Lorewood
Privacy policy
1. Who is responsible
The data controller is Sami Yacoubi, a private individual based in France who publishes Lorewood on a non-commercial basis. Contact for any privacy question: contact@lorewood.world.
2. What we collect and why
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: email address and password (stored hashed), or the identifier and basic profile (name, email, picture) your sign-in provider shares if you use Google, Discord, Facebook or Apple | Create your account and sign you in; send account emails (confirmation, password reset) | Contract (b) |
| Library and reading progress: the books you add and the chapter you are on | Show only what you have already read, on any device | Contract (b) |
| Community profile: display name, social links and profile picture you choose to add | Identify you as the author of your contributions | Contract (b) |
| Community content: comments, fan art (images, title, caption, maturity flag and your "human-made" statement), likes, suggested corrections and votes | Publish and display your contributions | Contract (b) |
| Reports you file (reason, optional note) and reports about your content | Moderate the Community and keep it safe | Legitimate interest (f) — a safe service; legal obligations for hosted content |
| Feedback you send from the app (message, screen you were on) | Fix bugs and improve the app | Legitimate interest (f) |
| Usage analytics: screens viewed, actions such as opening a book or changing chapter, app opened/closed, app version, device model and system, linked to your account's random identifier (never your email) | Understand which features are used and find problems | Legitimate interest (f) — you can object at any time (section 7) |
| Technical data: IP address and request information in server logs | Deliver the service, security, debugging | Legitimate interest (f) |
We do not use your device location. The camera and photo library are used only when you pick an image to post, and only the image you choose is uploaded. We do not collect contacts, advertising identifiers or payment data, and we do not do any automated decision-making or profiling.
3. What is public
Your display name, social links, profile picture and everything you post in the Community (including images) are visible to other Lorewood readers and can be retrieved through the app's public interface. Images you post may contain metadata (such as the location where a photo was taken): check your photos before posting. Your email address, library and reading progress are never public.
4. Who processes your data
We use these service providers, bound by data processing agreements:
| Provider | Role | Data location |
|---|---|---|
| Supabase | Accounts, database, image storage, account emails | Ireland (EU) |
| Render | App server | Frankfurt (EU) |
| PostHog | Usage analytics | EU |
| Vercel | This website (server logs only) | Global network |
Some of these companies are based in the United States and may access data from there, for example for support. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
If you sign in with Google, Discord, Facebook or Apple, that company processes your sign-in under its own privacy policy. Apple and Google also process data as app stores under their own policies.
We never sell or rent your data and never share it for advertising.
5. How long we keep it
- Account, library, progress, profile and Community content: as long as your account exists. When you delete a post, it is removed from the app immediately.
- When you delete your account: your account, profile, library, progress, feedback and all your Community content (comments, fan art and their images, likes, votes, suggested corrections) are deleted, and your analytics data is deleted from PostHog, within 30 days. Corrections you suggested that were already accepted into a book's text stay part of that text, with no link to you. Reports you filed are kept for up to 1 year without any link to you, to keep moderation records.
- Usage analytics: up to 12 months.
- Server logs: up to 30 days.
- Backups: deleted data disappears from backups within 30 days.
6. On your device
The app stores your sign-in session in your device's secure storage, plus your preferences (language, which tips and notices you have seen) and chapter badges. The analytics tool stores a random identifier and events waiting to be sent. Signing out or uninstalling the app removes them.
7. Your rights
You can ask to access, correct, delete or receive a copy of your data (portability), to restrict its use, and to object to its use — in particular to usage analytics. You can also give instructions on what happens to your data after your death. Most of it you can manage directly in the app (profile, posts, account deletion). For anything else, including a copy of your data, email contact@lorewood.world from the address linked to your account; we reply within one month.
If you think your rights are not respected, you can complain to the French data protection authority, the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France), or the authority in your country.
8. Minimum age
Lorewood is for people aged 15 and over. We do not knowingly collect data from younger children; if you believe a child under 15 has an account, contact us and we will delete it.
9. Security
All connections are encrypted (HTTPS). Access to your data in our database is restricted to your own account and to the minimum needed to run the service.
10. Changes
We will update this page when the app changes how it uses data, and tell you in the app for significant changes. The version and date at the top show the latest update.