Privacy Policy

Read Master is operated by Read Master LLC (2108 N St Ste N, Sacramento, CA 95816, USA) and is offered only in the United States. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our reader, AI reading tools, and related services. By using Read Master you accept the practices described here.

We collect the following categories of data:

• Account data. Email address, display name, and locale captured through Clerk when you sign up or sign in.
• Reading data. Books you upload or import, reading positions, highlights, annotations, and progress. Stored privately to your account and never shared with other users.
• AI interaction data. The text passages you select or have us analyze, the prompts we construct and send to Anthropic, and the AI-generated material we save for your reuse (guides, assessments, flashcards, simplified text and Explain conversations).
• Usage and analytics data. Product usage events sent to PostHog, our analytics provider, only after you grant Analytics consent in the cookie banner. These events are recorded against your account; they are not anonymous. They include, for example, that you opened a book, that you read in a book on a given day and how far through it you were, that you created an annotation (its type, such as highlight, note or bookmark, and its colour), that you used a lookup (which kind, how long it took and whether the answer came from our cache), and that an AI explanation was produced (its size in tokens and how long it took). These reading events refer to a book by an internal identifier, not its title, and never contain a word you looked up, a passage, or the text of a note or highlight.
• How you found us. When you create an account we record the referral code and campaign tags in the link you arrived by, the website that sent you (its name only, not the full address), and the first page you saw here. We hold these in this browser tab until you sign up, never in a cookie. We also keep your answer to the one-time question “How did you hear about Read Master?”, or that you chose not to say.
• Payment data. Billing information processed entirely by Stripe. We never see or store your full card number.
• Error and diagnostic data. Crash reports and performance traces via Sentry, used only to improve service stability. A report can carry your account identifier (from your browser, only if you accepted analytics); web addresses and sign-in tokens are removed before it is sent.
• Your country, for one feature. Before we adapt a whole chapter or book, we read which country your connection comes from, as reported by our network provider Cloudflare, because that feature is offered in the United States only. We use it for that check alone and do not store it.
• Copyright notices. When someone sends us a takedown notice or a counter-notice, we store its full text, the sender's name and contact details, the work it names, our decision, and the book and account it concerns.

We use the data above strictly to operate Read Master:

• Render books and persist your reading progress and annotations across devices.
• Generate pre-reading guides, assessments, flashcards, explanations, simplified text and picture descriptions via Anthropic Claude.
• Process subscription payments via Stripe.
• Send transactional and lifecycle emails (account confirmations, billing notices, feature announcements) via SendGrid — only when you have not unsubscribed.
• Monitor service health and diagnose errors via Sentry and our infrastructure providers.
• Improve the product using analytics about how it is used — only when you have given consent.

We do not sell your personal data, use it for advertising, or share it with third parties for their own marketing purposes.

Books, documents, and other content you upload or import are private to your account. Read Master personnel do not read your uploaded content in the ordinary course of business. Authorized personnel may access your content only in the following limited circumstances:

• Customer support. When you contact us with a specific support request and the resolution requires inspecting your content.
• Security and abuse prevention. To investigate suspected security incidents, unauthorized access, or violations of our Terms of Service that we have reasonable cause to believe involve your account.
• Legal compliance. When we receive a valid legal order, subpoena, or court order requiring disclosure, or when disclosure is necessary to protect the rights, property, or safety of Read Master, our users, or the public.
• Service operation and quality. To diagnose technical failures directly affecting your account (for example, a failed import or corrupted file) when no anonymized diagnostic path is available.

Any personnel access is logged and subject to confidentiality obligations. We do not permit access beyond these purposes.

Read Master routes certain content to third-party AI providers to generate the features you request. We send the minimum amount of content necessary for each feature:

