Privacy Policy
Effective 2026-08-03 · Version 2026-08-03
Deep Reading ("we") operates the Deep Reading apps and website. This policy explains what personal data we collect, why, and your rights.
Data controller: contact [email protected]. For any privacy request, write to that address; we respond within 30 days.
What we collect
Your email address and password (hashed); the books and files you upload; your annotations, notes, reading progress, and highlights; the questions and prompts you send to AI features; payment metadata (handled by our payment processor — we never see or store your card number); limited device/account preferences. We process IP addresses transiently for rate-limiting and abuse prevention (kept in short-lived cache, not in our database).
AI features share content with third parties
When you use reading-coach, translation, explain/summarize, PDF table-of-contents, or chat features, we send the relevant text — selected passages with surrounding context, chapter text, or your typed prompts — to our AI providers. Paid tiers use OpenRouter (United States), which may route your request to downstream model providers (such as OpenAI, Anthropic, or Mistral); the free tier uses Cloudflare Workers AI. These providers process your content to generate the response and retain it according to their own policies. We do not store the contents of your prompts on our servers beyond what is needed to deliver the response. Deleting your account cannot recall content already transmitted to these providers.
Who we share data with (sub-processors)
Cloudflare (hosting: D1 database, R2 file storage, KV cache, Workers compute, Workers AI) — various locations; OpenRouter and its downstream model providers (US) — AI; Creem (payment processing); Resend (transactional email); Google (when you sign in with Google — we only receive your name, email, and a stable account identifier).
International data transfers
Your data is processed by providers in the United States and other countries. For users in the EEA, UK, and Switzerland, we rely on Standard Contractual Clauses (or an equivalent transfer mechanism) to protect personal data transferred outside those regions.
How long we keep your data
We keep your account data for as long as your account is active. You can delete your account and export your data at any time (see below). Note: a small amount of billing and audit data is retained as required for legal, tax, and accounting obligations. Deleted data may persist in platform backups for a limited period before it is overwritten.
Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. To exercise any right, contact [email protected]. You may also complain to your local data-protection authority.
Deep Reading is not intended for children under 16. By registering, you confirm you are at least 16 years old.
We protect access tokens with short-lived credentials and store passwords using a one-way salted hash. No security measure is perfect, but we follow current best practices.
We do not use advertising or analytics trackers, and we do not sell your personal data.