Readhouse privacy policy

Effective date: 2026-10-25

Readhouse is a book and document reader for Android and the web, provided by NebuCoreTech and operated by Louis Wong. Contact us at support@readhouse.app for support, privacy questions or deletion requests. The web reader requires a free Readhouse account. Android can open local books without an account; explaining passages, reading aloud and adding free Bookshop books require sign-in. Signed-in accounts automatically synchronize their library across devices. Readhouse does not sell books, show advertisements, sell personal information or add an advertising analytics service.

Readhouse is intended for readers aged 13 and over. This policy describes the pre-release app and its website, including the free Bookshop and the reader controls below. The public launch is still being prepared. The separate volunteer testing study recruits adults; that study does not make the app adult-only. Earlier builds can behave differently, as described below.

Welcome reading preferences

Welcome gifts and their setup are optional; on Android you can choose Explore first and read local books without completing them. To complete the gift setup, you provide an age range, at least one preferred genre and your reading frequency. You can also tell us your reading goals and how you found Readhouse. We save accepted answers with your account to personalize book ordering and understand our readers, including planning how to introduce Readhouse to similar audiences. Our internal report counts the latest answers in aggregate; it does not send answers to an advertising service. Completing the survey does not subscribe you to marketing emails or gift reminders.

The updated 0.14.51 web reader rejects an Under 13 Welcome answer before saving language preferences, preparing translation or submitting the survey. The current Android internal build, 0.14.50/code167, has not received that client correction: it can apply language preferences and prepare translation before the server refuses the survey. The updated server rejects new Under 13 survey submissions. If an earlier build already saved an Under 13 answer, that answer restricts Welcome gift claims and Readhouse hosted Explain, Ask and narration, including replayed requests and cached results. Replacing the survey answer cannot remove this existing restriction. Other accepted answers can be revised in Reading preferences. We retain the latest saved answers while your account exists and include them in account export and deletion; encrypted recovery backups follow the retention policy below. Unfinished answers remain in this browser or app's local storage. This uses a chosen or already-saved answer, not verified age. Sign-in can occur before the gift survey, and the correction does not establish the age of every account holder.

Books and reading data on your device

Readhouse copies imported documents into its private app storage on Android or browser storage in the web reader. Local shelf records, reading positions, bookmarks, highlights, notes, unfinished comments and preferences are stored on that device. Reading and searching within an imported book, and using the bundled Android English dictionary, do not by themselves upload the book or your notes. After sign-in, book files and the reading records described below are automatically stored privately with your Readhouse account so another device can restore your library.

You choose files through Android's file picker. If you choose a cloud document provider, that provider handles its files under its own policy. Notes exported or shared using another app go to the destination you choose. Those separately exported copies are outside Readhouse account storage.

Your account and automatic sync

When you sign in, Readhouse processes your email address, name and available profile information, the sign-in provider's account identifier, session records and device registration information. Depending on the sign-in methods enabled for your release, you may use an email code, Google or Apple. Those providers and our email-delivery service process the information needed to complete sign-in under their own policies. Readhouse does not ask for your Google or Apple password. Email sign-in codes expire after five minutes and are stored as hashes. Browser sessions use necessary sign-in cookies; native session credentials are kept in the device's protected account storage. A session can last up to 30 days and can be renewed while used.

Sync starts automatically after sign-in and includes your books, book identifiers and metadata, reading positions, bookmarks, highlights, saved notes and reading preferences. Saved notes include their associated quotations. Existing local books are added to the account when you first sign in. We keep device identifiers, change history and conflicting versions so offline edits can be reconciled. Book transfers resume after interruptions and are checked for completeness. Unfinished note drafts and device-specific settings remain local. Reading progress estimates use recent page-turn timing on your device and exclude idle periods.