• Anthropic (Claude). Some features use Anthropic's AI: pre-reading guides, assessments, flashcards, simplified text, AI word lookups, and "Explain this" answers about a passage or a picture. When you use one, we send the relevant passage, chapter text or picture to Anthropic's API, along with contextual metadata about the request. Anthropic processes this content to generate the response we return to you. Prompts to Anthropic are wrapped as untrusted user content. We do not pass your account credentials or payment information. Three more things reach Anthropic without a separate request from you. First, before each AI request, we send the same content to Anthropic's token-counting service. It measures the length so the request fits the model's limit, and returns only a number. Second, after you import a book with AI features turned on, we send its pictures and their captions to Anthropic as one batch. This gets picture descriptions ready for screen readers. Third, once a week we send a small sample of recent AI output back to Anthropic to be scored for quality. The sample holds pre-reading guides with the book's title and author, and simplified chapters of public-domain books together with the original chapter. We never sample a chapter of a book that is not in the public domain.
• DeepL (translation). When you use the reader's word/passage translation lookup, we send the text you selected — plus a short snippet of the surrounding sentence or paragraph, used only as disambiguation context to improve accuracy — to DeepL's API to return a translation. We send only this reading content; never your account credentials or payment information.
• Google Cloud Translation. DeepL does not cover every language. When you ask for a translation into a language it lacks (for example Hebrew, Hindi, Vietnamese or Thai), we send the text you selected to Google Cloud Translation instead. We send only that text and the language you chose, with no surrounding passage; never your account credentials or payment information.
• Google Cloud Text-to-Speech (premium voices). When you listen with a premium voice or download a book's audio, we send the book's text to Google Cloud Text-to-Speech one sentence at a time, along with the language, voice, speed and pitch you chose. Google returns the audio, and we keep it until it has gone 180 days without being played, so the same sentence is not normally sent again; once that stored audio is deleted, playing the sentence sends it again. We do not send your name, email address, account identifier or payment information.

Read aloud with your browser's voices. The free read-aloud feature uses the voices built into your browser or device, not a Read Master server. We choose a voice that runs on your device whenever one exists for the book's language. If your browser has only online voices for that language, the browser itself sends each sentence to its maker (for example Google or Microsoft) to be spoken, under that company's terms.

Dictionary, thesaurus and encyclopedia lookups. When you look up a word in the reader, our server sends that word to the Free Dictionary API (definitions) and to Datamuse (synonyms and antonyms). When you look up a name or term, our server sends it to Wikipedia. These are public reference services, not contracted processors. Our server sends them only the word or term; never your name, email address or account identifier, and that request does not carry your IP address. One exception: when a Wikipedia entry has a picture, your browser loads that picture directly from Wikimedia, which then receives your IP address and browser details.

Pictures your browser loads from other sites. Cover photos on our blog come from Unsplash, and cover thumbnails in the Project Gutenberg catalogue search come from Project Gutenberg. Your browser loads these pictures directly from those sites, so each one receives your IP address and browser details and can tell that the request came from Read Master. We do not send them your name, email address or account identifier. Neither is a contracted processor.

Aside from Anthropic and the translation and speech providers described above, we do not currently use other external AI providers. If we add a new AI processor, we will update this policy and, where required, notify you in advance.

Model training. Based on our current understanding of Anthropic's API terms, content submitted via the API is not used to train Anthropic's models by default. However, this is subject to Anthropic's policies and our contractual arrangement, and we cannot make an absolute guarantee on their behalf. If you have specific concerns about AI training, please contact us at [email protected] (opens your email app).

How long Anthropic keeps your content. Anthropic keeps a copy of each request we send and each answer it returns for up to 30 days, then deletes it. If Anthropic's safety systems flag a request, Anthropic may keep that request and its answer for up to 2 years. We do not have a zero-retention arrangement with Anthropic.

Model training. Based on our current understanding of DeepL's API (Pro) terms, text submitted via the API is not used to train DeepL's models and is deleted after the translation is returned. This is subject to DeepL's policies; if you have concerns, contact [email protected] (opens your email app).

Model training. Based on our current understanding of Google Cloud's terms, text sent to Google Cloud Translation and Google Cloud Text-to-Speech is not used to train Google's models. This is subject to Google's policies; if you have concerns, contact [email protected] (opens your email app).

We retain different categories of data for different periods:

