Draft for counsel review · Last updated September 2026 · Placeholders are highlighted
This policy explains what [Entity name] ("Novelop," "we") collects when you use the Novelop apps and website (the "Service"), why, who we share it with, and the choices you have. The short version: we collect what we need to run a reading service and pay authors, we never see your card or bank details, we don't sell your data and we don't run advertising.
1. What we collect
Things you give us
Account. Your email address; if you sign in with Apple, the name and email (or Apple's private relay address) Apple shares with us. There are no passwords.
Profile. Display name, bio and avatar if you add them. For authors these appear on your public author page.
Date of birth, only if you choose to turn on mature (18+) content. We use it to confirm you are 18 or older and keep it with your profile.
Books you publish and everything you tell us about them (title, blurb, genres, cover, the AI label and the models used, price).
Ratings, reviews and reports you submit, and messages you send to support.
Things that come from using the Service
Reading activity. Which books you sample, unlock, buy, download or archive; your position in each book (and in its audiobook, if you listen); whether you finished it. This is how the Service works (your library syncs across devices) and how authors are paid.
Purchases. What you bought and when, the amount, and identifiers from Apple or Stripe (transaction ids, a Stripe customer id). We never receive or store your card number, bank account or billing address for purchases — Apple and Stripe hold those.
Author payouts. If you set up payouts, Stripe collects your identity, tax form and bank details directly. We store only your Stripe account id, whether payouts are enabled, and the payout amounts and dates.
Device and log data. IP address, browser or device type, operating system, app version, crash reports and the pages or screens you use, with timestamps. Our hosting providers keep standard server logs.
Local storage. The apps keep your reading preferences (theme, text size), your sign-in session, and downloaded books and audiobooks on your device so they work offline. The website uses no advertising or tracking cookies.
We do not collect precise location, contacts, photos (other than a cover or avatar you upload), health data or biometric data.
2. How we use it
To provide the Service: sign you in, keep your library and reading position in sync, apply the sample and unlock rules, and show mature content only to adults who opted in.
To pay authors: count unlocks and sales per book and compute royalties.
To review content: moderators read submitted manuscripts, and we run an automated screen for prohibited content and duplicates before a person decides. Nothing is published without human review.
To communicate: receipts (from Apple or Stripe), sign-in links, and notices about your account, your books or your payouts. We do not send marketing email unless you opt in, and you can unsubscribe from anything that isn't essential.
To keep the Service safe: detect fraud, abuse, scraping and rule-breaking; enforce our Terms and Content Policy.
To improve the Service: aggregate, de-identified statistics about how books and features are used.
To comply with law and respond to lawful requests.
Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you (most of the above), our legitimate interests in running, securing and improving the Service, your consent where we ask for it (marketing, the 18+ setting), and legal obligation.
We do not use your books, reviews or reading data to train machine-learning models, and we do not allow our providers to.
3. Who we share it with
We share personal information only as described here, and only what each party needs:
Service providers under contract: Supabase (database, authentication and file storage, hosted in [AWS us-east-1]), Netlify (website hosting), Stripe (web payments and author payouts), Apple (in-app purchases and Sign in with Apple), Resend (transactional email), and Anthropic (whose Claude API screens submitted manuscripts for prohibited content; Anthropic does not use API inputs to train its models).
Other users. Your display name appears with your reviews; authors' display names, bios and books are public. Reading activity and email are never shown to other users, including authors.
Moderators and staff who need it to review content, handle reports and support requests, and run payouts.
Legal. When required by law, subpoena or court order, to protect the rights and safety of users or the public, or to enforce our Terms.
Business transfers. If we are acquired or merge, your information may transfer to the successor under this policy; we will notify you.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
4. How long we keep it
Account and library data: for as long as you have an account. Reading position: until you remove the book or delete your account. Purchase, payout and royalty records: 7 years after the transaction, as tax and accounting law requires, in a form that no longer identifies you where possible. Moderation records and reports: 2 years, to enforce repeat-violation rules. Server logs: 90 days. When you delete your account we delete your profile, library, progress, ratings, shelves and unpublished books immediately; published books are unpublished and their text deleted after a 30-day grace period during which readers who bought them keep access as the Terms promise, unless you tell us to delete them right away.
5. Security
Data is encrypted in transit (TLS) and at rest by our providers. Database access is governed by row-level security so that each user's data is only readable by them and by staff with a need. Payments are handled by Stripe (PCI DSS Level 1) and Apple; we never handle card data, which keeps us in the lowest PCI scope. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and any regulator as the law requires.
6. Your rights and choices
Access and portability. Account › Your data › Download gives you a JSON file of your profile, library, ratings, shelves, books and payouts at any time.
Correction. Edit your profile in Account; email us for anything else.
Deletion. Account › Delete my account, or email us. See Section 4 for what happens next.
Mature content. Turn it on or off in Account; we keep your date of birth only while it is on.
Email. Unsubscribe links in any non-essential email; essential notices (receipts, security, moderation decisions) continue while you have an account.
Offline data. Remove downloaded books from Account or the book page; uninstalling the app removes everything stored on the device.
Texas, California and other U.S. state residents
Under the Texas Data Privacy and Security Act, the California Consumer Privacy Act and similar laws you may have the right to know what personal data we process, to access, correct and delete it, to obtain a portable copy, and to opt out of the sale of personal data, targeted advertising and certain profiling. We do not sell personal data, do not engage in targeted advertising and do not profile you in a way that produces legal or similarly significant effects, so there is nothing to opt out of; the other rights are available through the controls above or by emailing privacy@example.com. We will verify your identity by sending a link to your account email. You may authorize an agent to act for you. If we deny a request you may appeal by replying to our decision; we will respond within 45 days. We will not discriminate against you for exercising these rights.
European Economic Area, United Kingdom and Switzerland
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where processing is based on consent. Personal data is processed in the United States; we rely on standard contractual clauses with our providers, and on the EU-US Data Privacy Framework where a provider is certified. You may lodge a complaint with your local supervisory authority. Our representative in the EU/UK, if we appoint one, will be named here: [Representative or "not applicable"].
7. Children
The Service is not directed to children under 13 and we do not knowingly collect personal information from them; if we learn we have, we delete it. Content marked 18+ is hidden unless an adult opts in with a date of birth. If you believe a child has an account, email privacy@example.com.
8. Cookies, analytics and "Do Not Track"
The website uses only strictly necessary storage: your session, your preferences, and a temporary name-preview setting. We do not use advertising cookies, pixels or third-party analytics that track you across sites. Stripe sets cookies on its checkout pages for fraud prevention under its own policy. Because we do not track you across sites, we do not respond differently to "Do Not Track" or Global Privacy Control signals — there is nothing to turn off — but we honor them as opt-outs where the law treats them that way.
9. Changes
We will post any changes here and update the date at the top. For material changes we will also notify you in the app or by email before they take effect.