1. What we collect

We collect only what we need to run Cozy-Reader:

• Account details. Your email address and password. Your password is stored only as a secure hash by our sign-in provider; we can't read it.
• Your content. The PDFs you upload and everything you make with them: notes, highlights, bookmarks, flashcards, chat messages and images you add. To make a PDF readable and searchable we turn it into page text and images, build a search index, and may generate a cover image.
• How you use your library. Things the app needs to work for you, such as how far you have read, your favorites, study sessions and flashcard results, and how much of your monthly AI and upload allowance you have used.
• Billing details. Stripe handles payments. We receive your subscription status, plan, trial and renewal dates, and a customer ID from Stripe. We never see or store your full card number.
• Technical data. Basic server logs, such as IP address, browser type, the pages and features requested, and errors, which we use to keep the Service running and secure.

We don't use advertising, ad trackers or third-party analytics, and we don't buy data about you from anyone.

2. How we use it

We use your information to:

• provide the Service: show your library, read and search your PDFs, and run notes, chat and flashcards;
• sign you in, keep your account secure, and prevent abuse;
• run your subscription and free trial, and send emails about your account and billing;
• fix problems and keep the Service working well; and
• meet legal obligations.

We don't sell your personal information, we don't share it for targeted advertising, and we don't use your content to train AI models.

3. AI features

The assistant, document search, summaries, AI note edits, flashcard drafts and generated covers use AI models from OpenAI. When you use them, only the parts of your content needed for that request (for example, passages from your PDF, your question, or the note text you ask to change) are sent to OpenAI. We ask OpenAI not to store these requests, and under OpenAI's terms for business customers they are not used to train its models.

4. Who we share it with

We share information only with service providers that help us run Cozy-Reader, and only what each needs to do its job for us:

• Supabase: sign-in, database and file storage.
• OpenAI: AI features, as described above.
• Stripe: payments and billing. Stripe's own privacy policy applies to the payment details you give it.
• Amazon Web Services (AWS): the servers that run the website and app, and the emails we send about your account, such as sign-up confirmations and password resets.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger, acquisition or sale of the business, in which case this policy continues to apply to it.

5. Private PDFs and image links

Your original PDF files are private to your account. To load quickly, images taken from your PDFs (page images, figures and covers) and images you add to notes, chats and flashcards are served from long, randomly generated web addresses. They aren't listed anywhere, but anyone who has one of those exact addresses can view that image, so don't share them.

6. Cookies and local storage

We use a small number of cookies and browser storage, all needed for the app itself:

• sign-in cookies that keep you signed in;
• a cookie that remembers whether you keep the sidebar open; and
• browser storage that remembers your light or dark theme and similar display choices.

We don't use advertising or cross-site tracking cookies.

7. How long we keep it

We keep your account and content for as long as your account exists, including after a subscription ends, so you can pick up where you left off if you subscribe again.

• Removing a PDF from your library permanently deletes it, along with its notes, flashcards, chats and images.
• To delete your whole account, email eddie@eamakes.com from your account's email address. We delete it and all its content within 30 days.
• Copies in backups are removed on their normal schedule.
• We keep billing records for as long as tax and accounting laws require.

8. Your rights and choices

You can ask us to give you a copy of your personal information, correct it, or delete it. Email eddie@eamakes.com from your account's email address and we will respond within 30 days (45 days where the law allows). We may need to confirm it's you first. We won't treat you differently for using these rights.

California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing for targeted advertising. We don't sell or share personal information in that way. You can make a request yourself or through an authorized agent.

If you live in the European Economic Area or the United Kingdom, you also have the rights to restrict or object to our use of your information, to data portability, and to complain to your local data protection authority. We use your information to perform our contract with you (running the Service and your subscription), for our legitimate interests in keeping the Service secure and working, and to meet legal obligations.

9. Security

We protect your information with encryption in transit, access controls that keep each account's data separate, and trusted providers. No online service is perfectly secure, so keep your own copies of anything important. If a breach affects your information, we will tell you as the law requires.

10. Children

Cozy-Reader is not for children under 13, and we don't knowingly collect information from them. Users under 18 need a parent or guardian's permission, as our Terms explain. If you think a child under 13 has given us information, email eddie@eamakes.com and we will delete it.

11. Where your data is processed

Cozy-Reader is based in the United States, and our service providers may process data in the United States and other countries. Where the law requires it, we rely on safeguards such as the standard contractual clauses our providers offer.

12. Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will email you before it takes effect.

13. Contact us

Questions about your privacy or this policy? Email eddie@eamakes.com.