• Uploaded book originals (PDF, EPUB, DOCX, etc.). Stored in Cloudflare R2 and retained while your account is active. When you remove a book from your library we delete the file, its processed text and the guides, simplified text and Explain conversations made from it shortly after 30 days, or at once if you choose to erase it immediately, unless another reader also holds the same book. Flashcards, assessment results and read-aloud clips stay, as described under “What remains after deletion” below. A job retries every four hours and alerts us to any file left behind.
• Normalised book content (BookContent). The processed, indexed text extracted from your upload. Retained with the book; removed when the book is deleted or your account is deleted.
• Text imported from a web page. We keep the text of an article imported from a web page for 30 days from when we fetched it. On day 30 a nightly job deletes it. The same job deletes every word-for-word copy of it that we can match: the passages saved with your highlights, the passages you asked Explain about, the quotes in pre-reading guides, and the read-aloud audio made from it. (Other read-aloud clips are covered below.) A link that downloads a PDF file is kept like an uploaded file, not on this schedule. The book stays in your library with its title, cover, notes, highlight positions and reading progress. Re-import fetches the article again and starts a new 30 days. Guides, assessments and flashcards stay, and a flashcard may quote a line you chose. Read-aloud clips we cannot match to the deleted text are deleted after 180 days unused. An article named in a takedown notice is kept with the record of that notice.
• Pre-reading guides. A nightly job deletes each guide about 30 days after it is made (or regenerated). It is deleted sooner when you delete the book or your account.
• "Explain this" conversations. When you ask the AI to explain a passage, the passage you selected and the AI's reply are saved so you can reopen the conversation. Each conversation is deleted 90 days after its last message, and sooner if you delete the book or your account. They are included in your data export.
• Account and reading data. Retained while your account is active. When you delete your account it is closed at once and can be restored for 30 days. After that we delete your library, notes, highlights, flashcards, assessments, the books only you held, and the translations and image descriptions we cached for you.
• Simplified (re-leveled) text. When you ask for an easier or harder version of a passage or chapter, we save the result for your account so it does not have to be generated again. It is deleted 30 days after you last used it.
• Material shared between readers (public-domain books only). For a book that is in the public domain in the United States, the simplified text, picture descriptions and read-aloud audio we generate are stored once and shown to every reader of that book. This material carries no account identifier, and it is not removed when you delete the book or your account. We never share material generated from any other book.
• Backup snapshots. Our database provider keeps a rolling recovery history, so a deleted record can still be restored for up to 7 days. After that it cannot be recovered. Before risky maintenance we sometimes take a separate one-off copy, which we delete once the maintenance is confirmed. Backup access is restricted and audited.
• Copyright holds. If your account is named in a copyright takedown notice or a counter-notice, we keep the closed account and all its data, including the files you uploaded and the records our service providers hold for us, for up to 3 years after we record the most recent notice or counter-notice, instead of deleting it after 30 days. We do this so the record is available if there is a legal dispute. The stored copy of a book that is itself named in a takedown notice is kept with the record of that notice and is not deleted on this schedule.
• Analytics events. Deleting your account also deletes your PostHog profile and the analytics events recorded against it.
• How you found us. After 24 months we delete the referring website, the first page and your answer, and keep only the referral code and campaign tags. Deleting your account deletes all of it.

What remains after deletion. A few records are kept on purpose:

• Backup snapshots, for up to 7 days, as described above.
• Billing, copyright-notice and security audit records that the law, or our duty to show we followed it, requires us to keep, with your name, email address and IP address removed.
• An account under a copyright hold, and its data, for up to 3 years, as described above. The stored copy of a book named in a takedown notice stays with the record of that notice.
• If we close an account for repeated copyright infringement, we keep some of its records for 3 years from the closure, then delete them, except the stored copy of a book named in a notice, which stays with the record of that notice. We keep its account details, the notices and strikes against it and any counter-notices, its activity log with IP addresses removed, the emails we sent about them, and the stored copy of each struck book, as for any book named in a takedown notice: its title, authors, the web address it was imported from, its file fingerprint where it has one (a short code that identifies the file without containing its text), and its text. The files you uploaded are deleted. Deleting the account removes everything else. We keep these records because we may need them in a legal claim, and we log that we kept them (GDPR Article 17(3)(e)).
• A book that another reader also holds, and material we generated for a public-domain work, which is shared between readers and does not identify you.
• AI answer-quality samples: no account or book identifier, deleted after 30 days.
• Flashcards, assessment results and read-aloud audio clips made from a removed book stay in your account until you delete them or the account. Unused clips go after 180 days.
• Translations of passages you looked up are cached for you alone, for up to 30 days. They are not tied to a book, so removing a book does not remove them; they expire on their own or go when the account is deleted.

You can request export or deletion of your data at any time from Settings → Privacy, or by emailing [email protected] (opens your email app).

We share the minimum necessary data with the following vetted subprocessors to operate the service:

