Your reading,
kept private.

IWho we are

Chat your book is a reading service offered through chatyourbook.com and the Chat Your Book mobile applications (together, the "Service"). The Service is operated from the United Kingdom. For any privacy question or request, write to support@chatyourbook.com.

IIWhat we collect

Account information

When you create an account, we collect your email address. If you sign in with Google or Apple, we also receive your name and profile picture from that provider. This is used only to identify your account and personalise your experience.

Reading activity

We store your reading progress, annotations, preferences, and onboarding choices (such as genre preferences and student status) so your library follows you between devices and sessions. This data is tied to your account and visible only to you.

Chat and AI interactions

When you use margin chat or alternative-plot features, your messages and the AI responses are saved so you can return to a conversation later. Messages are sent to our AI provider (Anthropic) for processing. They are not used to train AI models.

Payment information

We never see or store your card details. Web payments are processed by Paddle (our Merchant of Record). Mobile in-app purchases are processed by Apple or Google. Subscription status is managed through RevenueCat. Each of these providers handles payment data under its own privacy policy.

Analytics

We use PostHog and Google Analytics to understand which features people use, so we can improve them. Where the law requires it (UK, EU, Australia, New Zealand and similar jurisdictions), analytics cookies are set only after you give consent through the cookie banner.

Device information

On mobile, we may log device type, operating system version, and app version for debugging and compatibility. This is not linked to your identity.

Local storage on your device

On mobile, sign-in tokens are kept in the device secure credential store. Reading progress, settings, downloaded books, annotations, notes, and queued sync data may be stored inside the app's local sandbox so the app can work offline. Local notes are not stored as an encrypted notes vault, so anyone with access to an unlocked device may be able to view app data. Use a device passcode and biometric lock to protect this.

IIIWhy we are allowed to use your data

Under UK and EU law, we rely on the following legal bases:

• Contract: to deliver the Service you signed up for, including accounts, reading progress, and chat features.
• Legitimate interest: to keep the Service secure, prevent fraud, and improve features through analytics.
• Consent: for non-essential analytics cookies in jurisdictions that require it, and for any optional communications.
• Legal obligation: to keep financial records as required by law.

IVHow we use your data

We use your data only to:

• Provide and maintain the Service.
• Save your reading progress, annotations, and chat history.
• Send your chat messages to the AI provider for processing.
• Manage your subscription through RevenueCat, Paddle, Apple, or Google.
• Personalise the experience based on the preferences you set.
• Send important service notices (for example, changes to terms or billing).
• Understand product usage, in aggregate, through analytics.

We do not sell your personal data. We do not use it for advertising. We do not use it to train AI models.

VWho we share data with

We share data only with the providers we need in order to run the Service. Each one is bound by a data-processing agreement.

• Anthropic: processes chat messages to generate AI responses (USA).
• Paddle: handles web payments as Merchant of Record (UK / USA).
• Apple and Google: handle mobile in-app purchases.
• RevenueCat: manages subscription entitlements (USA).
• PostHog: product analytics (USA / EU).
• Google Analytics: website analytics (global).
• Neon: database hosting (USA / EU).
• Cloudflare: hosting and content delivery (global).

VIInternational data transfers

Some of our providers are based outside the UK and EU, including in the United States. When your data leaves your region, we protect it using:

• Standard Contractual Clauses approved by the UK and EU.
• Data-processing agreements with every provider.
• The provider's own compliance certifications (such as SOC 2 or ISO 27001 where applicable).

VIIA note on AI

Several features are powered by AI, and we want to be open about how that works.

• Margin notes, summaries, and alternative plots are generated by Anthropic's models.
• AI output can be wrong. The original text is always the source of truth.
• Your messages are sent to the AI provider for processing only, not for training.
• We choose models based on literary understanding, accuracy, and safety.
• A portion of subscription revenue goes to environmental charities to offset the carbon cost of AI.

VIIIHow long we keep data

IXYour rights

UK and EU (GDPR)

You have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct anything that's wrong.
• Erasure: ask us to delete your data ("right to be forgotten").
• Portability: receive your data in a machine-readable format. Use the "Export My Data" feature in your account.
• Object: object to processing based on legitimate interest.
• Restrict: ask us to limit how we use your data.
• Withdraw consent: withdraw consent at any time, where consent is the basis for processing.

You may also lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority.

United States (California: CCPA / CPRA)

If you live in California, you have additional rights:

• Right to know: what personal information we collect and how we use it.
• Right to delete: request deletion of your personal information.
• Right to correct: request correction of inaccurate information.
• Right to opt out of sale: we do not sell your personal information.
• Right to non-discrimination: we won't treat you differently for using your rights.

Categories of personal information we collect: identifiers (email), internet activity (reading progress, feature usage), and inferences (reading preferences). We do not collect sensitive personal information as defined by the CPRA.

Australia (Privacy Act 1988)

Under the Australian Privacy Principles, you can:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Some of your data may be sent to overseas providers (see section VI). We take reasonable steps to ensure they comply with the APPs.

New Zealand (Privacy Act 2020)

You have the right to:

• Access your personal information (Information Privacy Principle 6).
• Correct your personal information (IPP 7).
• Complain to the Office of the Privacy Commissioner (privacy.org.nz).

We only disclose information to overseas recipients where we are satisfied they have comparable privacy protections.

To use any of these rights, write to support@chatyourbook.com, or use the "Export My Data" and "Delete Account" controls in the app. We respond within 30 days.

XCookies and consent

We keep cookies to a minimum:

• Essential cookies: sign-in session and theme preferences. These are required for the Service to work.
• Analytics cookies: PostHog and Google Analytics. In the UK, EU, Australia, New Zealand, and similar jurisdictions, these are set only after you consent.

We do not use advertising, retargeting, or third-party marketing cookies.

XIChildren's privacy

Chat your book is made for secondary-school students and older readers — you must be 13 or older to create an account, and you confirm this when you sign up. We do not ask for, and do not knowingly collect, personal data from children under 13. In the United States, this aligns with the Children's Online Privacy Protection Act (COPPA). In the UK and EU, where the digital consent age in your country is higher than 13, you may need a parent or guardian's agreement to use the Service. If you believe a child under 13 has provided us with personal data, contact support@chatyourbook.com and we will delete it promptly.

XIISecurity

We use industry-standard protections, including encrypted connections (HTTPS / TLS), secure database hosting, hashed passwords (bcrypt), and biometric sign-in options on mobile (Face ID, Touch ID). Mobile sign-in tokens are kept in the device secure credential store; offline notes and reading state sit inside the app sandbox as described above. No system is perfectly secure, so we cannot guarantee absolute protection.

XIIIChanges to this policy

We may update this policy from time to time. If a change is material, we will notify you by email or through the Service. The "last updated" date at the top shows when the policy was last revised.

XIVContact

For any privacy question or request, write to support@chatyourbook.com. If you are not satisfied with our response, you can contact the supervisory authority in your jurisdiction (see section IX).