Cookie Policy

Cookies are small text files a website stores in your browser. We also use closely related technologies — your browser's local storage and session storage — to remember your choices. This policy covers all three and refers to them together as “cookies” unless a distinction matters.

We use them sparingly: to keep you signed in, to remember your language and theme, and — only with your consent — to understand how the product is used and to remember a referral link you arrived from.

When you first visit, our cookie banner asks for your choices. We use a default-deny model: until you choose, only strictly necessary cookies are set. Analytics and marketing stay off until you turn them on.

• Necessary. Required for sign-in, session, language, theme, and to record your cookie choices. These cannot be turned off — the app can't run without them.
• Analytics. Product analytics and error monitoring so we can fix what's broken and ship what helps. Off by default; strictly opt-in.
• Marketing. Remembers a referral link you arrived from so we can credit the person who invited you. Off by default; strictly opt-in.

These are always active because the service depends on them:

• __session, __client_uat, __clerk_db_jwt (and suffixed variants) — set by our authentication provider, Clerk, to keep you securely signed in.
• readmaster-locale — your interface language, so the right language renders on the server before the page loads (kept for 1 year).
• readmaster-theme — your selected theme (kept for 1 year).
• cookie_consent — your cookie choices, so we can honour them on every request and know not to ask again (kept for 1 year).
• rm-ff — which features are switched on for you, so the page renders correctly the first time it loads. It holds only on-or-off switches, no identifier, and is kept for 1 year.

These are only set after you grant Analytics consent:

• PostHog (ph_*) — privacy-conscious product analytics. Before you opt in, PostHog stores nothing on your device and records no usage; it only checks which features are switched on, using a random identifier that is discarded when you leave the page. If you withdraw consent it stops capturing immediately and removes what it stored, except a marker that remembers your choice.
• Session recording — PostHog may also record how the page responds as you use it, to help us fix confusing screens. All text and everything you type is masked, and request contents are dropped, so a recording shows layout, not your words.
• Sentry — error monitoring to diagnose crashes. In your browser it starts only after you opt in.

Withdrawing Analytics consent stops new analytics events and recording in your browser right away, and stops the events our servers send within about a minute.

• waitlist_ref — if you arrive via a referral link (a ?ref= address), this remembers the code for up to 30 days so the right person gets credit when you sign up.

This cookie is only written after you grant Marketing consent. Without consent we still let a referral link prefill the form for that visit, but nothing is stored, and we clear the cookie if you later withdraw consent.

Some preferences live in your browser's local or session storage rather than in cookies. They stay on your device and are not sent to our servers automatically:

• Local storage — readmaster-language, readmaster-theme, readmaster-theme-mode, and cookieConsent mirror your language, theme, and consent choices for fast loading. Other keys remember tips you have dismissed (rm_app_layer_hint_dismissed:v1, rm_layer_hint_dismissed:v1) and, if you accepted Analytics, when we last showed you a survey (rm_survey_*).
• Offline storage — when you are signed in, the app keeps a copy of your library, notes and up to 300 recently read chapters in storage inside your browser (rm-rq-…, one per account, with rm-offline-identity), so you can keep reading without a connection. The copy is ignored once it is more than 24 hours old and erased when you sign out. Our offline helper also keeps copies of pages you visit (rm-pages) so they open offline.
• Session storage — short-lived interface state, such as dismissed in-app notices and a safeguard that prevents sign-in redirect loops. This is cleared when you close the tab.

Our payment provider, Stripe, may set fraud-prevention cookies on its checkout page. These are necessary to process a payment securely and are only set when you begin a checkout.

You can change your choices at any time from the Cookie settings link in the footer — or, when signed in, from the Privacy section of your account settings — or through your browser's settings. See our Privacy Policy for how we handle the data these cookies relate to.

Questions about cookies go to [email protected] (opens your email app).