Privacy policy

Effective date: 30 September 2026 (updated for sign-in codes and cloud sync)

Read Rebel is a reading app for PC (as an installable web app) and Android. We designed it so that your reading life stays on your device. This policy explains what personal data we process, why, how long we keep it, who helps us, and the rights you have wherever you live. It also serves as our notice under India's Digital Personal Data Protection Act, 2023, the EU and UK GDPR, and US state privacy laws.

1. Who we are

Read Rebel is provided by Siddharth Macker, sole proprietor trading as Read Rebel, New Delhi, India ("we", "us"). For the personal data described here, we are the data fiduciary (India) and the controller (EU/UK GDPR). You can contact us at hello@readrebel.app.

If you are in the EU or UK, you can send any privacy request to hello@readrebel.app.

2. The short version

• Accounts are optional. You can read without signing up. If you create a free account, we keep your name, username, email and/or mobile number, a short reader profile, and a synced copy of your reading data so it follows you to your other devices.
• Without an account, your highlights, notes, vocabulary, reading progress and streaks stay on your device only. With an account, copies of the books you are currently reading are also backed up so they open on your other devices; you can turn this off in Settings → Account.
• We don't sell your data, show ads, or use advertising or tracking cookies.
• We only process personal data when you create an account, buy Rebel Plus, subscribe to our newsletter, contact us, or load our website and servers (standard hosting logs).

3. Data that stays on your device

Imported books, and everything you create in Read Rebel, are saved in your browser's storage (IndexedDB and localStorage) or in the Android app's private storage. That includes highlights, notes, vocabulary and flashcards, reading time, streaks, achievements, settings, alarms, your trial status, and your reading-coach data: your diagnosis answers (why reading stops, language, interests, available time), book suggestions, session schedule, check-ins and weekly reflections. If you don't have an account, this data isn't sent to us. If you sign in, a copy of it is synced to your account so it follows you to your other devices; see section 4. Clearing site data or uninstalling the app deletes the copy on that device. You can export a copy at any time with Settings → Export backup.

Some features connect directly from your device to third parties when you use them. We don't receive this data.

• "Explain": a short term you select (a name, place or idea) is sent to Wikipedia's public API (Wikimedia Foundation).
• "Explain this line": when you select a line and tap Explain, that line, the sentence around it and the book's title are sent through our server to Anthropic, whose Claude model writes the plain-English (or Hindi) explanation. We don't store the text or link it to you. Anthropic processes it as our service provider under its commercial terms, doesn't use it to train its models, and may keep it briefly for safety and abuse monitoring. If the explainer is unavailable, the app looks up the harder words in the dictionary instead.
• Crash reports: if a screen in the app fails, the app sends us the error message, which screen it was on and the app version, so we can fix it. No book text, notes or account details are included. These reports are kept in our hosting logs for a short time.
• "About this book": when you add a book, its title, author, the publisher's description (if the file has one), a short excerpt from its opening pages and a few lines from it are sent through our server to Anthropic, which writes a short introduction and picks the book's best lines. We don't keep the text or link it to you; Anthropic processes it as our service provider and doesn't use it to train its models. The introduction is saved with the book on your device (and in your account, if you have one).
• Word definitions are fetched through our server, which asks the Free Dictionary API and Wiktionary (Wikimedia Foundation) and caches common words. Only the word is sent. If our server can't be reached, your device asks the Free Dictionary API (dictionaryapi.dev) directly.
• Read-aloud: uses your device's or browser's voices. Most run on your device, but some "online" or "natural" voices provided by your browser or operating system may send the text being spoken to that company's speech service. Choose an offline voice if you prefer.
• Reading buddy and share cards: when you choose to share a card or invite a buddy (for example via WhatsApp), your device's share sheet sends what you chose to the app you picked. That app's privacy policy applies. We don't receive a copy, and there are no public leaderboards.
• Fonts: the app and this website load fonts from Google Fonts, so your browser requests font files from Google.

These providers receive your IP address as part of any internet request, and their own privacy policies apply.

4. Data we process, why, and our legal basis

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects, and we don't sell or "share" personal data for cross-context behavioural advertising.

Payment card, UPI and bank details are entered on our payment provider's checkout. We never see or store your full card or bank details.

5. Service providers

We use a small number of providers who process personal data for us under contracts (data processing agreements) that require them to protect it and use it only on our instructions:

• Vercel Inc. (USA): website, app and API hosting, and server logs.
• Razorpay Software Pvt. Ltd. (India): payment processing for Plus. For some payment steps, Razorpay also acts as an independent data fiduciary or controller under its own privacy policy and regulatory obligations.
• Buttondown (USA): sending the newsletter and managing subscriptions.
• Anthropic PBC (USA): generating "Explain this line" explanations from the text you select.
• Google Firebase (Google LLC, USA): account sign-in (Firebase Authentication, including one-time SMS codes) and the account database with your synced reading data (Cloud Firestore, stored in Google's Mumbai, India region). When you sign in with a mobile number, Google reCAPTCHA checks the request for abuse and Google's privacy policy applies to that check.
• Resend (Resend, Inc., USA): sending one-time sign-in codes by email.
• ImprovMX (email forwarding) and Google (Gmail): our hello@readrebel.app mailbox.

