Privacy policy

Last updated 2026-05-08 · Plain English version below the legal one

1. Who we are

Sparky Reads is operated by Joona Tyrninoksa, a sole developer based in Helsinki, Finland. You can reach the operator at the email address listed in the GitHub repository github.com/Joona-t/lovespark-reads.

2. What we collect

2.1 Identity (required)

• The OAuth subject claim from your provider (GitHub or Google) — a stable opaque identifier such as github:12345. We do not store your password (we never see it).
• Your display name and email address, as returned by the OAuth provider, are received during login but are NOT persisted to disk in the v0.1.0 release. They live in memory only for the duration of a single sign-in flow.

2.2 Reading data (you create it)

• The books you add (title, author, ISBN, page count, cover URL, status, rating, your notes, your highlights, your reading sessions, etc).
• Reading goals and streak data you set.
• An immutable append-only event log of every change you make to your library.

2.3 Operational data

• Server logs (IP address, request path, status code, duration, your user identifier) retained for 30 days for debugging and abuse prevention.
• Error stack traces (no user-content payloads) retained for 14 days.

2.4 What we do NOT collect

• No third-party tracking pixels, no Google Analytics, no Facebook Pixel, no Mixpanel.
• No cookies for analytics or advertising. The only cookies we set are functional auth cookies (described below).
• No reading content is sent to any AI provider or third party. The optional MCP-server integration runs entirely on your own computer.

3. Cookies

We set three cookies, all functional, none for tracking:

• lvr_jwt — keeps you signed in (HttpOnly, Secure, SameSite=Lax, 1-hour expiry).
• lvr_refresh — silently extends your session without re-login (HttpOnly, Secure, SameSite=Strict, scoped to /auth/refresh, 7-day expiry).
• lvr_csrf — protects against cross-site request forgery (Secure, SameSite=Lax, JS-readable, 1-hour expiry).

No banner is displayed because we do not set non-essential cookies.

4. Where your data lives

Application servers run on Fly.io (multiple regions). Static assets are served via Cloudflare. Backups are sent nightly to Backblaze B2 (United States). All data is encrypted in transit (TLS 1.2+).

Cloudflare may process your IP address to terminate TLS and protect against denial-of-service attacks. Cloudflare's privacy policy: cloudflare.com/privacypolicy.

5. Legal basis (GDPR Art. 6)

• Consent (Art. 6(1)(a)): for any future analytics or marketing emails.
• Contract performance (Art. 6(1)(b)): for storing your books and reading history — that is the service you are signing up for.
• Legitimate interests (Art. 6(1)(f)): for short-retention server logs used for debugging and abuse detection.

6. Your rights (GDPR Art. 12-22)

• Access and portability: visit /api/me/export from your browser (logged in) to download your full event log + book projection as JSON.
• Rectification: edit any book, rating, note, or highlight via the dashboard.
• Erasure: visit /api/me with a DELETE request (or use the "Delete my account" button in Settings — coming with v0.1.1). Your data is soft-deleted immediately and permanently purged after a 7-day grace period.
• Restriction and objection: contact the operator.
• Lodge a complaint: with your supervisory authority. The Finnish Data Protection Ombudsman: tietosuoja.fi/en.

7. Data retention

• Reading data: kept until you delete your account.
• Server access logs: 30 days.
• Error logs: 14 days.
• Backups: nightly snapshots retained for 30 days.

8. Children

The service is not directed at users under 16. If you are under 16, please do not create an account. If you are a parent or guardian and believe your child has created an account, contact the operator and we will delete it.

9. Changes to this policy

We will update this page when material changes occur. Material changes affecting how we use your data will be announced via the dashboard banner and via email (if we have your email).

Self-host version: when you run Sparky Reads on your own computer via ./reads serve, none of this policy applies. All your data stays on your machine. The dashboard does not call out to our servers.