of its next charge, how many months each charge pays for, and the title and amount of each tier it entitles you to; and the campaign's id and page name. It asks Patreon for nothing else: never your email address, your name or your other memberships.

It keeps: your Patreon member id; the title and amount of your highest tier, your membership's status, whether it gives premium, the end of the period paid, the date of the charge that paid for it, and until when it gives premium; when you connected and disconnected, and when it was last checked; whether an administrator suspended it, and when Patreon refused the site's access; and the tokens Patreon gives the site to check your membership again, encrypted, with when they run out, deleted when you disconnect or when Patreon refuses them.

Technical data

The IP address and browser (user agent) of each signed-in session, the IP address of changes recorded in the activity log, the cookies and browser storage described in the Cookie Policy, and our servers' logs.

From others

Discord, when you sign in with it (your Discord id, name, email address, whether Discord verified it, and your picture, which we copy); Stripe (whether a payment went through); Patreon, when you connect it (your Patreon id and your membership of the library's campaign); and people who report your content (a copy of what they reported).

Public: your username and the usernames you had before, picture, banner, bio, links, role, whether you are banned, your premium tier and since when, when you joined, your books and chapters, comments and reviews, and how many reactions a chapter received. Your gender and country, unless you hide them. Your library, only if you turn it on (and never your “Dropped” shelf). Your name on the supporter wall, only if you choose it. The name color and picture frame you earned by reading, when you wear them. Your reading progress (level, title, badges, streak, stars and sky); on the leaderboards and in your weekly league, your name and the words you read in chapters that counted; on the days-read board the days you read in the last 30 days; your Year in the sky page and its image card; and by your name on a book's comments and reviews, a mark for how much of it you read (Reader, Devoted, Companion) and your number if you were one of its first readers (the first readers to read much of it), which its author also sees, by name, on the book's workspace; unless you turn off Show my reading progress (your streak alone: Show my streak). With it on, also how many readers follow you and how many you follow (never who), and, to the readers who follow you, the levels, badges, titles and constellations you earned and the books you finished in the last 30 days, while your library shows. How many readers starred a book (not who).

Within a reading circle: its members see each other's names, how many chapters each read toward the week's goal and the set nudges sent; whoever invites you sees whether you answered, and a circle's owner sees the invitations sent in it.

Private: your email address, your votes (others only see counts), whom you follow and who follows you (others only see counts; a reader you follow who follows you back can see that you follow them (to invite you to a reading circle)), your reading history (beyond what Year in the sky shows while you show your reading progress), your settings and your payments. Staff see what they need to moderate; moderators do not see email addresses. Authors see how their books are read in numbers (chapters counted as read, reading times, readers who reached the latest chapter, stars), never who read them, but for their first readers who show their reading progress.

• To run your account and the site (showing what you post, your library, notifications, premium and payments): because it is needed for the service you asked for (contract).
• To keep the site safe and fair (preventing abuse and spam, rate limits, moderation, the activity log, backups, checking that chapters counted as read were read, which staff can replay, checking comments and reviews for substance and repetition, with an AI provider when one is set up, and keeping a risk score, so that rewards stay fair, fixing problems and improving the site): our legitimate interests, balanced against yours.
• Analytics and advertising cookies: your consent where the law asks for it, which you can withdraw at any time with Privacy and cookie settings. In the EEA, the UK and Switzerland, readers who see ads give or refuse it in Google's consent message, a consent platform certified by Google.
• Legal duties (keeping payment records, answering lawful requests, reporting child sexual abuse material): legal obligation.
• Emails: activation, password, gift codes and news about your tickets are part of the service; the notification digest is sent only if you choose it and has a one-click unsubscribe. We do not send marketing emails.

We do not sell your personal data. These service providers process it for us:

• Cloudflare: every visit passes through it (your IP address and the requests you make), and it stores our off-site backups (Cloudflare R2).
• Our server host: the database and the stored files are on our own server, rented from a hosting provider.
• Google: Gmail sends our emails. Google Analytics and Google AdSense run only with your consent where the law asks it (in the EEA, the UK and Switzerland, AdSense's script loads before you answer, to show Google's consent message, so Google receives your IP address and the page you are on then); they receive your IP address, device information and the pages you visit, and AdSense may personalise ads where that is allowed (in Europe, only when you allow it in Google's consent message, which records your answer).
• Stripe and Link (Stripe's merchant of record service, which sells premium to you): payments, their tax and payment support (your email address, username and account id, a gift recipient's email address, and the name and billing address you give on their checkout page).
• Patreon: when you connect it for premium, we ask it for your membership of the library's campaign, with the tokens it gave us, when you connect and every day after; we send it nothing about you.
• Discord: when you sign in with it. Authors' chapter announcements go to the Discord servers they choose.
• Gravatar (Automattic): serves pictures made from email address hashes.
• The AI provider the administrators choose (such as OpenAI or OpenRouter), when one is set up: the comments and reviews it judges, with their context, never who wrote them; a provider that passes requests on, such as OpenRouter, sends them to the company that runs the chosen model.

We also share data when the law requires it, or to protect people from serious harm.

The operator is in the United States, so your data is processed there and wherever our providers work. If you use the site from elsewhere, your data goes to the United States. Our providers protect international transfers with their own safeguards, such as the European Commission's standard contractual clauses.

Wherever you live, you can:

• see and download your data: Settings → Your data gives you a data export, as a JSON file;
• correct it in your settings;
• delete your account in Settings → Your data;
• choose which optional cookies run, with Privacy and cookie settings in the footer;
• stop the email digest in Settings → Notifications, or with the link in any digest.

Under the GDPR you also have the rights of access, rectification, erasure, restriction, portability and objection (to processing based on our legitimate interests), and to withdraw consent at any time. You can complain to the data protection authority (the supervisory authority) of the country where you live.

US state privacy laws give rights to know, delete and correct your data, to opt out of the “sale” or “sharing” of it for targeted advertising, and not to be treated differently for using them. We honour these rights for everyone, and we treat a Global Privacy Control signal from your browser as an opt-out of personalised advertising and analytics.

For anything you cannot do in the settings, write to [email protected]. We answer within 30 days, after checking that the request comes from the account's owner (we may ask you to write from its email address).

Accounts are for people aged 16 or older. We do not knowingly collect data from children under 13 (or under 16 in the European Union). If you believe a child gave us personal data, write to [email protected] and we will delete it.

The site is served over HTTPS only, passwords are hashed, stored files are served only through the site, access to data is limited by staff role, and downloading a backup needs an administrator's password. No system is perfectly secure: if you find a problem, please tell us at [email protected].

The site recommends books (trending books, “readers also read”) from reading activity counted across many readers. Whether a chapter counts as read is decided automatically from your reading pace. Each counted chapter also gets an automatic score of how automated its reading looked (from your pace and how you moved through the text), which flags it for staff to review: a high score holds that chapter's rewards until staff decide, and staff may void reads made by cheating. A chapter whose text you were already rewarded for earns nothing again. Whether a comment or review earns a reward is decided automatically from its checks, the AI provider's judgment where one is used, the day's limits and your account's risk score, and a high score holds your rewards until staff decide. Only rewards are decided this way: no decision with legal or similarly significant effects on you is made automatically, and no account is ever banned, nor its role changed, automatically. Staff can see the checks of your comments, reviews and reading and what they rested on, while that is kept, and decide the rewards held for them; a reward refused automatically stays refused. If you think a decision about your rewards is wrong, write to [email protected].

We may update this policy; the date at the top says when it last changed. We announce significant changes on the site or by email before they apply.

Questions or requests about your data: [email protected].