We may disclose data if the law requires it, to protect our rights or users' safety, or as part of a business transfer. In that case, the successor must follow this policy.

6. International transfers

We're based in India, and our providers may process data in India, the United States, the EU and other countries. When we transfer personal data from the EU, EEA, UK or Switzerland to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA) or the EU–US Data Privacy Framework where a provider is certified. Transfers out of India follow the DPDP Act and any restrictions the Government of India notifies. You can ask us for a copy of the relevant safeguards.

7. How long we keep data

• Purchase and invoice records: for as long as tax and accounting laws require (in India typically up to 8 years), then deleted.
• Licence records: while your pass is active, and for up to 24 months afterwards so we can restore purchases and handle disputes.
• Newsletter data: until you unsubscribe. After that, we keep only your email address on a suppression list so we never email you again, plus the consent record for as long as we may need to show it.
• Account data: until you delete your account, which you can do yourself at any time in Settings → Account. If an account is inactive for 3 years, we delete it.
• Support emails: up to 24 months after the conversation ends.
• Hosting logs: kept by our host for a short period (typically days to a few weeks) under its retention settings.
• On-device data: stays on your device until you delete it. We have no copy unless you have an account, in which case the synced copy is kept until you delete the data in the app or delete your account.

8. Your rights

Depending on where you live, you have some or all of the following rights. We honour these requests for everyone, wherever the law allows.

• Access: get a summary or copy of the personal data we hold about you and how we use it.
• Correction and completion: fix inaccurate or incomplete data.
• Erasure: ask us to delete your data, unless we must keep it (for example tax records).
• Portability: receive your data in a machine-readable format. Your reading data is already portable through Export backup.
• Withdraw consent at any time (for example, unsubscribe). This doesn't affect processing that has already happened.
• Object or restrict: object to processing based on legitimate interests, or ask us to restrict it.
• Nominate (India): nominate someone to exercise your rights if you die or become incapacitated.
• US state rights: know, access, delete, correct, and opt out of sale, sharing or targeted advertising. We don't do any of the last three. We won't discriminate against you for using your rights.
• Complain: to our Grievance Officer (section 13), and to a regulator: the Data Protection Board of India, your EU/EEA supervisory authority, the UK Information Commissioner's Office, or your state Attorney General or privacy agency.

To make a request, email hello@readrebel.app or our Grievance Officer. We may need to verify your identity, usually by confirming the email address used for your purchase or subscription. Authorised agents may act for you where the law allows. We'll respond within the time the law requires, and within one month at most unless we tell you why we need longer.

9. Children

Read Rebel isn't directed to children under 13, and we don't knowingly collect personal data from them. In India, anyone under 18 needs the verifiable consent of a parent or lawful guardian before creating an account, buying Plus or subscribing to the newsletter. Elsewhere, users below the local age of digital consent (13 to 16 in the EU, depending on the country) need a parent's consent to subscribe. We don't track, profile or target advertising at children. If you think a child has given us personal data without the required consent, contact us and we'll delete it.

10. Security

We use reasonable security safeguards, including HTTPS everywhere, secrets kept only on the server, cryptographically signed licences, restricted access to purchase records, and providers with strong security practices. No system is perfectly secure. If a personal data breach affects you, we'll notify you and the relevant authorities as the law requires, for example the Data Protection Board of India and affected users under the DPDP Act, or the supervisory authority within 72 hours where GDPR applies.

11. Cookies and local storage

This website doesn't use advertising, analytics or tracking cookies. The Read Rebel app uses your browser's local storage only to provide the features you ask for (storing your books, progress, settings, licence and, if you have an account, your sign-in session). This is strictly necessary and needs no consent banner. If we ever add optional analytics, we'll ask for your consent first and update this policy.

12. Notice for US residents

In the past 12 months we've collected the categories of personal information described in section 4: identifiers (name, email, mobile number, IP address), commercial information (purchase records) and internet activity (server logs). We use them for the business purposes described in section 4. We don't sell personal information or share it for cross-context behavioural advertising, and we don't use or disclose sensitive personal information for purposes that require a right to limit. We keep each category for the periods in section 7.

13. Grievance Officer (India) and contact

In accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules under it, and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer is:

Siddharth Macker, Grievance Officer
Read Rebel
New Delhi, India
Email: hello@readrebel.app
Hours: working days, 10:00–18:00 IST

We acknowledge every grievance within 24 hours and aim to resolve it within 15 days of receipt. If you're not satisfied with our response, you can escalate to the Data Protection Board of India or the consumer forums available to you.

For anything else, write to hello@readrebel.app.

14. Changes to this policy

We'll update this policy when our practices change, for example before an AI book companion launches. We'll change the effective date above and, for material changes, tell you in the app, on this website, or by email if you've given it to us. Where the law requires consent for a new purpose, we'll ask for it first.