Privacy Policy

1. Introduction

Saga Reads ("the Service") is operated by Fog City Creations LLC ("we", "us", or "our"). This Privacy Policy explains how we collect, use, and protect your personal information when you use our book tracking application, whether on the web or in our mobile app.

2. Information We Collect

Account information

When you create an account, we collect your email address and display name. Authentication is handled through Supabase, our database and authentication provider. Each account is assigned a unique account identifier that we use internally and with some of the service providers listed in Section 4.

Reading data

We store the books you add to your library, your reading status, ratings, reviews, notes, and reading progress. If you import data from Goodreads via CSV, we process and store that imported information.

Preferences

We store your app preferences including favorite subgenres, rating system preference, theme settings, and onboarding selections. On the web, some preferences are stored locally in your browser (via localStorage) and some are stored in our database. In the mobile app, preferences and your session are stored on your device using the operating system's secure storage.

AI chat conversations

When you use Sage, our AI reading assistant, we store your conversation messages to provide continuity across sessions and to improve the quality of recommendations. Your messages, along with context built from your library, are sent to Anthropic to generate responses (see Section 4).

Subscriptions and purchases

If you purchase a subscription, the transaction is processed by the Apple App Store or Google Play — we never receive your payment card details. We use RevenueCat to manage subscriptions and verify entitlements; RevenueCat receives your account identifier and purchase/receipt data associated with your subscription.

Push notifications

If you enable push notifications in the mobile app, we use OneSignal to deliver them. OneSignal receives a device push token and your account identifier so that notifications can be routed to your device. We do not share your location with OneSignal.

Usage analytics

On the web, we use Vercel Analytics to collect anonymous, aggregated usage data such as page views and general traffic patterns; this data does not identify individual users. In the mobile app, we use PostHog to understand how features are used (for example, which screens are opened or when a book is added). These product-analytics events are associated with your account identifier so that we can understand usage across your sessions — they are pseudonymous rather than anonymous. We do not use analytics for third-party advertising, and we do not track you across other companies' apps or websites (see Section 7).

Diagnostics

On our web application and backend services, we use Sentry to capture error and performance data so we can diagnose and fix problems. We do not intentionally attach your identity to these diagnostic reports.

3. How We Use Your Information

• To provide and operate the book tracking Service
• To personalize your experience, including AI-powered recommendations
• To store and display your reading library and progress
• To enable features like reading challenges, genre coins, and tier lists
• To process subscriptions and verify your entitlements
• To send push notifications and service emails you have opted into or that are essential to your account
• To diagnose errors and improve the reliability of the Service
• To improve the Service based on usage patterns

4. Third-Party Services

We use the following third-party services to operate Saga Reads:

• Supabase — database hosting, user authentication, and file storage
• Anthropic (Claude) — powers the Sage AI reading assistant; conversation messages and reading context are sent to Anthropic's API for processing
• PostHog — product analytics in the mobile app; usage events are associated with your account identifier
• RevenueCat — subscription and purchase management; receives your account identifier and purchase data
• OneSignal — push notification delivery; receives your device push token and account identifier
• Sentry — error and performance monitoring for our web application and backend services
• Resend — delivery of transactional emails, such as your welcome email
• Vercel — web application hosting and anonymous analytics
• Expo (EAS) — mobile app delivery and over-the-air updates
• Apple App Store / Google Play — payment processing for subscriptions
• Open Library, Google Books, ISBNdb, and ISFDB — book, series, and universe metadata and cover images, looked up by title, author, or ISBN. No personal information is sent to these sources.

Each of these services has their own privacy policies governing how they handle data. For full attribution and licensing of our book data sources, see our Credits page.

5. Data Storage and Security

Your data is stored securely in Supabase's managed PostgreSQL database with row-level security policies that restrict access to your own data. We use HTTPS for all data transmission. We do not sell, rent, or share your personal information with third parties for marketing purposes.

6. Cookies and Local Storage

On the web, we use browser localStorage to store your theme preferences, authentication tokens, and UI settings (such as cover image size). We do not use third-party tracking cookies. Supabase authentication uses secure cookies for session management. In the mobile app, your session and preferences are stored on your device using the operating system's secure storage rather than cookies.

7. Tracking

We do not track you across other companies' apps or websites, and we do not use your data for third-party advertising. We do not use advertising identifiers, and we do not share your personal information with data brokers or advertising networks.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data in your profile or library
• Delete your account and associated data through the Service settings, on web or mobile
• Request a copy of your data by contacting us
• Opt out of AI features by not using the Sage chat
• Turn off push notifications at any time in your device settings

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with a supervisory authority. If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know, access, and delete your personal information. To exercise any of these rights, contact us using the details in Section 12.

9. Data Retention

We retain your data for as long as your account is active. When you delete your account, you are signed out and access is revoked immediately. Your account then enters a 14-day grace period, after which your personal data is permanently deleted from our active systems, except where we are required by law to retain certain information.

10. Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

12. Contact

If you have questions about this Privacy Policy or your data, please contact us at hello@sagareads.app.