• Anthropic — AI text generation. Receives passage and chapter text when you use AI features, the pictures in books you import, and the weekly quality sample described above. Processes data under Anthropic's API terms.
• Clerk — Authentication and identity management. Receives your email address and display name.
• Stripe — Payment processing. Receives billing and subscription data when you subscribe or manage a plan. We never see your full card number.
• SendGrid — Transactional and lifecycle email. Receives your email address and name for delivery of account and billing communications.
• Cloudflare R2 — File storage. Stores your uploaded book originals and processed audio files (Pro TTS feature) using server-side encryption.
• Cloudflare Browser Rendering — Page rendering fallback for URL imports. When a URL you import can't be read directly, we send that URL to Cloudflare to render the page and return its content; Cloudflare does not receive your account credentials or payment information.
• Neon — Managed Postgres database. Stores all structured account, library, reading, and AI artifact data. Data is encrypted at rest by Neon.
• Upstash — Redis cache and rate-limiting queue. Stores rate-limiting counters and short-lived caches of material derived from your books: translations of passages you look up, AI descriptions and explanations of images, re-leveled text of public-domain books, and vocabulary lists. These caches expire within 90 days. A cached result is shared between accounts only when the book is in the public domain; otherwise it is kept for your account alone. The demo story you can read without an account adds one to a daily count when you start it and when you finish it; the count holds no cookie, account or address, and it expires after 90 days.
• Railway — Application hosting and deployment infrastructure.
• PostHog — Product analytics. Receives the usage events described above, recorded against your account identifier, only when you have given Analytics consent. Separately, our server checks with PostHog which features are switched on. Without Analytics consent that check carries no identifier for you or your account; with consent it may use your internal account identifier, and stops using it within about a minute of you withdrawing consent. No usage event is recorded for that check. With Analytics consent we also add the date you created your account (the day, not the time) to your PostHog profile, so we can see whether readers come back in the weeks after signing up.
• Sentry — Error monitoring and performance tracing. Receives crash reports and stack traces, which can carry your account identifier as described above; web addresses and sign-in tokens are removed before transmission.
• Trigger.dev — Background jobs. Long-running jobs (e.g. book import, AI generation, audio downloads) run on Trigger.dev's infrastructure. The job inputs we send it carry identifiers and settings (book IDs, user IDs), not book text. While a job runs there, it reads your book's text to do its work.
• BetterStack — Log management and observability. Receives server log events (including request, user, and trace identifiers) for debugging and reliability monitoring; secrets are redacted before transmission.
• DeepL — Machine translation. When you use the reader's translation lookup, the specific word or passage you select is sent to DeepL to return a translation. DeepL does not receive your account credentials or payment information.
• Google Cloud — Machine translation and speech. Google Cloud Translation receives the word or passage you select when you translate into a language DeepL does not cover. Google Cloud Text-to-Speech receives book text, one sentence at a time, when you use a premium voice. Google does not receive your account credentials or payment information.
• Cloudflare Turnstile — Bot check on the newsletter and waitlist forms. Your browser loads the check from Cloudflare as soon as a page showing one of those forms opens, so Cloudflare receives your IP address and browser details then, before you submit anything. When you submit the form, we send the check's one-time token and your IP address to Cloudflare to confirm it.

Each subprocessor is bound by contractual data-protection obligations and processes data only as directed by us for the purpose listed above. If we add a new subprocessor that materially affects your data, we will update this list and, where required by applicable law, notify you.

Read more in our Cookie Policy. You can change your cookie preferences at any time from the cookie banner or via the footer link.

Under the CCPA (California) and other applicable U.S. state privacy laws, and as a matter of our general policy for all users, you have the right to:

• Access. Request a copy of the personal data we hold about you.
• Portability. Export your reading data, annotations, and AI artifacts in a structured, machine-readable format from Settings → Privacy.
• Correction. Ask us to correct inaccurate personal data.
• Deletion. Delete your account and associated data from Settings → Privacy, or by contacting us. See Data retention above for applicable timelines.
• Restriction and objection. Object to or request restriction of certain processing activities where permitted by applicable law.
• Withdraw consent. Where processing is based on consent (e.g. analytics), withdraw it at any time without affecting the lawfulness of prior processing.

We act on verifiable requests within 30 days (or as required by applicable law). Submit requests from Settings → Privacy or by emailing [email protected] (opens your email app).

Read Master is offered only in the United States, and we store and process your data primarily there. Some of our subprocessors may process data in other countries, including the European Union. The locations each subprocessor uses are available on request.

Read Master is not directed at children under 13 years old. We do not knowingly collect personal data from children below this age. If you believe a child has created an account, please contact us at [email protected] (opens your email app) and we will promptly delete the account.

We may update this Privacy Policy from time to time. Material changes will be announced via email or an in-app banner at least 30 days before they take effect. The date at the top of this page reflects the date of the most recent revision. Continued use of Read Master after a change takes effect constitutes acceptance of the updated policy.

Privacy questions and data-subject requests go to [email protected] (opens your email app). We read and respond to every email.

For DMCA notices, see our DMCA Policy.

For postal correspondence and formal legal notices:
2108 N St Ste N, Sacramento, CA 95816, USA