These account records are stored on Readhouse's server and restricted to the signed-in account. Switching accounts separates each account's reading records and pending changes. Signing out pauses that account's sync; it does not delete its server records or copies already stored on a device. Once a book removal reaches the server, its synced original file is removed and its storage allowance is released. Interrupted cleanup retries automatically. Prior reading-record versions may remain in sync history or conflict records until account deletion; encrypted backups have separate retention, described below. Account settings provide an export, session revocation and an account-deletion request. Export files expire after 24 hours on the server; downloaded copies remain wherever you save them.

Readhouse keeps active account, sync and account-linked usage records until you delete the account or ask us to remove them. When an account-deletion request is accepted, its sessions are revoked and a background job removes the account, synced records and book files, request receipts, personal usage records and private generated audio. Cleanup may take longer if the service is unavailable; contact support if deletion does not complete. Operational totals without account identifiers may remain. Encrypted backups have separate retention, described below.

Reader setup

On first use, Readhouse asks for the current reader's age range without preselecting an answer. You can choose not to say. The range is stored only in app preferences; we do not ask for a birth date or send this setting to our server.

In version 0.12.15 and later, the selected age range filters the Bookshop collection using editable reading-age labels. The local reader, dictionary and device speech tools are not disabled by this filter. Changing the age selection updates Bookshop and cancels a download if that title is outside the new filter. It does not remove existing local books, notes or progress. Dictionary entries are not censored by age. The local range is not age verification and does not override an external service's age requirements.

Account profiles can separately carry a server-side adult/child audience classification and age band. Hosted sync, Explain/Ask and Readhouse narration are unavailable to profiles classified as children while cloud consent support is not enabled. The updated server also applies the saved Under 13 Welcome restriction described above to gift claims and hosted reading assistance. These restrictions are separate from the local Bookshop filter. They do not verify every account holder's age or turn the local filter into account eligibility.

Prefer not to say shows the full collection while recording only that you declined to share your age. It does not record an adult age or require a parent. These reading-age labels are editorial guidance, not a certification or a guarantee about every passage. Historical books can include dated language and themes. Parents can choose suitable material, and external providers apply their own terms and age requirements.

Versions 0.12.2–0.12.13 restricted online features for children and readers who chose Prefer not to say. The unpublished 0.12.14 candidate removed restrictions for that privacy choice; 0.12.15 replaces feature restrictions with Bookshop content filtering. Versions 0.12.1 and earlier did not apply reader-age controls. Requests already sent to an external provider remain subject to that provider’s processing and retention; changing reader setup does not delete that information.

The free Bookshop in newer previews

Opening Bookshop automatically requests a catalog from NebuCoreTech's service. Displaying artwork may request a cover when it is not already cached, including covers on your saved shelf. Choosing Add to shelf requests the selected EPUB edition. The service uses our existing server and Cloudflare. They receive the IP address and connection information needed to serve requests, as well as the requested catalog, cover or book path. We use this information to deliver files, diagnose failures and protect the service.

The catalog, samples and viewed covers are cached on your device for offline browsing. Downloaded books remain in app storage for offline reading. Android can browse the Bookshop without an account. Adding a free book requires sign-in and includes it in your automatically synchronized library. The web reader requires sign-in for access. There is no payment processing or purchase history in this Bookshop. Historical books can include mature themes or dated language; parents should choose suitable books for children.

Optional Welcome 3 gifts and communications

Newer internal candidates include a Welcome 3 campaign, available to eligible accounts under existing age and cloud-account restrictions; reminder delivery requires separate opt-in. When enabled for your account, choosing to join stores your campaign timezone, setup progress and gift claims. Signing in alone does not claim a gift or agree to communications. A successful claim records the exact book edition and permanent account entitlement; removing a downloaded copy does not erase that entitlement.

Gift reminders are optional and separate from ongoing free-book offers and updates. Readhouse records your choice, the consent wording version and when it changed. You can choose an available push or email reminder channel, turn reminders off in settings, and independently decline or withdraw email offers. An email unsubscribe link opens a confirmation page; opening the link alone does not change your choice. Email sign-in codes are a separate account service.

