Privacy Policy

This draft policy describes data handling for the ChapterWhen website and API. It covers readers, authors, and administrators. Anything described here as planned or undecided is marked as such — this page only asserts what the current implementation supports.

• Account information: email address, username, and profile details you provide (such as bio and avatar). Passwords are stored only as one-way cryptographic hashes, never as readable text.
• Authentication state: a session cookie that keeps you signed in, plus server-side records of your account role and active status. See §5 for cookie details.
• Reading activity (signed-in users): reading progress, library entries, bookmarks, highlights and notes, follows, comments, and reactions you create. This data powers features such as “continue reading” and your library.
• Authored content: novels, volumes, chapters (including drafts), and document imports you submit, with ownership metadata linking them to your account.
• Reading analytics: novel and chapter view events. Signed-in views are linked to the account; guest views are linked to a random browser identifier (see §3). Views of unpublished or hidden content are not recorded.
• Operational data: server request logs (method, path, status, timing) and error records used to keep the service running. These logs exclude request bodies, headers, and cookies.

Guests can read public content without an account. To count readership, the site stores a random identifier in the browser (localStorage key cw_visitor_id) and sends it with view events. This identifier is pseudonymous, not anonymous: it distinguishes browsers, not verified people, and it resets if browser storage is cleared or a different device is used. Audience figures shown to authors are therefore approximate device/browser counts, not verified headcounts.

View events are rate-limited. Analytics payloads contain no email addresses, passwords, or message content.

• Operating accounts, sessions, and access control.
• Providing reading features (progress, library, bookmarks, follows).
• Publishing and attributing author works.
• Measuring readership for authors and operating the catalog.
• Reviewing reported content and enforcing the Community Guidelines.
• Diagnosing errors, preventing abuse, and securing the service.

Information is not used for third-party advertising. The codebase contains no third-party analytics or advertising integrations.

• Session cookie (chapterwhen_token, with an environment-specific variant on staging): HttpOnly, so page scripts cannot read it; marked Secure in production; SameSite configured for the split frontend/API hosting. Signing out clears it. It expires with the session token (currently seven days).
• Guest analytics identifier in localStorage as described in §3. Clearing site data removes it.

Your information is processed within ChapterWhen's own database and hosting providers (application hosting, frontend hosting, and managed database) as necessary to operate the service. Public profile information, published works, comments, and reactions you post are visible to other users as designed. Unpublished drafts are never shown publicly.

[DATA-PROCESSING AGREEMENTS, SUBPROCESSOR LIST, AND ANY CROSS-BORDER TRANSFER DETAILS TO BE CONFIRMED BY THE OWNER.]

Account, content, and activity records are retained while your account is active and as needed to operate published works and audit moderation. There is currently no automatic deletion schedule, and no self-service account deletion — deletion and export requests are handled through support (see §8). A defined retention and erasure schedule [REQUIRES OWNER AND COUNSEL DECISION].

To ask questions about your data, or to request access, correction, export, or deletion, use Contact & Support and choose the privacy category. Include the account email and username so the request can be verified. Response times and identity-verification steps [TO BE DEFINED BY THE OWNER].

Privacy contact: [PRIVACY CONTACT TO BE PROVIDED — currently the general support channel].