Privacy notice

What we process

We store what the service needs to work, and no more:

• Account: email address, display name, when you registered and confirmed. Signing in with Google or Apple adds the identifier that provider sends us.
• Use of the service: the books you create and their pages, reading position, bookmarks, highlights, likes and the authors you follow.
• Credits and purchases: your balance, every grant and every spend, the books you bought, and the link to a Stripe customer record.
• Preferences: language, currency, theme, and whether you want the newsletter.
• Generation jobs: the brief you give and the state of the job.

Legal bases

• Account, books, reading position, preferences: performance of a contract, Art. 6(1)(b) GDPR — without them there is no service.
• Purchases, credits, invoicing data: performance of a contract, and legal retention duties under Art. 6(1)(c) GDPR.
• Newsletter: consent, Art. 6(1)(a) GDPR, withdrawable at any time in settings.
• Running and securing the servers: legitimate interests, Art. 6(1)(f) GDPR.

Who else sees the data

Four companies process data on our behalf, each under an Art. 28 GDPR agreement. There are no other recipients, and we do not sell data.

Transfers outside the EU

Where data reaches the United States, the transfer rests on the European Commission’s standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework.

Payment data

We never see card or bank details. Payment happens entirely at Stripe; we receive only the confirmation that it succeeded, the amount, and a customer reference, so we can credit your balance.

Cookies and browser storage

Only strictly necessary cookies: one keeps you signed in, one remembers your chosen currency. Both are required for the service you asked for and therefore need no consent under § 25(2) TDDDG. We run no tracking, no ad networks and no analytics — which is why there is no consent banner.

How long we keep it

• Account data and content: until you delete the account. Your books, bookmarks and highlights go with it.
• Purchase and payment records: ten years, as commercial and tax law require. These outlive the account.
• Newsletter: until you withdraw consent.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21 GDPR). Consent once given can be withdrawn at any time, with effect for the future.

You can delete your account yourself in settings. For anything else, a message to the address in the legal notice is enough.

You may also complain to a data protection supervisory authority, usually the one where you live.