Privacy

Legal operator

Data we process

We process email addresses, authentication identifiers, password credentials through Supabase Auth, confirmation/recovery events, edition acquisitions, saved bookmarks and reading progress. Reader registration collects email and password only. Requests can produce IP addresses, device/browser details and security or error logs at our hosting and service providers. We do not collect payment-card data or run paid purchases or subscriptions.

Purposes and legal bases

Account, library and reading records are used to provide the requested service (GDPR Article 6(1)(b)). Security, abuse prevention, fault diagnosis and handling enquiries rely on legitimate interests (Article 6(1)(f)); legally required retention relies on Article 6(1)(c). Authentication emails are transactional, not newsletter subscriptions. We do not use reader manuscripts or reading records to execute paid AI generation.

Service providers

Supabase provides authentication, application records and file storage; Lovable provides hosting, operational diagnostics and cookieless visitor statistics (pages visited, referring site, country, browser, page speed, errors and the on-page position of clicks); these statistics store nothing on your device and do not identify you. Authentication email delivery uses the configured Supabase email service with Resend when enabled. The site loads fonts from Google Fonts, which receives the network information needed to deliver them. Providers may process data outside the EEA; applicable contractual safeguards and provider transfer arrangements must cover such processing. We do not sell reader data.

Browser storage and retention

Browser storage on your device keeps the sign-in session, your interface language, your Reader settings (text size, theme and whether the tips were shown), your reading position for each edition until it is saved to your account (or on the device only when you read without signing in), and whether you dismissed or accepted the Home Screen invitation. The Studio also keeps an illustrated-upload attempt identifier for interrupted uploads. The site sets no advertising or tracking cookies. The application has no advertising or marketing tracker. Provider-level operational logging may still occur. Account and library records are retained while needed to provide access; security, legal and rights-related records are retained only as necessary for their purpose and applicable duties. Inactive accounts are not erased automatically.

Your rights and complaints

You may request access, correction, erasure, restriction, portability or object where applicable by contacting the operator. We may need to verify your identity and review lawful retention duties. Responses follow GDPR time limits, normally one month, with lawful extensions explained. You may complain to the Hellenic Data Protection Authority (www.dpa.gr) or another competent supervisory authority. You can permanently delete your reader account yourself in Account settings after re-entering your password; this removes the account and its library and reading records, subject to any retention the law requires. Staff accounts are closed by request. No marketing emails are sent, so no marketing consent is requested.