Your privacy, in plain words.

Reads is a private reading journal. This page explains, in words a young reader can follow, exactly what we keep on our servers and why.

In one paragraph

Reads only stores what you type into the app: your name, your email, the books you've added, the ratings you gave them, and your reviews. We do not track you across the internet, we do not sell any information to advertisers, and we do not use your data to train AI models. Your bookshelf belongs to you.

What we keep

Your name and email — so we can sign you in and send you password-reset emails.
Your date of birth — only to check you're old enough to make an account (8+). We never publish your age.
The books you add and rate — your reviews are public in the app so other readers can see them.
Reads+ subscription info — if you pay, we store the plan and expiry date. Card details are handled by Stripe.
Photos you scan — if you use “Add photo of library”, we send the photo to our AI helper to read the titles. It is not saved afterwards.
Signup metadata — when you create your account we record the IP address you signed up from and the “user-agent” string sent by your browser (e.g. “Chrome 120 on Windows”). We use this only to spot bot signups and gambling-spam waves. It is never linked to your reading activity or shared with anyone else.

What we don't do

We don't track you across other websites.
We don't put ads in Reads.
We don't sell, rent, or trade your data with anyone.
We don't use your books, reviews, or messages to train AI models.

If you're under 14

When you sign up, we ask your parent or guardian for permission by email. Your account stays locked until they click the link we send them. This is required by Spain's data-protection rules (LOPDGDD and the EU's GDPR).

Who we share things with

Stripe (Ireland/USA) — processes Reads+ payments.
Resend (USA) — sends transactional emails.
Anthropic / Claude (USA) — powers “For you” recommendations and the photo scanner. Never used to train.
Cloudflare (USA/global) — powers the “I'm not a robot” check on the sign-up form (Turnstile). Cloudflare briefly sees your IP and browser fingerprint to decide if you're a real person; nothing about your reading activity is sent.
Google AdSense (USA) — free (non-Reads+) users see banner ads served by Google. Google may set cookies to serve relevant ads and prevent fraud. Personalised ads require your consent (see the Cookies banner). See Google's ads policy.

Your rights

You can, at any time, see everything we've stored, change your name or email, delete individual reviews or books, or delete your whole account via the Contact page.

Data controller

The data controller is the project owner operating from Spain — contact via readscoteam@gmail.com. No Data Protection Officer is appointed (thresholds of art. 37 GDPR / art. 34 LOPDGDD are not met).

Legal bases (Art. 6 GDPR)

Contract (6.1.b) — account, library and Reads+.
Legal obligation (6.1.c) — billing records required by Spanish tax law.
Consent (6.1.a) — mailing-list newsletter, photo scanner.
Legitimate interest (6.1.f) — abuse-prevention rate limits.

Retention

Account data: while your account is active; deleted within 30 days of your request.
Billing records: 6 years (art. 30 Código de Comercio).
Email logs: 12 months.
Uploaded photos: not stored — discarded after AI processing.
Signup IP + user-agent: 12 months, then deleted or hashed.
Server access logs: 30 days.

International transfers

Some processors operate US servers. Transfers rely on Standard Contractual Clauses (Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework.

Cookies

Reads uses only strictly-necessary cookies and local storage. See the Cookies Policy.

How to complain

You may complain to the AEPD (www.aepd.es) or via the EU ODR platform (ec.europa.eu/consumers/odr). We'd prefer you write to us first via the Contact page.

Last updated: 20 July 2026.