Privacy policy

Who operates Readstack

Readstack is operated by Simon Smith, trading as Readstack.

What we collect

When you create an account, we collect:

• Your name, email address, and profile image URL, provided by your GitHub or Google account
• Authentication data, including the identifier provided by your login provider that lets us recognise your account

When you use Readstack, we store information associated with your library, including:

• URLs you save
• Extracted article content, titles, images, and metadata
• Your library state, such as whether an article has been archived

When you save a webpage, we store its content in your library so you can read it later. This content may include personal information from the page.

We also automatically collect limited technical information when you use the service, such as your IP address, browser type, operating system, and server logs. We use this information to operate, secure, and troubleshoot the service.

If you contact us, we may keep your correspondence for as long as necessary to respond to you and deal with any related issue.

We do not collect payment card details. Payments are processed by Stripe, and card data never touches our servers. We receive information about your Stripe customer record and subscription or payment status so that we can manage your account.

How we use it

We use your information to:

• Provide and maintain the service (saving and reading articles)
• Manage your account and subscription
• Process payments via Stripe
• Respond to support requests
• Comply with legal obligations

We do not sell your data. We do not share it with advertisers.

Legal basis

We process your personal data under the following legal bases:

• Contract: where processing is necessary to create and operate your account, save and retrieve your library, manage your subscription, and provide the service you have requested.
• Legitimate interests: where necessary to keep Readstack secure, prevent fraud and abuse, diagnose errors, and maintain the reliability of the service. Where we rely on legitimate interests, we consider whether those interests are outweighed by your rights and interests.
• Legal obligation: where we need to retain or disclose information to comply with applicable law, including tax, accounting, or regulatory requirements.

Social logins

You can sign in using GitHub or Google. When you do, that provider gives us the information needed to create and authenticate your Readstack account, including your name, email address, profile image URL, and a unique account identifier. We use this information only to create, identify, and manage your Readstack account.

GitHub and Google process information under their own privacy policies. See GitHub's privacy policy and Google's privacy policy for information about how those providers process your data.

Service providers

We use the following services to operate Readstack:

• Stripe processes payments and manages subscription billing. Stripe receives information necessary to process payments, manage subscriptions, and prevent fraud. We do not receive or store your full payment card details.
• Sentry provides error monitoring and may receive technical information, such as IP address, browser information, and diagnostic information, when an error occurs.
• Resend delivers transactional emails and receives information such as your email address and email delivery information when we send account or service messages.
• GitHub and Google provide account authentication when you choose to sign in using those services.
• Hetzner provides the infrastructure that hosts our application and database.
• Backblaze B2 provides object storage for static assets and stored article images.
• Cloudflare provides proxy, content-delivery, and security services and processes technical information such as IP addresses and request data.

We only provide service providers with information necessary for the purposes for which we use them. We do not use advertising networks or sell data to any third party.

Where your data is stored

Some of the service providers we use may process personal data in countries outside the UK or EEA. Where personal data is transferred internationally, we use providers and safeguards that allow those transfers to take place in accordance with applicable data protection law, such as recognised adequacy arrangements or approved contractual safeguards where required.

Contact us at [email protected] if you would like more information about how your data is protected when it is transferred internationally.

How long we keep it

We keep your account information and saved library for as long as your account is active.

If you delete your account, your account data and saved articles are deleted from our active systems. Limited information may remain temporarily in backups or system logs until those records expire through their normal retention cycle.

We may retain limited transaction, billing, or other records for longer where required by law or reasonably necessary to resolve disputes, prevent fraud, or enforce our agreements. Support correspondence and technical logs are retained only for as long as reasonably necessary for the purpose for which they were collected.

Children

Readstack is not designed or directed specifically at children. If we become aware that we have collected personal data from a child in circumstances where we should not have done so, we will take appropriate steps to delete it.

Your rights

Under the UK GDPR and, where applicable, the EU GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict how we process your data
• Receive a portable copy of your data

To exercise any of these rights, or to request an export of your data, email [email protected]. We will respond without undue delay and normally within one month, as required by applicable data protection law.

Where we process personal data on the basis of legitimate interests, you have the right to object to that processing.

You can also contact us at [email protected] if you have a complaint about how we handle your personal data. We will acknowledge data-protection complaints within 30 days and investigate and respond without undue delay.

If you are in the UK, you can also complain to the ICO. If you are in the EEA, you can contact your local data protection authority.

Cookies and similar technologies

We use cookies and similar browser-storage technologies where necessary to operate Readstack, keep you signed in, protect your account, and remember preferences you choose.

• A session cookie keeps you signed in.
• A CSRF/security cookie helps protect your account.
• Browser storage remembers your appearance preference, such as light or dark mode. You can change this preference in Readstack or clear it in your browser.

We do not use advertising cookies or technologies that track you across websites.

Changes to this policy

If we make material changes we will update the date at the top of this page. For significant changes we will notify you by email.