Privacy Policy

1. Controller (Verantwortlicher)

The controller responsible for processing personal data in connection with this app and website is:

2. What Data We Collect

When you create an account and use Chapter, we collect and process the following personal data:

• Account data: email address and display name, provided by you during registration
• Profile data: optional profile picture and favorite genres
• Reading data: books you track, reading progress (current page), notes, voice recordings, and reviews
• Books you add by hand: title, author, page count and an optional cover image you upload, linked to your account as the person who added the book, and — for each book separately — whether you chose to share it with other readers (see section 3)
• Reports: if you report content, the reason, your optional comment, your account and the reported content; if you hide a shared book, that choice
• Usage data: app interactions, timestamps of progress updates
• Device data (mobile only): advertising identifier (IDFA / Google Advertising ID) used by Google AdMob and Meta for advertising and measurement (see section 7)
• Marketing & measurement data (mobile only): app events — such as completing registration, viewing a book, running a search, or starting a subscription — shared with Meta to measure and optimize advertising campaigns (see section 7)
• Subscription data (mobile only): whether you have an active Chapter Premium subscription, the store it was purchased through, and its renewal date (see section 6)
• Premium waitlist (website, closed): if you signed up on our pricing page before Chapter Premium launched, we hold the email address you provided

3. Purpose and Legal Basis

We process your data for the following purposes:

• Providing the service: account management, club features, reading progress — legal basis: contract performance (Art. 6(1)(b) GDPR)
• Sharing books you added by hand: if you switch on “Share with others” for a book, its title, author, page count and cover are shown to other readers in the book search. Other readers do not see who added it. This happens only for the books you choose — legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time for each book, under Settings → Shared books or on the book itself. The book then no longer appears in search; readers and book clubs that already added it keep it on their shelves, together with their reading progress, notes and reviews.
• Reports and moderation: reviewing reported content, removing content that violates our content rules, the law, or the rights of others (including copyright), and preventing a removed cover image from being uploaded again — legal basis: legitimate interest in a safe service and in handling legal notices (Art. 6(1)(f) GDPR). Every report is emailed to our moderation inbox. A book reported by several readers is hidden from search until we have reviewed it. To stop a removed cover from being uploaded again, we keep a fingerprint (hash) of the image file, not the image itself.
• Sending invitations: emailing club invites on your behalf — legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• Advertising (mobile): displaying ads via Google AdMob — legal basis: consent (Art. 6(1)(a) GDPR) where required
• Advertising measurement (mobile): measuring and optimizing our advertising campaigns via Meta App Events — legal basis: consent (Art. 6(1)(a) GDPR) where required
• Subscriptions (mobile): recognising and managing your Chapter Premium purchase — legal basis: contract performance (Art. 6(1)(b) GDPR)
• Premium updates: emailing you about Chapter Premium, if you requested it on our website before launch — legal basis: consent (Art. 6(1)(a) GDPR)

4. Data Storage — Supabase

Your data is stored and processed using Supabase (Supabase Inc., 970 Toa Payoh North, Singapore). We use Supabase for authentication, database storage, and file storage, including cover images you upload. Cover images are stored under a random, unguessable address. Supabase acts as a data processor on our behalf under a Data Processing Agreement. Data may be stored on servers in the European Union or United States (with appropriate safeguards under Standard Contractual Clauses).

More information: supabase.com/privacy

If you joined the Chapter Premium waitlist on our website before launch, your email address is also stored with Resend (Resend, Inc., USA) so we can send product announcements and manage unsubscribe preferences. Resend acts as a data processor on our behalf. You can unsubscribe from Premium updates via the preference link in any email we send.

We also use Resend to deliver report notifications to our moderation inbox. These emails contain the report (reason, comment, the reporting account) and the reported content.

More information: resend.com/legal/privacy-policy

5. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, unless we are required by law to retain it longer. Reading progress and notes you have shared with a club will be anonymized upon account deletion. How to delete your account, in the app or without it, is described on the account deletion page.

Reports are kept for as long as we need them to handle and document the case. Fingerprints of removed cover images are kept for as long as the removal applies.

6. In-App Purchases — RevenueCat (Mobile Only)

Chapter Premium is sold as an auto-renewing subscription through the Apple App Store or Google Play. Payment is handled entirely by Apple or Google under their own terms and privacy policies; we never receive your payment details.

To recognise your subscription across devices we use RevenueCat (RevenueCat, Inc., San Francisco, CA, USA). RevenueCat receives the purchase receipt from the store together with your Chapter user ID, and tells our servers whether your subscription is active and when it renews or expires. RevenueCat acts as a data processor on our behalf. Data may be processed in the United States under Standard Contractual Clauses.

More information: revenuecat.com/privacy

7. Advertising & Measurement (Mobile Only)

Google AdMob. The mobile version of Chapter uses Google AdMob (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to display ads. AdMob may collect your device's advertising identifier and usage data to show personalized ads. This does not apply to the web version, and no ads are shown to Chapter Premium subscribers.

Meta App Events. The mobile version also uses the Meta SDK (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland — and Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA) to measure and optimize advertising campaigns. When you take certain actions — such as completing registration, viewing a book, running a search, or starting a subscription — the app sends a corresponding event to Meta, together with your device's advertising identifier where you have consented. This helps us understand which ads lead to sign-ups and build audiences for future campaigns. The Meta SDK is only activated after you have consented in the app's advertising consent dialog; on iOS, the advertising identifier is only shared with Meta if you additionally allow tracking in the App Tracking Transparency prompt. Chapter Premium subscribers are not shown the consent dialog and their app events are not sent to Meta. This does not apply to the web version.

You can withdraw your consent at any time and opt out of personalized ads and tracking on iOS via Settings → Privacy & Security → Tracking (and Apple Advertising), or on Android via Settings → Google → Ads.

More information: policies.google.com/privacy and facebook.com/privacy/policy

8. Cookies and Local Storage

The Chapter web app uses minimal browser storage (localStorage / session cookies) strictly necessary for authentication and maintaining your session. No tracking cookies or third-party analytics are used on this website.

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have:

• Right of access (Art. 15 GDPR) — request a copy of your personal data
• Right to rectification (Art. 16 GDPR) — correct inaccurate data
• Right to erasure (Art. 17 GDPR) — request deletion of your data
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR) — object to processing based on legitimate interests
• Right to withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, contact us at contact@chapter-bookclub.app. You also have the right to lodge a complaint with the competent supervisory authority. In Hamburg, that is:

10. Content Rules and Moderation

Chapter does not permit users to upload, post, or publicly share nudity, sexually explicit material, or realistic, graphic depictions of violence. This includes content presented as news. These rules apply to profile pictures, uploaded book covers, reviews, notes, and other content users contribute to the app. Content that breaks these rules is not permitted even if someone manages to upload it.

You can report objectionable content in the app or contact support@chapter-bookclub.app. We review reports and remove content that violates these rules. How we process reports and removed cover images is described in sections 2–5 above.