Privacy Policy

What we collect

You can create an account with an email address and password, or sign in with Google, GitHub, or LinkedIn. We store your email address, your display name, and, for social sign-in, the profile image that provider returns. Passwords are never stored in plain text; we store only a salted bcrypt hash.

While you read, we record your progress (which book, chapter, and section you last opened), your bookmarks, your notes, and any comments you post. This data is bound to your account and is used to sync your position across your devices and to show your comments where you posted them.

To keep accounts safe we keep device and session records (a device label, browser and operating system details, and when a device was last active) and the IP addresses of requests. IP addresses are used for rate limiting and security logs.

What we don't do

• We don't sell, rent, or trade your personal data.
• We don't share your reading activity with third parties for advertising.
• We don't use third-party trackers to follow you around the web.

Payments

Paid plans are processed by Stripe. Your card details are entered on Stripe's pages and never reach our servers. We keep only the identifiers and status Stripe sends us (customer, subscription, and payment references) so we can give you access and handle refunds.

Email and notifications

We send transactional email (email verification, password reset, receipts, and subscription notices) through Resend. We send you push notifications only if you opt in on your device, and you can turn them off at any time in your browser settings.

Cookies and sessions

We use a session cookie to keep you signed in, a device token cookie that ties a sign-in to one registered device, and a small preference cookie for your theme. They are not used for advertising, and we don't use third-party advertising cookies.

Where your data lives

AI Book is hosted on Railway. Your account data is stored in a PostgreSQL database located in the United States.

How long we keep it

Account data (profile, progress, bookmarks, notes, comments) is kept until you delete your account. Security logs are kept for 90 days. Stripe webhook records are kept for 90 days.

Your rights and deleting your account

You can ask us to give you a copy of your data, correct it, or delete your account and all associated data by emailing the address below. We'll process the request within seven days.

Contact

Questions about this policy or requests about your data: [email protected].

Last updated October 6, 2026. For general questions you can also write to [email protected].