When you intentionally enable phone reminders, Android schedules and displays them on that device. Welcome reminders do not use Firebase Cloud Messaging, upload a notification token, or send reminder content to a push provider. Readhouse stores the reminder choice on your account and keeps the pending reminder time and gift number on the device. Signing out, switching accounts, turning reminders off, completing the campaign, or later account-state synchronization cancels the pending local reminder. Android may delay an inexact reminder, and a reminder can be stale until a disconnected device next synchronizes; opening it always fetches current campaign state before a claim.

If you choose an available email channel, our configured outbound email provider receives your verified account email address and the message content. Delivery, bounce, complaint and unsubscribe records help prevent unwanted or repeated messages. Provider acceptance means a message was accepted for delivery; it does not prove that you saw a notification or opened an email.

Optional Welcome visit and sign-in observations are disabled in the updated 0.14.51 web reader. It does not create an observation visit identifier, upload optional observation events or link an observation visit to an account. It removes older optional observation queues before sending, while keeping the local state needed to finish or cancel sign-in and return to the chosen book. Explore first is a way to bypass gifts and setup, not a separate switch that turns other data collection off.

The current Android internal build, 0.14.50/code167, and other older clients can still send Welcome observations before Explore first when the campaign is enabled, and may retry queued observations later. This web/backend update does not release a corrected Android app. The updated server acknowledges those legacy optional batches without storing their observations or visit-to-account links. Receiving a batch still involves an off-device request; ordinary connection/security processing remains. Historical observations are not erased by this correction. Older records can contain a hashed random visit identifier, bounded setup actions and failure categories, and a verified sign-in can have linked a visit to the account. Linked historical records remain included in account export and deletion and follow the existing cleanup policy below. Current optional-observation reports are marked unavailable rather than treating the absence of new observations as zero activity.

The updated server still processes account-bound state needed for gift claims, qualifying reading activity and reminder eligibility, along with necessary account, security and abuse-prevention information. It does not keep new raw optional campaign observations for analytics. Historical detailed campaign events and outcomes retain their existing 90-day cleanup target; an unavailable worker can delay cleanup. Minimal consent, suppression and deduplication records remain while needed to honor your choices and prevent repeat reminders. Permanent gift entitlements remain while the account exists. Account export and deletion include account-linked campaign records; recovery backups and independent provider records follow the separate policies described below. Disabling these Welcome observations does not disable the separate sync, hosted-service usage accounting, optional reports or SDK diagnostic processing described in this policy.

Available channels and the actual campaign terms are shown before you opt in.

Dictionary and translation

The bundled English dictionary works locally. When online lookup is enabled and a word is missing locally, Readhouse sends that word over HTTPS to FreeDictionaryAPI.com. Its provider receives the word and connection information, including your IP address. This request does not include the whole book or your notes. Successful definitions are cached locally. Online lookup is off by default for new installations of version 0.11.32 and later; older versions used a different default, and saved preferences are preserved. You can turn it off in Dictionary settings.

Definition translation uses Google ML Kit. Translation text is processed on your device. Downloading a language model connects to Google. ML Kit also sends Google SDK usage and diagnostic information, including device/app information, installation identifiers, performance/error information and configured languages. Its supporting Firebase configuration services can process country, language, time zone and app/platform information. Versions 0.11.32 and later defer translation setup until a non-English language is prepared; a saved language choice can cause this on a later launch. Older builds can initialize the SDK at startup. Returning to English stops Readhouse translation requests but does not reverse information already sent or guarantee that all SDK background processing stops.

See ML Kit's terms and privacy information and Google's SDK data disclosures. Each external provider controls its own processing and retention.

Speech, search and assistant actions

Pronunciation and read-aloud pass text to your installed Android text-to-speech engine. An online voice may send that text to its provider. An available offline voice can process speech locally, although the engine may handle its own diagnostic information. Temporary speech audio is stored in the app cache and cleaned up by playback controls.

