Privacy

1. Who we are

nobodyreads.me is operated by Entropy Fox, registered in Denmark (CVR no. 37390992), which is the data controller for the personal data described here. You can reach us about anything on this page at privacy@nobodyreads.me.

The short version: we collect what running the site requires and nothing else. There is no advertising, no tracking across other sites, and we do not sell or share personal data with anyone for their own purposes.

2. What we collect, and why

When you create an account — your email, the nickname you choose, and a hashed password. Optionally a display name, short bio, and an avatar. We need these to give you an account and a plot, and to contact you about it. Legal basis: performance of our contract with you.

What you publish — posts, pages, comments, uploaded images and other media. You decide what goes in; it is stored so we can serve it. Legal basis: performance of our contract with you.

When you follow or support a plot — a record that your account is a member of that plot, and, if you pay, what you are entitled to read and until when. Legal basis: performance of our contract.

When you pay — Stripe handles the card. We never see or store card numbers. We keep the amounts, currency, tax, fees and our commission for each transaction, plus Stripe's customer identifier, so we can pay creators correctly and meet our accounting and tax obligations. Legal basis: contract, and legal obligation for the records we must retain.

When you subscribe to a plot's email list — your email address, and whether you confirmed it. Legal basis: consent, which you can withdraw at any time using the unsubscribe link in any message.

Comments are checked automatically before publication against the site's content policy. Legal basis: our legitimate interest in keeping the site usable and lawful. See section 6.

Server logs — ordinary request logs, kept briefly for security and debugging. Legal basis: legitimate interest.

3. Cookies

We use cookies that are strictly necessary and nothing else: a signed session cookie that keeps you logged in, and equivalents used during sign-in. There are no analytics, advertising or cross-site tracking cookies, which is why you are not asked to consent to any.

Stripe sets its own cookies on its checkout and billing pages, which are governed by Stripe's privacy policy.

4. Who else processes your data

We use a small number of providers to run the service. They process data on our instructions only, under contract, and may not use it for their own purposes. Where a provider is outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

We will also disclose data where the law requires it, or to establish or defend legal claims.

5. What plot owners can see

A plot owner is a separate controller for the audience of their own plot. They can see who has joined, who comments and what those comments say, how many people support them, and the amounts each sale earned them. They do not see your card details, your address, or your email address unless you gave it to them by subscribing to their email list.

6. Automated comment checks

Comments are sent to an automated service before publication and may be held for the plot owner to review, or rejected, if they appear to breach the content policy. This is an automated step in a human process — the plot owner decides what happens to a held comment, and you can contact us to have any decision looked at by a person.

7. How long we keep things

• Account and published content — until you delete them, or you delete your account.
• Email subscriptions — until you unsubscribe.
• Comments — a deleted comment keeps its place in the thread but its text and author are removed from display.
• Payment and payout records — retained for as long as accounting and tax law requires, typically several years, even after an account is closed. This is a legal obligation we cannot waive on request.
• Server logs — a short rolling window.

8. Deleting your account

You can delete your account from your account settings. That removes your plot and everything in it — pages, posts, uploaded media, comments, memberships, email subscribers and entitlements. Payment records are retained as described above, reduced to what the law requires.

If you hold an active paid subscription to someone else's plot, cancel it first from your subscriptions settings so it does not renew.

9. Your rights

If you are in the EU, EEA or UK you have the right to access your data, correct it, delete it, restrict or object to how we use it, and receive a portable copy. Where we rely on consent you can withdraw it at any time, without affecting what came before.

Write to privacy@nobodyreads.me and we will respond within one month. If you are not satisfied, you can complain to Datatilsynet, the Danish Data Protection Agency or to the authority where you live.

10. Security

Passwords are stored hashed, never in plain text. Traffic is served over HTTPS. Secrets stored on your behalf are encrypted at rest. Access to production data is limited to those who need it to operate the service. No system is perfect, and we will tell you and the relevant authority if a breach affects you and the law requires it.

11. Children

The service is not for anyone under 16. We do not knowingly collect data from children; if you believe we have, write to us and we will delete it.

12. Changes

If we change this policy we will update the date at the top, and tell account holders by email where the change is significant.

13. Contact

privacy@nobodyreads.me — or see our terms of use.