Privacy Policy

Read Master is operated by Read Master LLC (2108 N St Ste N, Sacramento, CA 95816, USA). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our reader, AI study tools, and related services. By using Read Master you accept the practices described here.

We collect the following categories of data:

• Account data. Email address, display name, and locale captured through Clerk when you sign up or sign in.
• Reading data. Books you upload or import, reading positions, highlights, annotations, and progress. Stored privately to your account and never shared with other users.
• AI interaction data. The text passages you select or have us analyze, the prompts we construct and send to Anthropic, and the AI-generated artifacts (guides) we cache for your reuse.
• Usage and analytics data. Product usage events sent to PostHog, our analytics provider, only after you grant Analytics consent in the cookie banner. These events are recorded against your account; they are not anonymous. They include, for example, that you opened a book, that you read in a book on a given day and how far through it you were, that you created an annotation (its type, such as highlight, note or bookmark, and its colour), that you used a lookup (which kind, how long it took and whether the answer came from our cache), and that an AI explanation was produced (its size in tokens and how long it took). These reading events refer to a book by an internal identifier, not its title, and never contain a word you looked up, a passage, or the text of a note or highlight.
• Payment data. Billing information processed entirely by Stripe. We never see or store your full card number.
• Error and diagnostic data. Anonymized crash reports and performance traces via Sentry, used only to improve service stability.

We use the data above strictly to operate Read Master:

• Render books and persist your reading progress and annotations across devices.
• Generate pre-reading guides via Anthropic Claude.
• Process subscription payments via Stripe.
• Send transactional and lifecycle emails (account confirmations, billing notices, feature announcements) via SendGrid — only when you have not unsubscribed.
• Monitor service health and diagnose errors via Sentry and our infrastructure providers.
• Improve the product using analytics about how it is used — only when you have given consent.

We do not sell your personal data, use it for advertising, or share it with third parties for their own marketing purposes.

Books, documents, and other content you upload or import are private to your account. Read Master personnel do not read your uploaded content in the ordinary course of business. Authorized personnel may access your content only in the following limited circumstances:

• Customer support. When you contact us with a specific support request and the resolution requires inspecting your content.
• Security and abuse prevention. To investigate suspected security incidents, unauthorized access, or violations of our Terms of Service that we have reasonable cause to believe involve your account.
• Legal compliance. When we receive a valid legal order, subpoena, or court order requiring disclosure, or when disclosure is necessary to protect the rights, property, or safety of Read Master, our users, or the public.
• Service operation and quality. To diagnose technical failures directly affecting your account (for example, a failed import or corrupted file) when no anonymized diagnostic path is available.

Any personnel access is logged and subject to confidentiality obligations. We do not permit access beyond these purposes.

Read Master routes certain content to third-party AI providers to generate the features you request. We send the minimum amount of content necessary for each feature:

• Anthropic (Claude). When you request a pre-reading guide or an "Explain this" answer, we transmit the relevant passage or chapter text — along with contextual metadata — to Anthropic's API. Anthropic processes this content to generate the response we return to you. Prompts to Anthropic are wrapped as untrusted user content; we do not pass your account credentials or payment information. Three more things reach Anthropic without a separate request from you. Before each AI request, we send the same content to Anthropic's token-counting service, which measures its length so the request fits the model's limit and returns only a number. After you import a book with AI features turned on, we send its pictures and their captions to Anthropic as one batch, so that image descriptions are ready for screen readers. And once a week we send a small sample of recent AI output back to Anthropic to be scored for quality: pre-reading guides with the book's title and author, and simplified chapters of public-domain books together with the original chapter. We never sample a chapter of a book that is not in the public domain.
• DeepL (translation). When you use the reader's word/passage translation lookup, we send the text you selected — plus a short snippet of the surrounding sentence or paragraph, used only as disambiguation context to improve accuracy — to DeepL's API to return a translation. We send only this reading content; never your account credentials or payment information.
• Google Cloud Translation. DeepL does not cover every language. When you ask for a translation into a language it lacks (for example Hebrew, Hindi, Vietnamese or Thai), we send the text you selected to Google Cloud Translation instead. We send only that text and the language you chose, with no surrounding passage; never your account credentials or payment information.
• Google Cloud Text-to-Speech (premium voices). When you listen with a premium voice or download a book's audio, we send the book's text to Google Cloud Text-to-Speech one sentence at a time, along with the language, voice, speed and pitch you chose. Google returns the audio, and we keep it for a time so the same sentence is not normally sent again; once that stored audio is deleted, playing the sentence sends it again. We do not send your name, email address, account identifier or payment information.

Read aloud with your browser's voices. The free read-aloud feature uses the voices built into your browser or device, not a Read Master server. We choose a voice that runs on your device whenever one exists for the book's language. If your browser has only online voices for that language, the browser itself sends each sentence to its maker (for example Google or Microsoft) to be spoken, under that company's terms.

