Privacy Policy, Smithbook

Who the data controller is

Smithbook is the controller of the personal data processed on this platform.

What data we collect

• E-mail: used to deliver purchased books, authenticate you to the reader, and send updates on your orders.
• Name: optional, to customize e-mails and receipts.
• Purchase history: list of the books you bought, dates and values.
• Reading progress: current chapter, notes, bookmarks, to sync between your devices.
• IP address and device type: for fraud prevention and account security.
• Payment details: processed directly by Stripe (credit card only). We never store your card number.

What we use it for

• Deliver the books you bought.
• Sending transactional e-mails (receipt, magic link, withdrawal confirmation, account updates).
• Fraud prevention (anti-self-purchase, cloned-card detection).
• Meeting legal obligations (issuing invoices, income-tax withholding for authors when applicable).

Who we share with

• Stripe: payment and payout processing.
• Brevo: sending transactional e-mails.
• Google Cloud (Cloud Run) / Firebase: infrastructure and hosting.
• We don't sell your data to third parties or use it for ads.

How long we keep it

Purchase data: 5 years (tax obligation). Reading progress and notes: for as long as your account exists. You can request deletion at any time.

Your rights

You have the right to: confirm processing, access, correct, anonymize, port, delete your data, and withdraw consent, as provided by the data protection law that applies to you. To exercise these rights, write to dpo@smithbook.com. We respond within 15 days.

Cookies

We use essential cookies only: mk2_reader keeps you signed into your library, mk2_author keeps an author signed into the author dashboard, and csrf protects forms from being submitted from another site — all httpOnly, SameSite=Lax. We do not use advertising cookies in the Store.

Contact

Data Protection Officer (DPO): dpo@smithbook.com
General support: support@smithbook.com