Privacy Policy

We collect information you provide, information generated by your use of the Service, and information needed to operate and secure it:

• Account information: your name and email address, verification and account status, account identifier, creation and update dates, and administrative information such as your account role and sign-up period.
• Authentication information: one-time-code challenges, verification attempts, sign-in and session records, expiry and revocation information, and, if you choose passkeys, public-key credentials and authenticator metadata. We receive verification codes to check them and store a protected hash rather than the original code. Passkey authentication does not give us your device's fingerprint or face data, device unlock code, or private cryptographic key.
• Reader information: your saved reading speed (used to estimate chapter reading times), the titles in your private library, reading status, last-read time, completion records, and the section and position needed to resume reading.
• Technical and security information: IP address, browser or user-agent information, client type, request and diagnostic information, and session identifiers. This is received by us or our infrastructure providers when your device connects to the Service. Protecting rate-limit identifiers does not make all these records anonymous.
• Support information: your contact details, correspondence, attachments and other information you choose to send, including feedback, complaints and rights requests. Someone reporting an issue may also provide information about you.
• Browser information: authentication cookies, locally stored appearance information, and a temporary reading-speed result when you choose to carry it through sign-up or log-in described in our Cookie Policy.

The current sign-up flow asks for your name and email, not your date of birth or gender. You need a working email address and authentication information to create and access an account. Without these, we cannot provide account features. Passkeys and contacting support are optional. Reading activity generates the records needed to save progress. Please avoid sending sensitive information that is unnecessary for your request.

Where UK or EEA data-protection law requires a lawful basis, we use the bases below. Other applicable laws may require a different basis or consent, which must be satisfied separately; accepting our Terms is not a substitute for that consent.

• Providing your account and reader: we use account, authentication and reading information to create and verify accounts, sign you in, send requested verification codes, maintain your library and save progress. Our basis is performance of our contract with you, or taking steps at your request before entering that contract.
• Security and reliability: we use account, authentication and technical information to prevent abuse, apply rate limits, investigate incidents, diagnose faults and send security notices. Our basis is our legitimate interests in protecting readers and maintaining a secure, reliable service.
• Support and service communications: we use account and correspondence information to answer requests and communicate changes. Our basis is performance of the contract for account-related assistance, and our legitimate interests in responding to other enquiries and keeping people informed about the Service.
• Legal responsibilities: we use relevant records to meet legal obligations, including applicable privacy requests. Establishing, exercising or defending legal claims and investigating misuse is based on our legitimate interests in protecting legal rights, unless a legal obligation applies.

When relying on legitimate interests, we must consider your rights and reasonable expectations, including the interests of younger readers. You may object as explained below. If we request consent for a specific purpose, we will explain that purpose and how to withdraw consent.

We do not sell personal information, share it for cross-context behavioural advertising, use it for targeted advertising, or send marketing emails. We do not use reading history to infer sensitive characteristics for advertising. We do not make solely automated decisions with legal or similarly significant effects. Automated security checks may temporarily limit requests; contact support if you think a restriction is wrong.

We use service providers, including Cloudflare and Amazon Web Services (AWS). Categories of services include hosting, storage, communications, security, diagnostics and operational analytics. Providers receive information relevant to the services they supply. Your library and reading progress are not shared with other readers.

We may disclose relevant information to professional advisers, authorities or other recipients where necessary to comply with law, investigate abuse, protect people or establish, exercise or defend legal rights. If our business is reorganised, sold or transferred, relevant information may be disclosed to advisers and prospective or actual successors, subject to appropriate confidentiality and data-protection requirements. This does not authorise unrelated uses of your information. Disclosures of reading records are subject to any additional protections under applicable reader-privacy law, including requirements for legal process, notice or specific consent.

We operate from the United Kingdom. Our providers may process information in other countries, including outside the UK, EEA or your country of residence, where laws may differ. Restricted international transfers require safeguards under applicable law, such as a recognised adequacy decision or approved contractual safeguards and any necessary additional protections. You can contact us for information about the destinations and safeguards relevant to your information, including how to obtain a copy of applicable safeguards.

