PRIVACY POLICY

The data controller is [Company name] Limited (company number [company number]), [registered office address]. Privacy questions and requests: [support email].

With an account:

• Email, username, password (password stored hashed, never readable), to run your account. Legal basis: contract.
• Platform activity, reading history and lists, coin balance and transactions, XP, achievements, comments, reviews, ratings, quiz results, submissions, to provide the features you use. Legal basis: contract.
• Purchases, if you buy coins or subscribe, payment is taken by Stripe. We never see or store your card details; we keep a record of what you bought, the amount, the date and a Stripe reference. Legal basis: contract and legal obligation (tax records).
• Consent records, which policy versions you accepted and when. Legal basis: legal obligation.
• Anonymous reading figures, so creators can see how their series are doing: which chapters were opened, how far into each one a reader got and for how long, when a series was shared, and a broad label for how the visit began (for example “TikTok”, “a search engine” or “a shared link”). These are tied to a random number kept in your browser, never to your account, name, IP address or the page you came from. Browsers that send Global Privacy Control or Do Not Track are not counted. Legal basis: legitimate interests.
• Marketing emails, only if you opt in at signup or later; unsubscribe any time. Legal basis: consent.

Without an account: reading progress and coin balance for guests are stored only in your browser's local storage, that data never reaches our servers (apart from the anonymous reading figures above).

We do not sell your data, run third-party advertising, or use tracking cookies.

Account data is stored with Supabase on AWS in Ireland (eu-west-1), inside the EU, which UK law recognises as giving your data adequate protection. The website is served by Vercel, whose edge network may process requests globally under standard contractual clauses; Vercel also gives us cookie-free page-view counts. Emails we send (sign-up confirmation, password reset, notifications) go through Resend. If you make an AI clip, the page image and your instructions are sent to Higgsfield to create it. Payments are processed by Stripe, which receives your email address and payment details as an independent controller under its own privacy policy. We share data with no one else except where the law requires it.

For as long as you have an account. If you delete your account, personal data is deleted or anonymised within 30 days, except records we must keep (e.g. consent logs, fraud prevention) which are kept only as long as legally required. Comments you posted may remain with your username replaced by "deleted user".

Under UK GDPR you can, at any time and for free:

• get a copy of the data we hold about you (access & portability);
• correct it (rectification);
• have it deleted (erasure, the "right to be forgotten");
• restrict or object to processing;
• withdraw any consent (e.g. marketing) without affecting your account.

Email [support email] and we will respond within one month. If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office at ico.org.uk.

The platform is for users aged 16 and over. We do not knowingly hold data on anyone younger; if you believe we do, contact us and we will delete it.

If this policy materially changes we will notify account holders before the change takes effect. The version you accepted is recorded against your account. See also our Terms of Use.