Dictionary, thesaurus and encyclopedia lookups. When you look up a word in the reader, our server sends that word to the Free Dictionary API (definitions) and to Datamuse (synonyms and antonyms). When you look up a name or term, our server sends it to Wikipedia. These are public reference services, not contracted processors. Our server sends them only the word or term; never your name, email address or account identifier, and that request does not carry your IP address. One exception: when a Wikipedia entry has a picture, your browser loads that picture directly from Wikimedia, which then receives your IP address and browser details.

Pictures your browser loads from other sites. Cover photos on our blog come from Unsplash, and cover thumbnails in the Project Gutenberg catalogue search come from Project Gutenberg. Your browser loads these pictures directly from those sites, so each one receives your IP address and browser details and can tell that the request came from Read Master. We do not send them your name, email address or account identifier. Neither is a contracted processor.

Aside from Anthropic and the translation and speech providers described above, we do not currently use other external AI providers. If we add a new AI processor, we will update this policy and, where required, notify you in advance.

Model training. Based on our current understanding of Anthropic's API terms, content submitted via the API is not used to train Anthropic's models by default. However, this is subject to Anthropic's policies and our contractual arrangement, and we cannot make an absolute guarantee on their behalf. If you have specific concerns about AI training, please contact us at [email protected] (opens your email app).

How long Anthropic keeps your content. Anthropic keeps a copy of each request we send and each answer it returns for up to 30 days, then deletes it. If Anthropic's safety systems flag a request, Anthropic may keep that request and its answer for up to 2 years. We do not have a zero-retention arrangement with Anthropic.

Model training. Based on our current understanding of DeepL's API (Pro) terms, text submitted via the API is not used to train DeepL's models and is deleted after the translation is returned. This is subject to DeepL's policies; if you have concerns, contact [email protected] (opens your email app).

Model training. Based on our current understanding of Google Cloud's terms, text sent to Google Cloud Translation and Google Cloud Text-to-Speech is not used to train Google's models. This is subject to Google's policies; if you have concerns, contact [email protected] (opens your email app).

We retain different categories of data for different periods:

• Uploaded book originals (PDF, EPUB, DOCX, etc.). Stored in Cloudflare R2 and retained while your account is active. When you remove a book from your library we delete the file, its processed text and everything generated from it shortly after 30 days, or at once if you choose to erase it immediately, unless another reader also holds the same book. A job retries every four hours and alerts us to any file left behind.
• Normalised book content (BookContent). The processed, indexed text extracted from your upload. Retained with the book; removed when the book is deleted or your account is deleted.
• URL-imported content. The retrieved body of URL-imported articles is subject to a cold-storage purge after approximately 90 days of inactivity, consistent with our content-freshness policy. Metadata and your annotations are retained while the library entry exists.
• AI-generated artifacts (guides). Retained while your account is active. Deleted when you delete the relevant book, or when you delete your account.
• "Explain this" conversations. When you ask the AI to explain a passage, the passage you selected and the AI's reply are saved so you can reopen the conversation. Each conversation is deleted 90 days after its last message, and sooner if you delete the book or your account. They are included in your data export.
• Account and reading data. Retained while your account is active. When you delete your account it is closed at once and can be restored for 30 days. After that we delete your library, notes, highlights, flashcards, assessments, the books only you held, and the translations and image descriptions we cached for you.
• Simplified (re-leveled) text. When you ask for an easier or harder version of a passage or chapter, we save the result for your account so it does not have to be generated again. It is deleted 30 days after you last used it.
• Material shared between readers (public-domain books only). For a book that is in the public domain in the United States, the simplified text, picture descriptions and read-aloud audio we generate are stored once and shown to every reader of that book. This material carries no account identifier, and it is not removed when you delete the book or your account. We never share material generated from any other book.
• Backup snapshots. Our database provider keeps a rolling recovery history, so a deleted record can still be restored for up to 7 days. After that it cannot be recovered. Before risky maintenance we sometimes take a separate one-off copy, which we delete once the maintenance is confirmed. Backup access is restricted and audited.
• Copyright holds. If your account is named in a copyright takedown notice or a counter-notice, we keep the closed account and its data for up to 3 years after we record the most recent notice, instead of deleting it after 30 days. We do this so the record is available if there is a legal dispute. The stored copy of a book that is itself named in a takedown notice is kept with the record of that notice and is not deleted on this schedule.
• Analytics events. Deleting your account also deletes your PostHog profile and the analytics events recorded against it.

What remains after deletion. A few records are kept on purpose:

• Backup snapshots, for up to 7 days, as described above.
• Billing, copyright-notice and security audit records we are required to keep, with your name, email address and IP address removed.
• An account under a copyright hold, and its data, for up to 3 years, as described above. The stored copy of a book named in a takedown notice stays with the record of that notice.
• A book that another reader also holds, and material we generated for a public-domain work, which is shared between readers and does not identify you.
• AI answer-quality samples: no account or book identifier, deleted after 30 days.
• Flashcards, assessment results and read-aloud audio clips made from a removed book stay in your account until you delete them or the account. Unused clips go after 180 days.
• Translations of passages you looked up are cached for you alone, for up to 30 days. They are not tied to a book, so removing a book does not remove them; they expire on their own or go when the account is deleted.

You can request export or deletion of your data at any time from Settings → Privacy, or by emailing [email protected] (opens your email app).

