Privacy, data flow, and account controls.
This policy explains what the OpenReader instance at https://openreader.richardr.dev processes, why it is processed, and the controls available to you. Effective date: October 7, 2026.
1. Scope and operator
This policy describes the official OpenReader service at openreader.richardr.dev. It does not govern copies of the open-source software run by somebody else; those deployments have their own operators and may use different service providers or policies.
2. Information processed
- Account and authentication data: name, email address, email-verification status, password verification data, linked sign-in provider details, sessions, IP address, user agent, and security or recovery tokens. OpenReader also records the time you accept this policy.
- Documents and derived content: uploaded EPUB, PDF, TXT, Markdown, and DOCX files; extracted text and layout data; previews; generated speech, timing/alignment data, playback caches, and account or audiobook exports.
- Reading and configuration data: document and folder metadata, recently opened state, reading position, document settings, voice and playback preferences, appearance preferences, and selected TTS provider/model settings.
- Security and operations data: request metadata, error and service logs, durable job and operation state, pseudonymous compute-limit counters, and an anonymous-device identifier when anonymous compute controls apply. IP and device values used for compute-limit buckets are stored as keyed hashes rather than raw values in those buckets; authentication sessions can retain IP address and user-agent data.
- Optional analytics: only after you opt in, Vercel Web Analytics receives page-view data such as the path, referrer, browser, device type, and approximate location. OpenReader does not send document contents, account names, or email addresses as analytics events.
3. How data is used
- Authenticate accounts, verify email addresses, recover passwords, and protect sessions.
- Store, display, organize, search, and export documents and reading state.
- Parse files, create previews, generate and align speech, stream audio, and assemble exports.
- Enforce operator-configured usage limits, prevent abuse, diagnose failures, and secure the service.
- Measure aggregate product usage and improve the service when optional analytics is accepted.
In v5, the authenticated web application controls accounts, authorization, and database records. A separate compute worker processes long-running document, preview, speech, alignment, cleanup, email, and export jobs. NATS JetStream carries durable job and operation state, while SQL and object storage hold the application records and files needed for those features.
6. Retention and security
Account records, reading state, source documents, and reusable derived artifacts are generally retained while the account or document remains active. Incomplete temporary uploads are eligible for cleanup after 24 hours. Durable compute operation state expires after 24 hours, and completed account-export ZIPs are cleaned up after seven days by the shipped scheduled task. Finished audiobook files remain until the relevant audio, document, or account is deleted. An operator can change task scheduling and may retain infrastructure logs or backups on a different schedule.
OpenReader requests AES-256 server-side encryption for uploaded documents and generated object-storage artifacts. Saved TTS and Resend API keys are encrypted with AES-256-GCM. Passwords are stored as non-plaintext verification data. These safeguards do not provide end-to-end encryption: the instance operator and authorized infrastructure can access content when needed to operate the service, and requested text must be readable by the selected TTS provider.
Account deletion first removes per-user storage and then deletes account records and associated database rows. Shared content-addressed source objects and derived artifacts that no longer have an owner are reclaimed by the cleanup process. Residual copies may remain temporarily in provider backups or logs under the applicable provider's retention practices.
7. Your choices and privacy rights
Depending on your jurisdiction, you may have rights to know, access, correct, delete, or obtain a copy of personal information, and to appeal or opt out of certain processing. Exercising a privacy right does not reduce access except where the data is necessary to provide the requested service.
- Export: use Export My Data in Settings to create a downloadable archive of account metadata and uploaded files.
- Correction: update available profile, document, and preference fields in the application.
- Deletion: use Delete Account in Settings to permanently remove the account and begin associated storage cleanup.
- Analytics: decline non-essential processing in the consent notice, or send a Global Privacy Control signal.
8. Processing location
The official service is limited to requests identified as originating in the United States. That access restriction does not guarantee that every service provider stores or processes data only in the United States; provider infrastructure and subprocessors may process data in other locations under their terms and data-protection arrangements.
9. Contact, changes, and open source
For an account-specific privacy request, contact the operator of this instance. Do not include private account information, document contents, passwords, or recovery links in a public GitHub issue. The effective date above will change when this policy is materially revised.
OpenReader is open source. You can review the software or self-host it when you want control over the infrastructure and provider choices.