We keep information for the period needed for its purpose, considering the account relationship, security needs, applicable legal duties and any unresolved dispute. Account, library and reading-progress information is generally kept while your account remains active. You can request closure by emailing our support team. Once we have verified the request, we aim to remove this information within 30 days, unless limited records are needed for a legal obligation, security investigation, fraud prevention or dispute. Any shorter legal deadline still applies.

Verification codes and sessions have limited validity. Expiry stops their use for authentication; it does not itself delete associated security or database records. We retain those records only as needed to operate and protect the Service and resolve incidents. Residual copies may remain in logs or backups until their retention cycles end, subject to applicable deletion requirements. Contact us for information about retention relevant to your request.

Support correspondence is retained for up to 12 months after the issue is resolved, unless a longer period is needed for a legal claim or obligation. Any exceptional retention is limited to the information and period needed for that purpose.

We use measures intended to protect information against unauthorised access, loss and misuse, including account verification, protected authentication credentials, access controls and security rate limits. No service or transmission method can guarantee absolute security. Protect your email account and devices, do not share verification codes, and contact support promptly if you suspect an account incident. We will provide incident notifications where required by applicable law.

Your rights depend on the law that applies and may be subject to exceptions. They may include confirmation of processing, access to and a copy of information, correction, deletion, restriction, and receiving or transferring information in a portable form. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Email our support team to make a request. Describe what you need and, if relevant, identify your account. We may ask for proportionate information to verify your identity or an authorised agent's authority. Do not send identity documents unless requested. We will not discriminate or retaliate against you for exercising applicable privacy rights.

We respond within the period required by the law that applies. For UK and EEA requests, this is normally one month, with extensions permitted in certain circumstances. Where a US state law applies, many requests have a 45-day response period. We will explain any applicable extension, refusal or charge and available review rights. Requests are normally free; we charge only where the law permits.

If an applicable US state law grants you an appeal, reply to our decision asking for an appeal. Applicable rights may also include opting out of sale, targeted advertising or certain profiling, and limiting specified uses of sensitive information. We do not carry out those sale, advertising or significant-decision profiling activities. This notice does not claim that every state privacy law applies to Entold.

If you make a privacy complaint, we will acknowledge it within 30 days, investigate appropriately and explain the outcome without undue delay. This complaint process does not extend the deadline for a separate request to exercise your privacy rights.

You may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or the competent authority where you live, work or believe an infringement occurred, where applicable. For example, EEA readers can contact their local data-protection authority and Swiss readers can contact the Federal Data Protection and Information Commissioner. You do not need to complain to us first where the law permits you to approach an authority directly.

We use authentication cookies and our appearance functionality can access browser storage. We do not use advertising cookies or third-party advertising trackers. Our Cookie Policy describes these technologies, their lifetimes and browser controls.

We do not track your activity across other companies' websites for advertising. The Service does not change its behaviour in response to a Do Not Track signal. Global Privacy Control is a separate opt-out signal: because we do not sell or share information for cross-context behavioural advertising, there is no such activity to opt out of. You can still exercise other applicable rights by contacting us.

The Service is intended for readers aged 13 and over, subject to any higher local minimum age. We do not offer accounts to children under 13. If you are a younger reader, ask a parent or trusted adult to help you understand this policy. A parent or guardian must provide permission where the applicable law requires it; an age statement in our Terms does not replace a legally required consent process.

In simple terms: we use your email to help you sign in, remember the books you add and where you stopped reading, and use technical information to keep accounts safe. Your library is private from other readers. We do not use your information for targeted advertising. You can ask us to explain, correct or delete information by contacting support.

If you believe a child under 13 has an account, or that required permission is missing, contact our support team. If we learn of such an account, we will investigate, restrict or close it as appropriate, and take steps to delete information that we cannot lawfully retain. Parental requests are handled with regard to the child's rights and applicable law.

We may update this policy as our practices, the Service or legal requirements change. The date above identifies this version. We will provide reasonable notice of material changes through the Service or by email and obtain consent before new processing where the law requires it. A policy update alone does not authorise an incompatible new use.

For questions about this policy or the handling of your information, email our support team.