We share the minimum necessary data with the following vetted subprocessors to operate the service:

• Anthropic — AI text generation. Receives passage and chapter text when you use AI features, the pictures in books you import, and the weekly quality sample described above. Processes data under Anthropic's API terms.
• Clerk — Authentication and identity management. Receives your email address and display name.
• Stripe — Payment processing. Receives billing and subscription data when you subscribe or manage a plan. We never see your full card number.
• SendGrid — Transactional and lifecycle email. Receives your email address and name for delivery of account and billing communications.
• Cloudflare R2 — File storage. Stores your uploaded book originals and processed audio files (Pro TTS feature) using server-side encryption.
• Cloudflare Browser Rendering — Page rendering fallback for URL imports. When a URL you import can't be read directly, we send that URL to Cloudflare to render the page and return its content; Cloudflare does not receive your account credentials or payment information.
• Neon — Managed Postgres database. Stores all structured account, library, reading, and AI artifact data. Data is encrypted at rest by Neon.
• Upstash — Redis cache and rate-limiting queue. Stores rate-limiting counters and short-lived caches of material derived from your books: translations of passages you look up, AI descriptions and explanations of images, re-leveled text of public-domain books, and vocabulary lists. These caches expire within 90 days. A cached result is shared between accounts only when the book is in the public domain; otherwise it is kept for your account alone.
• Railway — Application hosting and deployment infrastructure.
• PostHog — Product analytics. Receives the usage events described above, recorded against your account identifier, only when you have given Analytics consent. Separately, our server checks with PostHog which features are switched on. Without Analytics consent that check carries no identifier for you or your account; with consent it may use your internal account identifier, and stops using it within about a minute of you withdrawing consent. No usage event is recorded for that check.
• Sentry — Error monitoring and performance tracing. Receives anonymized crash reports and stack traces; personally identifiable content is scrubbed before transmission.
• Trigger.dev — Background jobs. Long-running jobs (e.g. book import, AI generation, audio downloads) run on Trigger.dev's infrastructure. The job inputs we send it carry identifiers and settings (book IDs, user IDs), not book text. While a job runs there, it reads your book's text to do its work.
• BetterStack — Log management and observability. Receives server log events (including request, user, and trace identifiers) for debugging and reliability monitoring; secrets are redacted before transmission.
• DeepL — Machine translation. When you use the reader's translation lookup, the specific word or passage you select is sent to DeepL to return a translation. DeepL does not receive your account credentials or payment information.
• Google Cloud — Machine translation and speech. Google Cloud Translation receives the word or passage you select when you translate into a language DeepL does not cover. Google Cloud Text-to-Speech receives book text, one sentence at a time, when you use a premium voice. Google does not receive your account credentials or payment information.
• Cloudflare Turnstile — Bot check on the newsletter and waitlist forms. Your browser loads the check from Cloudflare as soon as a page showing one of those forms opens, so Cloudflare receives your IP address and browser details then, before you submit anything. When you submit the form, we send the check's one-time token and your IP address to Cloudflare to confirm it.

Each subprocessor is bound by contractual data-protection obligations and processes data only as directed by us for the purpose listed above. If we add a new subprocessor that materially affects your data, we will update this list and, where required by applicable law, notify you.

Read more in our Cookie Policy. You can change your cookie preferences at any time from the cookie banner or via the footer link.

Under the GDPR (EU/UK) and CCPA (California), and as a matter of our general policy for all users, you have the right to:

• Access. Request a copy of the personal data we hold about you.
• Portability. Export your reading data, annotations, and AI artifacts in a structured, machine-readable format from Settings → Privacy.
• Correction. Ask us to correct inaccurate personal data.
• Deletion. Delete your account and associated data from Settings → Privacy, or by contacting us. See Data retention above for applicable timelines.
• Restriction and objection. Object to or request restriction of certain processing activities where permitted by applicable law.
• Withdraw consent. Where processing is based on consent (e.g. analytics), withdraw it at any time without affecting the lawfulness of prior processing.

We act on verifiable requests within 30 days (or as required by applicable law). Submit requests from Settings → Privacy or by emailing [email protected] (opens your email app).

Our infrastructure operates primarily in the United States and European Union. When your data is transferred across jurisdictions, we rely on appropriate safeguards — such as Standard Contractual Clauses approved by the European Commission — to maintain GDPR-equivalent protection. Specific transfer mechanisms for each subprocessor are available on request.

Read Master is not directed at children under 13 years old (16 in the European Union). We do not knowingly collect personal data from children below these ages. If you believe a child has created an account, please contact us at [email protected] (opens your email app) and we will promptly delete the account.

We may update this Privacy Policy from time to time. Material changes will be announced via email or an in-app banner at least 30 days before they take effect. The date at the top of this page reflects the date of the most recent revision. Continued use of Read Master after a change takes effect constitutes acceptance of the updated policy.

Privacy questions and data-subject requests go to [email protected] (opens your email app). We read and respond to every email.

For DMCA notices, see our DMCA Policy.

For postal correspondence and formal legal notices:
2108 N St Ste N, Sacramento, CA 95816, USA