Privacy, data flow, and account controls.

1. Scope and operator

This policy describes the software's default v5 data flows, but the operator of this deployment is responsible for the service and its privacy practices. Ask the operator about any deployment-specific changes, including infrastructure regions, backups, log retention, and configured TTS providers.

2. Information processed

• Account and authentication data: name, email address, email-verification status, password verification data, linked sign-in provider details, sessions, IP address, user agent, and security or recovery tokens. OpenReader also records the time you accept this policy.
• Documents and derived content: uploaded EPUB, PDF, TXT, Markdown, and DOCX files; extracted text and layout data; previews; generated speech, timing/alignment data, playback caches, and account or audiobook exports.
• Reading and configuration data: document and folder metadata, recently opened state, reading position, document settings, voice and playback preferences, appearance preferences, and selected TTS provider/model settings.
• Security and operations data: request metadata, error and service logs, durable job and operation state, pseudonymous compute-limit counters, and an anonymous-device identifier when anonymous compute controls apply. IP and device values used for compute-limit buckets are stored as keyed hashes rather than raw values in those buckets; authentication sessions can retain IP address and user-agent data.
• Optional analytics: only after you opt in, Vercel Web Analytics receives page-view data such as the path, referrer, browser, device type, and approximate location. OpenReader does not send document contents, account names, or email addresses as analytics events.

3. How data is used

• Authenticate accounts, verify email addresses, recover passwords, and protect sessions.
• Store, display, organize, search, and export documents and reading state.
• Parse files, create previews, generate and align speech, stream audio, and assemble exports.
• Enforce operator-configured usage limits, prevent abuse, diagnose failures, and secure the service.
• Measure aggregate product usage and improve the service when optional analytics is accepted.

In v5, the authenticated web application controls accounts, authorization, and database records. A separate compute worker processes long-running document, preview, speech, alignment, cleanup, email, and export jobs. NATS JetStream carries durable job and operation state, while SQL and object storage hold the application records and files needed for those features.

4. Cookies, local storage, and similar technologies

• Authentication cookies: Better Auth uses an HTTP-only, SameSite=Lax session-token cookie (normally better-auth.session_token, with a secure-prefixed name on HTTPS) for up to seven days. A signed session cache and supporting authentication cookies may be used for up to five minutes during session checks or account linking, and an OAuth state cookie may be used for up to ten minutes during a social sign-in. These cookies are necessary to provide authenticated or optional anonymous sessions.
• Anonymous compute cookie: when anonymous sessions and the relevant compute controls apply, or_device_id stores a random HTTP-only, SameSite=Lax identifier for up to two years. It helps prevent clearing browser storage from immediately resetting anonymous usage limits. It is not sent to TTS providers or placed in compute jobs.
• Consent preference: your accepted or declined analytics choice is stored in your browser's local storage under cookie-consent. It is not itself a cookie. A Global Privacy Control signal always overrides a prior choice and keeps analytics disabled.
• Appearance preferences: theme and custom color choices are stored locally in your browser so the interface can render consistently. These values are not used for advertising.

5. Service providers and disclosures

OpenReader does not sell personal information or use document contents for advertising. Data is disclosed to service providers only as needed to run the deployment or complete a feature you request. An operator may also disclose information when required by law or necessary to protect users, the service, or others.

• Application, database, queue, compute, and storage hosts: services selected by this instance's operator, which may be self-hosted or third-party.
• TTS providers: the cloud or self-hosted provider selected by the operator receives the text segments and speech settings needed for user-requested generation.
• Resend: if the operator enables account email, the Resend API receives the recipient address, sender and reply-to details, message content, and time-limited verification or recovery link needed to deliver the message.
• Vercel: if the instance uses Vercel hosting or enables Vercel Web Analytics, Vercel processes the related hosting data and, only after consent, cookieless analytics events.
• GitHub: if GitHub sign-in is configured and you choose it, GitHub processes the OAuth request and shares the authorized account details needed to create or link the account.

6. Retention and security

Account records, reading state, source documents, and reusable derived artifacts are generally retained while the account or document remains active. Incomplete temporary uploads are eligible for cleanup after 24 hours. Durable compute operation state expires after 24 hours, and completed account-export and audiobook-export artifacts are cleaned up after seven days by the shipped scheduled task. An operator can change task scheduling and may retain infrastructure logs or backups on a different schedule.

OpenReader requests AES-256 server-side encryption for uploaded documents and generated object-storage artifacts. Saved TTS and Resend API keys are encrypted with AES-256-GCM. Passwords are stored as non-plaintext verification data. These safeguards do not provide end-to-end encryption: the instance operator and authorized infrastructure can access content when needed to operate the service, and requested text must be readable by the selected TTS provider.

Account deletion first removes per-user storage and then deletes account records and associated database rows. Shared content-addressed source objects and derived artifacts that no longer have an owner are reclaimed by the cleanup process. Residual copies may remain temporarily in provider backups or logs under the applicable provider's retention practices.

7. Your choices and privacy rights

Depending on your jurisdiction, you may have rights to know, access, correct, delete, or obtain a copy of personal information, and to appeal or opt out of certain processing. Exercising a privacy right does not reduce access except where the data is necessary to provide the requested service.

• Export: use Export My Data in Settings to create a downloadable archive of account metadata and uploaded files.
• Correction: update available profile, document, and preference fields in the application.
• Deletion: use Delete Account in Settings to permanently remove the account and begin associated storage cleanup.
• Analytics: decline non-essential processing in the consent notice, or send a Global Privacy Control signal.

8. Processing location

Processing and storage locations depend on the infrastructure, TTS providers, email configuration, and regions selected by this instance's operator. Contact the operator for deployment-specific residency and international-transfer information.

9. Contact, changes, and open source

For an account-specific privacy request, contact the operator of this instance. Do not include private account information, document contents, passwords, or recovery links in a public GitHub issue. The effective date above will change when this policy is materially revised.

OpenReader is open source. You can review the software or self-host it when you want control over the infrastructure and provider choices.