Privacy

Who is responsible

[To fill: the seller’s name, legal form, registered address, registration and VAT numbers]. Write to [To fill: the contact e-mail address] about anything on this page.

What we keep, and why

• Your account: your e-mail address, to sign you in with a code and to send your receipts and gift codes; the first name you gave the app, to address you; the language your phone showed when you last asked for a sign-in code, to write our e-mails in it; when you joined and last signed in; and whether your box may offer you new titles.
• Signing in: each code, valid for ten minutes. For each session, a fingerprint of its key rather than the key itself, when it began, when it ends (at most 90 days later) and whether you signed out. When you sign in on a computer by scanning a code with the app, the browser’s description of itself and the country its connection comes from, kept for two minutes so the app can show them before you approve.
• Your boxes: each box’s serial number and model, the name you gave it, its time zone and quiet hours, its language, what it shows at rest, the country it was made for, and the reader’s birth year if you gave it. The time zone and quiet hours decide when the box is served; the language and the country decide which sentences it may show; the birth year keeps sentences unsuited to the reader’s age off it.
• What your boxes showed: each sentence, when, and your local time then; the keys you pressed on the box; your answers to offers of titles; and each time you started a title again. This record is how the box learns what to show you. There is no profile apart from it.
• Your titles: which you own, how each came to you (chosen, bought, a gift, or given by us), and when.
• Your orders: what you bought, the amount and currency, whether Stripe or Apple took the payment and its reference there, the order’s status, the billing country the payment service reports, and a gift’s code. For each gift code, the account that bought it and the account that used it.
• E-mails: each receipt and gift-code e-mail, with the address it goes to, from when it is written until it is sent and after. Sign-in codes are not kept among them.

Your address and your country

We read the IP address of your connection to find the country it is in, using a table held on our own server. The lookup neither stores the address nor sends it anywhere. The country sets the currency of the prices you see, and, when a computer asks to be signed in, it is shown on your phone.

In your browser

• One cookie, which remembers the language you chose on this site for a year.
• Once you sign in here, your session key, in this site’s browser storage, until you sign out or it expires.
• During a checkout, a note in the tab that it started on this site.

No advertising, no analytics and no tracking run on this site or in the app. This site loads typefaces from Google Fonts, so your browser asks Google’s servers for them and Google receives your IP address.

Who else receives it

• Stripe takes payments on its own page. It receives your e-mail address from us, and your payment details and billing address from you.
• Apple takes payments in the iPhone app outside the United States, under Apple’s own privacy policy. It tells us the transaction and the country of the store.
• Postmark sends our e-mails. It receives your address and the content of each message.
• The sentences are written and checked with AI models reached through OpenRouter. Nothing about you is sent there: those requests carry subjects and sentences, never an account, a box or what anyone read.
• [To fill: where the servers, the database, stored files and server logs are hosted, by whom, and whether data leaves the European Economic Area].

How long

• Your account, boxes, titles and what your boxes showed: while your account exists. Unbinding a box deletes its settings; what it showed stays with your account.
• Sign-in codes: ten minutes. Computer sign-in requests: two minutes. Both are then cleared.
• Session records: until your account is deleted.
• Orders: [To fill: how long orders are kept, which is the accounting period the seller’s country requires].
• Server logs: [To fill: how long server logs are kept].

Deleting your account

You delete your account from the app, under Account, with a code sent to your address. Everything below goes at once, together:

• your account, its sessions, and the computer sign-ins it approved;
• your boxes and their settings;
• what your boxes showed and the keys you pressed, your answers to offers, and the titles you started again;
• your titles, bought ones included.

Two records stay, with you taken off them:

• your orders, because a seller must keep its sales records;
• gift codes, without who bought or used them, so that a used code stays used.

[To fill: to fix before publishing: deleting an account does not yet remove the record of which title offers its boxes displayed].

[To fill: to decide before publishing: deleting an account keeps each receipt and gift-code e-mail sent to it, with the address].

Stripe and Apple keep their own records of your payments, under their own policies.

Your rights

You can change your name and e-mail address in the app, and delete your account there. To see what we hold about you, to receive a copy, to correct it, or to object to a use of it, write to [To fill: the contact e-mail address]. You may also complain to the data protection authority of the country you live in.