The web reader uses available browser/device speech services for its local speech option. The chosen voice provider may process text and diagnostics under its own policies. Selecting a Readhouse hosted voice uses the separate service described next. If a saved hosted voice is unavailable, playback pauses and asks you to choose an available voice; it does not silently switch to device speech.

Choosing Google search opens a search with the selected text. Choosing an assistant shares the selected passage and any included book context or comment with ChatGPT, Gemini or Claude. If direct sharing is unavailable, Readhouse may copy the prepared text to the clipboard and open the selected app or website. It does not automatically submit a chat message. Those services apply their own policies and age requirements. Avoid these actions when you do not want to share the selected material.

Explain, Ask Readhouse and hosted narration

When you request Explain or Ask Readhouse, the app sends your selected passage, question, limited relevant already-read text, book title/author/chapter information and current reading position to the Readhouse backend. The backend sends the needed context to OpenRouter and the configured model provider to produce the response. It does not automatically send an entire book, your private notes, your complete highlights collection or reading history. Text you deliberately type into a question is included. Ordinary reading and local word lookup do not trigger these requests.

Choosing a Readhouse narration voice sends each needed text segment through Readhouse to OpenRouter and the speech provider. This includes a small amount of look-ahead text prepared for continuous playback. Provider credentials remain on Readhouse's server. Providers receive the text necessary for generation; their independent processing and retention policies apply. We do not promise that a provider retains no data. Read OpenRouter's privacy policy and its provider data-practice information before sending sensitive material.

Readhouse stores usage metadata such as account identifier, feature, model, request status, latency, token/character counts, estimated cost and opaque book/segment references to operate the service, apply limits and diagnose failures. These operational events do not store the full passage, question, note or generated answer. An account-scoped memory cache can reuse completed answers for 15 minutes; stale entries are no longer reused but can remain in memory until replaced or the service restarts. Separate request receipts can retain the completed answer or audio reference for 24 hours so a repeated request does not generate or charge twice; expired receipts are removed by background cleanup.

Completed narration from imported/private text is cached on Readhouse's private server storage for reuse by the same account. Access requires authentication and account authorization. Private audio has a seven-day expiry and is removed by background cleanup; an expired cache entry is not available for playback through the service. Regenerating a segment creates a new cache lifetime. Account deletion also removes private cached audio. Verified public catalog narration may be cached for reuse across readers, with a one-year expiry; imported content is not made public because a client labels it public. Provider-held copies are not deleted by deleting the Readhouse cache.

Website and technical logs

The public information pages use no advertising cookies, analytics script or external fonts. The Readhouse web reader uses local browser storage for its shelf and account/sync data, necessary cookies when signed in, and a service worker to save shipped reader files for offline use. This reader-file cache excludes authentication/API responses, imported books and generated audio; books are kept in separate local storage. Our server receives connection information when serving pages and API requests. Website and Bookshop logs can include IP address, requested path/query, time, response status, referrer and user agent. Account/session records can include connection and device information used to secure sign-in. We use these records for service operation, troubleshooting and security, not advertising profiles.

Website/Bookshop access logs rotate daily when nonempty and retain up to 14 rotated files plus the current file. Because empty logs are skipped, this is not a promise to delete each request exactly 14 days later. New API, worker and database container logs rotate by size, with up to three 10 MB files per service. Hosting and delivery providers may process additional infrastructure/security records under their own policies. The Bookshop uses Cloudflare's delivery/security service; the Readhouse website uses Cloudflare for DNS and receives web requests directly at our existing server.

Encrypted Readhouse database, private-file and configuration backups are created for deployment and recovery and may also be created by an operator. An off-server encrypted copy may be kept. These backups can contain account records, synced book files and private generated audio that have since been deleted from the active service. A fixed automatic backup-retention period has not yet been configured, so active-service expiry or account deletion does not guarantee deletion from every backup on the same schedule. Backups are restricted to recovery use; contact support about removal requests involving retained backups. The independent retention policies of hosting, email, sign-in and model providers still apply.

