What we hold, and what we never touch

The short version

• We hold your email address, the things you read here, and what we measured while you read them.
• It lives on our own machines — PostgreSQL for the database, Ceph for stored files, both on hardware we own and run. Not a public cloud.
• Documents you import are yours alone. They are never pooled with other readers’ content, never shared, and never used to train anything.
• There is no advertising technology, no third-party analytics and no cross-site tracking in this product. The only third-party script anywhere is Stripe’s, on the checkout page, so that a payment can be taken.
• Your card details never reach our servers.
• Our usage analytics are first-party and keyed to a profile identifier. That makes them pseudonymous personal data, not anonymous data, and we say so rather than rounding it up.
• You can download everything in one file, and you can ask for all of it to be deleted.
• We do not sell personal data and we do not share it for advertising.

What we collect

Grouped by where it comes from. Nothing here is inferred from a third party — we have no data supplier.

What you tell us

• Your email address, because it is how you sign in and how we reach you about the account.
• A password, if you set one. It is stored as a hash — we cannot read it, and it is never written to a log. You can sign in with a one-time link instead and never set one.
• Settings you choose: country, language, time zone, appearance, and whether you want optional email. Optional email is off unless you turn it on.
• Your profile: the display name you read under and its reading preferences.

What you bring

• Documents you import and the text inside them, plus their title, author, source address, length and language.
• What you do with them: which are queued, being read, finished or archived; folders, tags and favourites; how far through each one you are, and on which device.
• What you write: highlights, notes attached to them, and saved vocabulary with the sentence it came from.

What we measure

• Reading sessions: when a session started and ended, how much of it was active reading, how many words, the reading mode, the kind of device, raw speed, comprehension, effective speed, regressions, and how steady your pace was.
• Daily summaries built from those sessions, and your curriculum and gate state — level, stage, skill mastery, attempts and their evidence.
• Streaks, achievements and any mastery records you hold.

What billing produces

• Your plan and its status, the renewal date, and a reference to the record held by our payment processor.
• An append-only payment record of what happened and when. It cannot be edited or deleted through the application — enforced by permissions, by policy and by a database trigger — because an audit trail that can be quietly corrected is not one.
• No card details. They are entered on our payment processor’s own hosted page and never pass through our servers.

Why we hold it

Each of these is a use we can point at in the product. There is no fifth purpose held in reserve.

• To sign you in, keep the account yours, and stop abuse.
• To serve you the document you asked for, at the position you left it.
• To measure your reading honestly and show you the result — which is the product, not a by-product of it.
• To take payment, and to answer you when you write to us.

Content you import stays yours

This is the paragraph most people came here to read, so it is the plainest one on the page. A document you import is stored against your account and nobody else’s. It is never pooled with other readers’ content, never shared, never sold, and never used to train any model. Readeroom does not send text you read or import to an outside company for analysis, scoring or training — the systems that process your reading run on our own hardware.

Read-aloud has one reader-controlled exception that needs saying precisely. A local device voice is produced by your browser or operating system on the device. If you choose a device voice marked “needs internet”, your browser or operating system may send the words being spoken to its voice provider under that provider’s privacy terms. Readeroom does not choose that provider, receive that request or receive the resulting audio. You can choose a local voice instead. Readeroom’s persistent audiobooks are made only from rights-cleared shared catalogue books, never from your private imports.

Isolation between accounts is enforced by the database itself, not by the application remembering to filter. Every table holding your data has row-level security forced on, so a query can only ever see rows belonging to the account it is running for. The security page describes the controls, and the gaps.

Cookies and local storage, in full

This is the complete inventory. Essential here means the product cannot do the thing you asked for without it. Everything listed is first-party — set by us, for this site alone. There is no advertising or cross-site tracking cookie in this product at all, so there is none to list.

On the checkout page, and only there, we load Stripe’s script so a payment can be taken. It is the only third-party script in the product and it is not loaded anywhere else; what it stores is governed by Stripe’s own privacy policy, not by this page.

So: we use only first-party cookies and local storage required for authentication, security, preferences and functions you asked for. Whether a consent banner is required follows from this inventory and a legal review of the places we operate in — it is not a conclusion we are entitled to reach about ourselves, and you will not find one claimed here either way. Today this table is written and checked by hand against the code; generating it from the code, so it cannot drift, is work we still owe this page.

Usage analytics, described accurately

There is no analytics vendor in this product. When we record how the product is used, the record is first-party: a product_events table in our own PostgreSQL, keyed to a profile identifier.

A profile identifier is not a name, but it is still you. That makes these events pseudonymous personal data, not anonymous data — and an earlier draft of this product’s own documentation called them anonymous, which was wrong. The rules they are held under:

• 13 months, then irreversible aggregation: the profile key is dropped and only daily counters survive.
• Those surviving counters are only kept at a coarseness that cannot single anyone out — a minimum cell size of 50 profiles, with smaller cells suppressed rather than published, and no per-item or free-text detail retained at all. A daily count of one person’s sessions is still that person’s data with the name filed off.
• On pages you can reach without an account, the identifier is a first-party session id that rotates every 24 hours and expires at 90 days. It is never joined to a profile after the fact. There is no cross-site identifier and no fingerprinting.
• These events must appear in your data export, and must be removed when your account is deleted, on the same terms as everything else on this page.

