Terms of Service & Privacy Notice

1. Document Ingestion & Storage Policy

When you import an EPUB file (either via local file selection, Google Drive, or public domain catalogue):

• No Binary Retention: The original uploaded `.epub` archive is stored solely in a transient scratch buffer (`/tmp`) for the seconds required to extract text chapters. Once text chunking is complete, the temporary file is immediately and permanently unlinked from the server.
• Chunk Transformation: Extracted paragraph text is broken down into ~1,190-word reading intervals and held in a database record associated with your user ID. We never sell, index for public AI training, or share your processed library contents with third parties.
• User Library Management: Deleting a book from your bookshelf immediately disassociates that volume from your library account.

2. Google Drive Integration & OAuth Scopes

Our integration with Google APIs operates strictly under Google's Limited Use requirements:

• Zero Credential Storage: We never receive, process, or store your Google password or persistent refresh tokens. Authorisation uses client-side Google Identity Services (GIS).
• Single-File Target Access: When invoking the Google Picker, access is granted solely to the specific file you choose. Our application cannot inspect, list, modify, or delete any other folders or documents in your Google Drive.
• No Advertising Use: Data retrieved from Google Drive is used strictly to parse the reading micro-session on your screen. No Drive metadata or content is transferred to data brokers or advertising networks.

3. Account Security & Credential Protection

We apply standard security practices to protect user data:

• Irreversible Password Hashing: User passwords are encrypted using one-way bcrypt cryptographic hashing with individual salts before write operations. Plaintext passwords are never logged or stored.
• Stateless Session Security: Authentication is handled via signed JSON Web Tokens (JWT) using HMAC-SHA256 signatures, sent via standard Authorization headers.
• Transport Encryption: All client-to-server traffic is forced over encrypted HTTPS (TLS).

4. Habit Analytics & Gamification Data

The platform collects minimal telemetry necessary to calculate your habit tracking features:

• Timestamps of completed sessions (used to plot your hourly habit distribution and daily streaks).
• Elapsed reading duration (used to calculate average words-per-minute velocity).
• Discovered vocabulary entries saved to your personal Wordex dictionary.

5. Fair Use & Intellectual Property

Users are responsible for ensuring they hold appropriate rights or personal licenses for private documents imported into the application. Public domain books made available via Project Gutenberg or Standard Ebooks are offered in accordance with their respective open public licenses.

6. Account Deletion & Inquiries

You may request deletion of your account, reading history, and associated chunk database records at any time by contacting the platform administrator.