Privacy Policy

This policy applies to the Aleph mobile app, this website, and any related services we operate. It is written for readers, not lawyers, and we have tried to keep it specific rather than vague.

The data controller is PLACEHOLDER — legal entity name and registered address. If you have questions about anything here, the contact details are at the end.

When you create an account we collect the details needed to run it:

• Account details: your email address, username, display name, and password (stored only as a salted hash — we never see it).
• Profile information: anything optional you choose to add, such as an avatar, bio, or the reading goal shown on your profile.
• Books you add: titles, authors, editions and page counts, including any you enter manually for textbooks, course readers or PDFs.
• Anything you write: club messages, captions on shared cards, and support requests you send us.

This is the core of the service, and the most sensitive thing we hold. When you log a reading session we record:

• Session timing: when the session started and stopped, and how long it ran.
• Position: the page range covered, or the equivalent position reported by an e-reader, and the resulting progress through the book.
• Derived measures: pace in pages per minute, session counts, streak length, and progress against any goal you set.
• Listening: for audiobooks, the duration listened and the page-equivalent it converts to.
• Retroactive entries: sessions you add after the fact, which we store the same way and mark as manually entered.

A reading history can reveal beliefs, health conditions, sexuality, politics and more. We treat it accordingly: it is private to you by default, it is never sold, and it is not used to build advertising profiles.

• Device and app information: device model, operating system version, app version, and language.
• Diagnostics: crash reports and error logs, used to fix faults.
• Connection data: IP address and timestamps when your app talks to our servers, retained briefly for security and abuse prevention.
• Time zone: your device's local time zone, because streak days are evaluated locally so that travel does not cost you a day.

These are commitments, not defaults we might quietly change:

• Your highlights and annotations. What you mark inside a book stays on your device. Aleph records that you read and how far, never what you noted.
• Third-party store credentials. We never ask for your login to any e-book store or library service.
• Your contacts, photo library, or precise location.
• Advertising identifiers. We do not run third-party advertising in Aleph and do not share your data with ad networks.

If any of this ever needs to change, we will tell you before it does, not afterwards.

• To run the service: recording sessions, maintaining your library, calculating pace, streaks and goal projections.
• To show you your own history: weekly and yearly views, personal bests, and finished-book summaries.
• To operate the social features you opt into: your feed, the people you follow, and any book clubs you join.
• To generate share cards when you finish a book, at the moment you ask for one.
• To keep the service safe: preventing abuse, investigating fraud, and enforcing our Terms.
• To support you: answering the messages you send us.
• To improve Aleph: understanding which features are used, in aggregate.

Where the GDPR or UK GDPR applies, we rely on performance of our contract with you for running the service, your consent for anything optional, and our legitimate interests in keeping Aleph secure and working. You can withdraw consent at any time.

Visibility is something you control, and the defaults are conservative.

Private by default

Your session history and your personal pace are private unless you choose to share them. Nobody sees your individual sessions, your reading speed, or your library simply by finding your profile.

Your feed

If you follow people or accept followers, activity you have chosen to make visible — books started and finished, streaks held, sessions logged — appears in their feed, along with any kudos.

Book clubs

In a club, other members can see your position in the club's current book and whether you are on pace for the meeting. They cannot see your personal pace or your session history unless you share it. The feed is spoiler-safe by design: it shows how far someone has read, never what happened.

Share cards

A share card is generated only when you ask for one. Once you post it outside Aleph, it is out of our hands and governed by wherever you posted it.

If you import a CSV from another service or a spreadsheet, we process the contents to create your library and any historical sessions the file describes. We keep the imported data on the same terms as everything else.

You can export at any time. Full CSV export of your library and every logged session — start time, duration, page range and title — is available in settings. Your reading history is yours, and it is not trapped here.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We share data only with service providers who process it on our instructions and under contract — PLACEHOLDER: list your actual sub-processors for hosting, crash reporting, email delivery and analytics, with their locations. We also disclose information where we are legally required to, where it is necessary to protect someone's safety, or to a successor entity if the business is sold — in which case we will tell you before your data moves.

• Account and reading data: kept while your account is open, because the point of the service is a long-term record.
• Deleted account: your library, sessions and profile are deleted within PLACEHOLDER days of your request, except where we must keep something to meet a legal obligation.
• Diagnostics and crash logs: PLACEHOLDER days.
• Connection logs: PLACEHOLDER days.
• Backups: purged on our normal backup cycle, PLACEHOLDER.

Wherever you live, you can view your data in the app, export all of it as CSV, correct your profile, and delete your account and its contents.

If you are in the EU, UK, or another region with comparable law, you also have the right to access, rectify, erase, restrict, object to, and port your data, and to complain to your local supervisory authority. If you are a California resident, you have the rights to know, delete, correct, and opt out of sale or sharing — and as stated above, we do not sell or share personal information. We will not discriminate against you for exercising any of these rights.

To make a request, contact us at PLACEHOLDER — privacy contact email. We respond within the period the applicable law requires.

We may process your data in countries other than yours, including PLACEHOLDER. Where we transfer personal data out of the EEA or UK, we use an approved transfer mechanism such as the Standard Contractual Clauses, together with additional safeguards where required.

We encrypt data in transit, store passwords only as salted hashes, and limit internal access to your reading data to the people who need it to operate or support the service. No system is perfectly secure, and we will not pretend otherwise — if a breach affects you, we will notify you and the relevant regulator as the law requires.

Aleph is not intended for children under PLACEHOLDER, and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.

This marketing site is deliberately plain. As published, it sets no cookies, runs no third-party analytics or tracking scripts, and serves its fonts and images from our own domain, so visiting these pages does not send your browsing to anyone else. Our hosting provider keeps standard server logs.

If we later add analytics or any other third-party script, we will update this section before doing so, and add a cookie notice if one is required.

If we make a material change — particularly to what we collect, who can see it, or who we share it with — we will tell you in the app or by email before it takes effect, and update the date at the top of this page.

Privacy questions and requests: PLACEHOLDER — privacy contact email. Postal address: PLACEHOLDER. If you are in the EU or UK and we are required to have a representative or Data Protection Officer, their details go here: PLACEHOLDER.