Support and test participation

Mail to support@readhouse.app passes through Cloudflare Email Routing to our existing Gmail inbox. Replies normally come from our Gmail address. We receive the sender's address, message and any attachments they choose to include. Louis and authorized assistance tools, including AI-assisted tools, may help handle requests and prepare replies. Please send steps, app version and device details instead of private books, selected passages, personal notes, passwords or other sensitive material.

Settings also offers Report a Bug, including on Android while signed out. You choose the description, optional reproduction steps, expected behavior, contact email and screenshot to submit. Before sending, you can inspect and turn off the app/device diagnostics: app version/build, platform, OS, device model when available, theme and current app screen. The form does not automatically attach your account identity, books, reading history or logs. A selected screenshot can contain anything visible in that image; review it before sending. The app resizes and re-encodes the image without its original filename or metadata.

In-app reports and images are stored in Readhouse’s database and are available only to authorized administrators. We use a hashed connection address to limit abuse; ordinary server connection logs still apply. Reports are not automatically posted to GitHub or emailed. Administrators can resolve, reopen or delete a report. Contact support with the approximate submission time and description to help us locate a report for removal. Reports remain until an administrator deletes them; there is currently no automatic expiry. Deleted reports can remain in encrypted recovery backups under the separate backup policy above.

Support messages are used to respond and resolve issues. We keep ordinary support conversations for up to 90 days after the last support activity, then remove them from the active inbox unless a longer period is needed for an unresolved request, security incident or legal obligation. Email-provider trash and backup processing may retain a removed copy for a further period. We keep non-identifying bug summaries separately when useful for improving the app.

If you volunteer for the closed test, we privately request the Google-account email needed for Play enrollment, participation consent, device/Android version, country and test feedback. These records are used for enrollment and test follow-ups, not marketing. We remove contact records within 30 days after participation ends unless you agree to continue testing or an unresolved issue or legal obligation requires longer retention. Google separately processes Play enrollment and testing feedback under its policies. Do not post your account email or book files publicly.

Families

Readhouse is intended for ages 13 and over. Parents and guardians should help teens choose age-appropriate reading material. Imported books and dictionary entries can contain mature vocabulary or themes; local reading-age labels do not certify every passage. Earlier internal/preview versions do not necessarily apply the corrected Welcome eligibility checks. The controls described above do not establish verified age or authorize use of an external service below that service's own age limit.

Parents and guardians can contact support@readhouse.app about their child's information. We do not ask children to join the adult volunteer study or send private book content. If a child sends support information, we use the minimum needed to respond, ask for guardian involvement where appropriate and remove unnecessary information. If you believe a child has supplied information that should be removed, contact us.

Your choices and deletion

On Android you can read local books while signed out. Signing in turns on automatic sync. You can disable online dictionary lookup, use English definitions, select an available offline device voice and avoid Explain/Ask, hosted narration, external search or assistant sharing. You can remove books and edit/delete notes. Android's Clear storage or uninstall removes Readhouse's local library, preferences and caches; clearing the web reader's site data removes its browser-stored copies. These actions do not delete a Readhouse account or server-synced records. Original documents and any earlier exported backups remain wherever you saved them until you remove those copies.

Use Account & sync to request an account export, revoke other sessions or delete your account. Account deletion requires recent sign-in and explicit confirmation. To request removal of account, support or tester records by email, contact support@readhouse.app from the address involved where possible. We may ask for limited information to locate the request and avoid deleting someone else's records. Do not send a password or sign-in code. Information already sent to an external provider is subject to that provider's controls and policies.

Security and changes

We limit operational access, use HTTPS for Readhouse web and app service requests, and keep signing credentials and private test records outside the source repository. No storage or transmission method is perfectly secure. We may update this policy when Readhouse or its services change; the effective date above identifies the current policy. Changes that affect app behavior will also be reflected in the app's privacy information and required Play declarations.

Relevant provider information: Cloudflare, Google, Apple, OpenRouter, OpenAI, Anthropic, and FreeDictionaryAPI.com. These links explain independent providers; they do not mean that all of them receive data whenever you read.