As of this version, nothing in the product writes to that table. The table and its rules exist; the code that would record an event does not. When that changes, this section is where it will be described, and the rules above are the ones it will be built against.

Who else can see it

Two service categories Readeroom uses, plus an optional device-voice provider that only your browser or operating system chooses when you select an internet-backed voice.

• Stripe — payments. You enter your card on Stripe’s own hosted page, so the card never reaches us. Stripe receives what it needs to take the payment and an account reference to attach it to.
• An outbound mail service — because a sign-in link, a password reset or an account notice has to leave our systems as email to reach your inbox. Those messages carry your email address and the reason we are writing.
• Your device’s speech provider, optionally — only when you select a voice marked “needs internet”. The browser or operating system may send the words being spoken to that provider. Readeroom does not receive the request or audio and cannot name the provider because the available voices come from your device.

There is no analytics provider, no advertising network, no data broker, no session recorder and no external model or inference service selected by Readeroom. The optional internet-backed device voice above is controlled by your device. We do not sell personal data, and we do not share it for advertising. If a court or a law requires us to hand something over, we will tell you unless we are forbidden from doing so.

Data-protection requests go to privacy@readeroom.com. We have not appointed a data protection officer and do not claim one.

How long we keep it

About backups, honestly. When you delete something it is removed from the live system immediately, and the last copy of it disappears when the backup holding it ages out — 30 days at the outside. We will not tell you deletion is instant everywhere, because it is never instant anywhere that keeps backups.

Two things worth saying plainly, because the word “backup” is usually left to do more work than it has earned. The first: these are not separately encrypted. They are held on the same on-premises storage as the live database and inside the same trust boundary, which is not itself encrypted at rest — so encrypting the copy and leaving the original in the clear would be decoration, not protection. That changes the moment a copy leaves this building: any off-site copy will be encrypted before it goes, and until that exists we are not claiming geographic redundancy we do not have. The second: a backup nobody has restored is a hope, not a backup. Ours is restored into an empty database and compared against the original — every table, every column, every access-control rule — and the check is written to fail loudly rather than to reassure.

Your rights, and how to use them

These work whether or not the law where you live requires them of us. Write to privacy@readeroom.com from the address on the account, and a person answers.

• See it and take a copy. Your data in the account gives you one JSON file containing your account, profiles, reading sessions, baseline and curriculum state, streaks, mastery records, library entries and the coach moments you were shown. It is limited to two exports a day, because it is a heavy read, not because we are rationing it.
• Correct it. Settings and profile details are editable in the account. For anything you cannot reach yourself, write to us and we will fix it.
• Delete it. Delete your account — it is in the product, on the Your data page, and we do not make you explain why. We ask for your password, and for the word “delete” typed out, because the action cannot be undone once it runs. Then there is a fourteen-day grace period during which nothing is removed and the account works exactly as before; cancelling in that window restores everything. The grace period preserves your data — signing in is not treated as a change of mind, so simply logging in will not cancel a deletion someone else asked for. When it runs, we delete the account and everything keyed to it: profiles, sessions, measurements, library entries, imported text and everything derived from it, highlights, notes, vocabulary, analytics events and your sign-in credentials. Live deletion is immediate; backups expire as described above. Two things survive, and both are named on that page: the backup copies until they age out, and — where you made a payment — a record of the transaction with your identity removed from it, kept as a financial record. Prefer to write instead? Email us, and a person does it for you.
• Object, or ask us to stop a particular use. Tell us which use, and we will either stop it or tell you plainly why we cannot and what your options are.
• Complain. If you are somewhere with a data protection regulator, you can complain to it. We would rather you told us first, but that right does not depend on us.

Children

Child profiles are not available yet, so we hold no child profile data today. The database has a place for them, and for a guardian’s recorded consent, but no part of the product creates one — the feature is designed and not built.

Before family profiles are switched on, this page will say exactly what is held for a child profile, who can see it, and what a guardian can and cannot do with it. It will say so first, not afterwards.

Changes to this policy

This document is versioned. The version and effective date at the top identify it, and they are generated rather than typed, so they cannot say something the release does not.

Superseded versions stay reachable and are linked from the current one — a policy that quietly rewrites itself is not a policy. There is only one version so far, so there is nothing yet to link; this page says that rather than showing you an empty archive.

Contact

Privacy and data requests: privacy@readeroom.com. Anything else: help@readeroom.com. Security reports go to security@readeroom.com, and the security page explains what happens next.

The legal entity that operates Readeroom and its registered address: PMOAid Pty Ltd (ACN 654 942 757), trading as Readeroom Level 7, 90 Phillip Street, Parramatta NSW 2150, Australia