Privacy
What is stored
- Book text, encrypted. The text of every book you import is encrypted in your browser with a key derived from your password (or, without an account, a random key that stays in this browser) before it is sent. The server stores the ciphertext and cannot read it. The operator cannot read your books without your password, and there is no password reset for the same reason.
- Book metadata in the clear: title, author, chapter titles, word count, cover image, reading position. The library page needs them.
- Account: your email, a hash of a value derived from your password (never the password itself), and the salt and wrapped key that let your browser rebuild its key from the password.
- Access log: IP address, browser user agent, request path and status for requests to the API, kept for 60 days and then deleted automatically.
- One cookie, the signed session that identifies your browser or your login. Nothing else. No third-party analytics, no tracking cookies, no ads, so there is no consent banner. Every script, style and image is served from this server; no third party is contacted when you use the site.
During an import the server extracts the text from your file in memory in order to clean it and hands it back to your browser for encryption. It is not written to disk and not logged.
Where
On servers run by the operator: a machine at the operator's home and possibly a rented virtual server in the European Union. Backups are copies of the same encrypted data.
Your rights
Under the GDPR and Brazil's LGPD you can ask what is held about you, take it out, and have it deleted. Everything here is yours to export and delete without asking: the Download link in the reader gives you the text of any book, and the button below deletes your account, or this browser's anonymous library, and every book under it, at once and for good. Anything else, write to renatobritto.professional@gmail.com; requests are honoured within 30 days.
Contact
The operator of this site is reachable at renatobritto.professional@gmail.com. The source code is public, and the encryption design describes the encryption in full.