Privacy Policy

What we collect

• Account details: your email address, a password (stored only as a secure hash — we never see or store the plain text), and any display name, handle, bio, avatar, or timezone you choose to add.
• Reading data you create: your library and Collections, reading progress and dates, ratings, reviews, thread tags, reading goals, and any reading-subscription amounts you enter into the Reading Value feature.
• Community activity: posts, comments, likes, follows, blocks, reports, and feedback notes you send us.
• Library imports: the export file you upload and the rows we parse from it while the import runs.
• If you sign in with Google (where offered), Google shares your name, email address, and profile picture with us. We never receive your Google password.
• Standard technical logs (such as IP address and browser type) generated when any web server handles a request, used for security and debugging.

How we use it

We use your data to run Inkwoven: keeping your library and Patterns, showing your content to the readers your privacy settings allow, processing imports, and sending account emails such as verification and password-reset messages. If our product-updates mailing list is enabled, your email address is added to it when you sign up; every mailing includes an unsubscribe link. We don't sell your personal data, we don't share it with third parties for their own advertising, and we don't show ads.

Who can see what

• Your profile is split into sections (reading history, reviews, Patterns, Collections, currently reading, bio, community posts, reading value), and you control each one: everyone, friends (readers whose friend request you or they accepted), or only you. Reading Value is "only you" by default; blocking a reader hides you from each other.
• Posts and comments are shown to readers your community privacy setting allows. Thread tags contribute to a book's shared community Thread list. If you propose a new Thread, our reviewers can see that you proposed it; your name is only shown publicly alongside it if you choose to be credited.
• Uploaded import files are private. They are kept in private storage that is never publicly reachable, and no other reader can see them.
• Avatars and book covers are served from public media storage so pages can display them — treat your avatar as public.

Services we rely on

Inkwoven runs on cloud hosting providers that store our database and files on our behalf. Depending on how a deployment is configured, we also use: an email delivery service (Mailgun) to send account emails; an error-monitoring service (Sentry) that receives technical crash reports; a mailing-list service (Mailchimp) for the optional product-updates list; and Google Analytics, only if analytics is enabled for the site. When you search for a book or run an import with enrichment on, the search text or ISBN is sent to the Google Books and Open Library catalogs to find book details — your account identity is not attached to those lookups. These providers process data only to provide their service to us.

How long we keep it

• Your account and reading data are kept for as long as your account exists.
• Uploaded import files are kept only while they are needed to run and review the import. They are deleted automatically after a retention window (30 days by default), and you can delete them sooner from your import history at any time.
• The import history itself (what was imported and when, without the file) is cleaned up after about a year.
• When you replace or remove your avatar, the old image file is deleted from storage.

Cookies and local storage

Inkwoven uses a small set of first-party cookies: a session cookie that keeps you signed in, a CSRF cookie that protects forms against forgery, and a theme cookie that remembers your light/dark preference for about a year. Your browser's local storage holds minor interface preferences, such as banners you've dismissed. If Google Analytics is enabled for the site, it sets its own analytics cookies; otherwise there are no tracking or advertising cookies.

Security

Production traffic is served over HTTPS, passwords are stored as salted hashes, and import uploads live in private storage separate from public media. No online service can promise perfect security, but we take reasonable measures to protect your data and will tell you if we learn of a breach affecting you.

Your choices

You can edit your profile, privacy settings, library, and posts at any time, and delete uploaded import files yourself. To get a copy of your data, or to delete your account and everything in it, email us at tonybenson309@gmail.com and we will handle it. If you signed up for the mailing list, every email has an unsubscribe link.

Children

Inkwoven is not directed at children under 13, and we don't knowingly collect data from them. If you believe a child is using an account, contact us and we will remove it.

Changes and contact

If this policy changes meaningfully, we will update the date at the top of this page and make significant changes visible in the product or by email. Questions about your data? Contact us at tonybenson309@gmail.com.