ShardReaderPrivacy Policy
A short list of things, kept for clear reasons, and deletable on request.
The short version. Reading needs no account and no name. An account stores your email address, a nickname, your bookmarks and what you post. There is no advertising, no analytics company, no tracking across other websites, and nothing is sold or shared for marketing. Payments are handled by Stripe; we never see your card. Ask us to delete your account and everything of yours goes, apart from payment records the law says to keep.
1. Who is responsible
IggyTag, who operates ShardReader, is the data controller. Contact: contact@shardreader.com.
2. What is stored, and why
| What | Why | Basis |
|---|---|---|
| Email address | To sign you in, confirm the account, reset a password, and send release emails if you want them | Contract |
| Password, stored only as a salted hash | So a stolen copy of the database does not reveal it | Contract |
| Nickname, avatar choice, reader ID | What other readers see instead of your email | Contract |
| Bookmarks and reading position | To put you back where you were, on every device | Contract |
| Messages in rooms, parties and private chats; suggestions and votes | To show them to whoever they were meant for | Contract |
| Reports you file, and our replies | To answer you, and to keep a record of moderation | Legitimate interest |
| Membership status, tier and renewal date | To unlock advance chapters | Contract |
| Whether you opened the site today, as a daily count | To know how many people visit, not who | Legitimate interest |
| Which chapters have been opened, counted once per reader | To know what is being read | Legitimate interest |
| Sign-in sessions and the time of the last one | To keep you signed in and to spot misuse | Contract |
| Email delivery outcomes, with the address partly hidden | To tell whether an email you asked for actually arrived | Legitimate interest |
Visitors who are not signed in are counted with a key made by hashing the day, the network address and the browser description together. The day is inside the hash on purpose: the same visitor is a different key tomorrow, so nothing can be followed from one day to the next. The address itself is not stored.
We do not collect your name, your location, your contacts, or anything from other sites. There are no advertising trackers, no Facebook pixel, no Google Analytics.
3. Who else sees it
| Who | What they see | Where |
|---|---|---|
| Netlify, which hosts the site | Requests to the site, including network addresses in short-lived server logs | United States and their global network |
| Stripe, which takes payments | Your email, your card details, your payment history | United States and Ireland |
| Neon, the billing database | Your reader ID, subscription and invoice records | As configured for this site |
| Resend, which sends email | Your email address and the emails sent to you | United States |
| Google, if you sign in with Google | That you signed in; we receive your email address, name and Google account identifier | United States |
Each is used because the site needs it to work, under their own terms as a processor for us. Nothing is sold, rented or shared for anyone else's marketing. We may disclose information if the law requires it, or to protect readers from harm.
These services operate in several countries, so your information is transferred internationally. Where the GDPR applies, those transfers rely on the standard contractual clauses in each provider's terms.
4. Other readers
Other readers see your nickname, your avatar and your reader ID, plus whatever you post. They never see your email address. The author sees your email address, because the author runs the site.
5. How long it is kept
- Your account: until you delete it, or ask us to.
- Chat messages: while the room holds them. Rooms keep the most recent several hundred messages; older ones fall away by themselves.
- Reports: kept while open, then archived. Old archived cases are pruned.
- Daily visit counts: about four months, as counts, not as people.
- Email delivery log: the last few entries only.
- Payment records: kept by us and by Stripe for as long as tax and accounting law requires, which is usually five to seven years. These stay even after an account is deleted, because the law says they must.
- An account that never confirms its email: it can do nothing but read, and may be removed.
6. Your rights
Whatever country you are in, you may ask us to:
- See what we hold about you.
- Correct anything wrong. Your nickname, avatar and email settings can be changed in Profile yourself.
- Delete your account and everything of yours, apart from payment records the law requires us to keep.
- Take it with you: we will send your account data in a machine-readable file.
- Object to processing we do on the basis of legitimate interest, or ask us to restrict it.
- Withdraw consent to release emails at any time, without affecting the rest of your account.
Email contact@shardreader.com and we will answer within 30 days. You may also complain to the data protection authority for the country you live in, wherever that is.
When an account is deleted, the site searches itself afterwards to confirm nothing of that reader is left behind.
7. Children
The site is not meant for children under 13, and we do not knowingly keep information about them. If you believe a child has made an account, write to us and it will be removed.
8. Keeping it safe
- Everything travels over HTTPS.
- Passwords are stored as salted hashes, never in a readable form.
- Card numbers never reach this site; Stripe's own payment page handles them.
- Changing a password signs your other devices out and sends you a warning email with a one-press "this was not me" link.
- Access to the library and the billing database is limited to the author.
No site can promise perfect security. If a breach ever affects your information, we will tell you and the relevant authority as quickly as the law requires.
9. Cookies
See the Cookie Policy. In short: one cookie to keep you signed in, and some settings kept in your own browser. No advertising or tracking cookies.
10. Changes
If this policy changes, the date at the top changes with it, and anything significant is announced in the site.
Back to ShardReader