Privacy

Last updated 8 August 2026. This is version 1.0 of the product, and this page describes what version 1.0 actually does.

Your books never leave your device, and we cannot read them. There is no account, no upload and no sync — a book you open here is opened by your browser, on your computer, and stays there.

Your books

When you drop an EPUB or a PDF onto the reader, the file is stored by your browser on your own disk — in the Origin Private File System, with the shelf entry and your place in the book in IndexedDB. None of it is sent anywhere. There is no server to send it to.

This is not a promise about our conduct. It is a description of the architecture: we run a static website and one small mailing-list endpoint, and neither of them has ever received a book.

You can take everything out at any time — Export my library on the shelf writes a zip containing every book file and a manifest of your reading positions, saved by your browser like any other download. Removing a book from the shelf deletes its bytes, not just its row.

The voice

The neural voice runs on your device, and reading a book aloud sends none of its text anywhere. The first time you press Play, though, your browser has to fetch the voice model, and that is a real request to somebody else:

• The model is Kokoro-82M, downloaded from Hugging Face (huggingface.co). Like any file download, Hugging Face and their CDN see the request — your IP address, your browser, and which file you asked for. They do not see anything about your book, because nothing about your book is part of the request.
• It is between roughly 90 MB and 330 MB depending on your device, it is cached by your browser afterwards, and it is fetched once. After that the reader works with no network at all.

What we count

Events, never identities. If analytics are switched on for a build, the reader posts an event name, this site's hostname, the address of the page you were on, and one coarse property — which voice tier your device landed on. That is the entire payload. No cookies, no identifiers, no fingerprint, no profile, and nothing that could be joined back to a person or across visits.

The page address is the reader's own, /app/, and carries nothing about a book: no title, no filename, no position. Nothing in this list ever does.

• book_opened — with the format (EPUB or PDF) and whether it was the sample book
• play_pressed, listened_10m, second_book, returned
• floor_verdict_shown — your device was offered the browser's voice
• waitlist_joined
• feedback — a thumb up or down, and the words you typed with it, if you typed any

That last one is the exception worth stating plainly. If you type something into the feedback box, we get what you typed. It is cut to 280 characters and stripped of any file path, and it is deliberately not put through the scrubber the crash reports use — that one deletes ordinary prose, which is exactly what you would be trying to tell us. So the box sends your words on purpose. Do not paste anything into it you would not want us to have; it is the only place on the site where you can type freely.

Crash reports

When the reader breaks, it can send us the error so we can fix it. Reports are switched off unless a build is configured to send them, and the public build sends nothing at all.

When they are on, a report carries three things, and by construction it cannot carry a fourth: the error's type, its message, and up to twenty stack frames. Before anything is sent, the message is put through a scrubber that

• removes runs of ordinary prose — which is what a page of your book looks like, and the way book text would otherwise end up in an error message;
• removes file:, blob: and data: URLs, which is where a filename or a book's bytes would otherwise be;
• truncates what is left to 300 characters.

The error object itself is never sent. Only those three fields are copied out of it, so anything else the code attached — including a book — is left behind rather than filtered out.

The waitlist

If you give us your email address to hear when the paid tier ships, we store your address and the date you gave it to us. That is the whole record. We do not store your IP address alongside it, we do not log what you were reading, and we will not send you anything except the one email this is for.

To stop that, or to have your address deleted, email CONTACT_EMAIL and it will be removed.

Hosting, and what a web server sees

The site is served by Cloudflare Pages, and the waitlist endpoint by a Cloudflare Worker. Like every web host, Cloudflare processes the requests your browser makes — IP address, user agent, which page — to serve them and to stop abuse. We do not add analytics to that, and it is not joined to anything else.

What is kept in your browser

Three small entries in localStorage, none of which is a cookie and none of which is ever sent anywhere:

• reader.seen — which one-time hints you have already been shown, so you are not shown them twice.
• reader.tier — which voice your device earned, so it is not re-measured on every visit.
• reader.metrics — which of the events above have already been counted for this browser, so a return visit is not counted twice, and how long you have listened. Written whether or not analytics are switched on, because it is what stops something being sent twice.

Clearing your browser's site data for this site removes them, along with your shelf and your books. Export first if you want to keep them.

Children

This is a reading tool with no account and no social features, and it is not directed at children under 13. We do not knowingly collect anything from anybody, which includes them.

Changes, and getting in touch

If this page changes in a way that matters, the date at the top changes with it. The version you are reading is kept in the project's public git history, so you can see exactly what changed and when.

Questions, or anything you think this page gets wrong: CONTACT_EMAIL.