Your privacy, in plain words.

Reads is a private reading journal. This page explains, in words a young reader can follow, exactly what we keep on our servers and why.

In one paragraph

Reads only stores what you type into the app: your name, your email, the books you've added, the ratings you gave them, and your reviews. We do not track you across the internet, we do not sell any information to advertisers, and we do not use your data to train AI models. Your bookshelf belongs to you.

What we keep

Your name and email — so we can sign you in and send you password-reset emails.
Your date of birth — only to check you're old enough to make an account (8+). We never publish your age.
The books you add and rate — your reviews are public in the app so other readers can see them.
Reads+ subscription info — if you pay, we store the plan and expiry date. Card details are handled by Stripe.
Photos you scan — if you use “Add photo of library”, we send the photo to our AI helper to read the titles. It is not saved afterwards.
Signup metadata — when you create your account we record the IP address you signed up from and the “user-agent” string sent by your browser (e.g. “Chrome 120 on Windows”). We use this only to spot bot signups and gambling-spam waves. It is never linked to your reading activity or shared with anyone else.

What we don't do

We don't track you across other websites.
We don't sell, rent, or trade your data with anyone.
We don't use your books, reviews, or messages to train AI models.

Ads (Google AdSense)

Reads is free to use, and once you've reached your monthly limit (10 books or 50 recommendations), we show a small banner ad served by Google AdSense to keep the lights on. Under the cap, and as a Reads+ subscriber, you never see ads.

Ads are served directly by Google — Reads doesn't pick what you see.
Google may read cookies in your browser and receive your IP address, user-agent, and page URL in order to serve ads and prevent fraud. It never receives your name, email, books, or reviews.
Personalised (behavioural) ads require your consent. On the current site, ads are non-personalised by default — you can enable personalisation any time via the Cookies banner.
Full details at Google's ads policy and how Google uses partner-site data.
To opt out of personalised ads across the web, visit Google Ads Settings.

If you're under 14

When you sign up, we ask your parent or guardian for permission by email. Your account stays locked until they click the link we send them. This is required by Spain's data-protection rules (LOPDGDD and the EU's GDPR).

Who we share things with

Stripe (Ireland/USA) — processes Reads+ payments.
RevenueCat (USA) — manages Reads+ subscription state across the web and any mobile apps. RevenueCat receives a pseudonymous customer ID (a random identifier we assign, not your email or name), your Reads+ product ID, purchase receipts relayed from Stripe / App Store / Google Play, and basic device metadata (platform, app version). It stores your renewal date and entitlements so we can grant or revoke Reads+ access instantly wherever you sign in. It never receives your books, reviews, ratings, or reading history. See RevenueCat's privacy policy.
Resend (USA) — sends transactional emails.
Anthropic / Claude (USA) — powers “For you” recommendations and the photo scanner. Never used to train.
Cloudflare (USA/global) — powers the “I'm not a robot” check on the sign-up form (Turnstile). Cloudflare briefly sees your IP and browser fingerprint to decide if you're a real person; nothing about your reading activity is sent.
Google AdSense (USA) — free users who've reached the monthly limit see banner ads served by Google. Google receives your IP, user-agent, and the page URL; it never receives your name, email, or reading activity. See the Ads section above and Google's ads policy.

Your rights

You can, at any time, see everything we've stored, change your name or email, delete individual reviews or books, or delete your whole account via the Contact page. Under UK / EU GDPR (and equivalent laws in other jurisdictions) you also have the following rights — email readscoteam@gmail.com to exercise any of them and we'll respond within 30 days.

Access — you can request a free copy of all data we store about you.
Erasure — you can ask us to delete your personal data (the “right to be forgotten”).
Portability — you can request a copy of your data in a machine-readable format to transfer to another provider.
Correction — you have the right to have inaccurate personal data corrected.
Objection & restriction — you can object to, or ask us to restrict, certain processing.
Complaint — you can lodge a complaint with the Spanish supervisory authority, the AEPD.

Data controller

The data controller is the project owner operating from Spain — contact via readscoteam@gmail.com.

Legal bases (Art. 6 GDPR)

Contract (6.1.b) — account, library and Reads+.
Legal obligation (6.1.c) — billing records required by Spanish tax law.
Consent (6.1.a) — mailing-list newsletter, photo scanner.
Legitimate interest (6.1.f) — abuse-prevention rate limits.

Retention

Account data: while your account is active; deleted within 30 days of your request.
Billing records: 6 years (art. 30 Código de Comercio).
Email logs: 12 months.
Uploaded photos: not stored — discarded after AI processing.
Signup IP + user-agent: 12 months, then deleted or hashed.
Server access logs: 30 days.

International transfers

Some processors operate US servers. Transfers rely on Standard Contractual Clauses (Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework.

Cookies

Reads uses strictly-necessary cookies for authentication and language preference, plus Google AdSense cookies for free users who've hit the monthly cap. See the Cookies Policy for the full table.

How to complain

You may complain to the AEPD (www.aepd.es) or via the EU ODR platform (ec.europa.eu/consumers/odr). We'd prefer you write to us first via the Contact page.

Last updated: 26 August 2026.