Privacy Policy
Last updated: October 6, 2026
Privacy at a Glance
- What we store: Your email address, the feeds you follow, your reading activity and settings, and what we need to keep you signed in.
- No data selling: We don't sell, trade, or rent your personal information to anyone.
- Analytics: We count page views on serenereader.com with Umami, a cookie-free analytics tool we host ourselves. It doesn't store your IP address, and we don't use it to identify you.
- In-app purchases: If you subscribe to Pro in our iOS or macOS app, Apple bills your Apple Account and sends us the records to unlock Pro. We never see your card details, and we don't use this data for tracking or ads.
- Deleting your account: You can delete your account from Settings at any time. Some records held by other services, such as Apple's and Polar's purchase records, remain afterward.
Introduction
SereneReader is operated by JonesLabs LLC ("JonesLabs", "we", "us", or "our"). This Privacy Policy explains how we collect, use, and share information when you use SereneReader on the web at serenereader.com or in our apps for iPhone, iPad, Mac, and Apple Watch (together, "the Service").
By using SereneReader, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service.
Information We Collect
Information You Provide
- Email address: We collect your email address when you create an account. You can sign in with a one-time code sent to that address, and we don't store passwords.
- Google, GitHub, or Apple sign-in: If you sign in with Google or GitHub (on the web or in our apps) or with Sign in with Apple (in our apps only), we store your account ID with that provider and the email address it shares with us (encrypted). If your account doesn't have a display name or profile picture yet, we may also save the ones the provider shares.
- Profile: An optional display name and profile picture address, which you can change in Settings.
- Feed subscriptions: The RSS/Atom feed URLs you subscribe to, along with any folders or organizational preferences you configure.
- Reading activity: Which articles you've read, starred, added to Read Later, filed in article folders, or hidden, with the time of each action, and any filter words you set. This is stored with your account so it syncs across your devices.
- Preferences: Theme selection, display settings, and other customizations you configure.
- Purchase information: When you subscribe to Pro inside the iOS or macOS app, Apple sends us the records needed to activate your subscription: Apple transaction identifiers (including the original transaction ID), the product identifier, your subscription status and current period, and a per-account purchase token (appAccountToken) we generate to link the purchase to your account. When you subscribe on the web, Polar sends us your Polar customer and subscription IDs, your plan, and the subscription's status and billing period. Apple and Polar process the payments; we never receive your card or bank details.
- API keys: If you create API keys (Pro and Team), we store a hash of each key rather than the key itself, along with its name, a short prefix for display, and when it was last used. We also log the time of each key's requests for 24 hours to show usage counts.
- Messages you send us: If you use the contact form or in-app feedback, your message reaches us by email through Resend, with the name and email address you enter (contact form) or your account email (feedback).
Information Collected Automatically
- Analytics data: We use Umami, a cookie-free analytics tool that we host ourselves, to count page views on serenereader.com. Your browser sends these page views to our own domain, and a Cloudflare Worker forwards them to our Umami server. For each page view, Umami records the page address and title (we remove search terms first), the referring page, your browser, operating system, device type, screen size, and language, and your approximate location (country, region, and city), which it looks up from your IP address. Umami doesn't store your IP address. It groups page views into visits with a hashed identifier that resets every month.
- Sign-in sessions: When you sign in, we store the IP address and User-Agent (which identifies your browser or app) with that session, and we record when you last signed in.
- Rate limiting: To prevent abuse, we keep short-lived counters tied to your IP address or account for some actions, such as requesting a sign-in code or sending the contact form. They expire within two hours.
- Server logs: Our servers log requests and errors, which can include IP addresses, request times, and error details. We use these logs for security and debugging.
How We Use Information
We use the information we collect to:
- Provide the Service: Fetch and deliver RSS feeds, store your reading progress, and sync across devices
- Authenticate you: Sign you in with a one-time code or your Google, GitHub, or Apple account, and keep you signed in
- Improve the Service: Review page-view statistics and overall usage counts to understand how the Service is used
- Maintain security: Monitor for abuse, detect threats, and protect the integrity of the Service
- Communicate: Send emails about your account, such as sign-in codes, Team invitations, and Team notices, through our email provider
- Comply with legal obligations: Meet legal requirements and respond to lawful requests
Data Retention
- Articles: Articles come from the feeds people follow and are shared by everyone who follows the same feed. Unsaved articles are removed once they're more than 90 days old, except that we keep the newest 50 articles of each feed whatever their age, and feeds with more than 500 articles are trimmed to the newest 500. Articles you save (starred, in Read Later, or filed in an article folder) are kept for 90 days on Free, 180 days on Pro, and with no limit on Team, counted from the article's publish date. When nobody follows a feed anymore, its articles are deleted, saved ones included.
- Feed data: Your feed subscriptions and folders are kept until you remove them or delete your account.
- Sessions: Sessions expire 7 days after you sign in, or end when you sign out, and are then deleted. We cache session details in Redis for up to 5 minutes. You can be signed in on any number of devices.
- API keys: Revoked keys are deleted 30 days after you revoke them. All your keys are deleted with your account.
- Server logs: Kept for a limited period under our hosting provider's log retention settings.
- Analytics data: Page-view data is kept in our Umami instance indefinitely and isn't linked to your account.
- Subscription records: Your plan, subscription status, and the purchase identifiers from Apple or Polar are kept with your account and deleted with it. Apple and Polar keep their own records of your purchases under their own policies.
- Account data:We keep your account data until you delete your account from Settings. Deletion removes your account, sessions, feed subscriptions, folders, reading activity, share links, and API keys from our database.
- Subscriptions when you delete your account: Deleting your account cancels an active web (Polar) subscription immediately, before anything is deleted. If we can't cancel it, the account isn't deleted and you can try again. We can't cancel App Store subscriptions: cancel yours in your Apple Account settings, because Apple keeps billing until you do. If you lead a Team, deleting your account disbands the team and moves its members to the Free plan.
- What deletion doesn't remove: Purchase records held by Apple and Polar, delivery logs kept by our email provider (Resend), messages you've sent us through the contact form or feedback, page-view analytics, server logs until they expire, and copies in any database backups until those backups expire.
Data Security
We protect your data with these measures:
- Email encryption: We store your email address encrypted with AES-256-GCM, plus a SHA-256 hash used to look up your account. The Service decrypts it when needed, for example to send you email, show it to your Team, or provide support
- HTTPS encryption: All data sent between your browser or our apps and our servers is encrypted with TLS
- Security headers: Our servers send security headers, including a Content Security Policy
- Session management: Session cookies are HTTP-only, session tokens are stored hashed, and sessions expire automatically
- Infrastructure security: Our hosting provider, Railway, is SOC 2 Type II compliant
While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any security incidents.
Your Privacy Rights
All Users
Regardless of your location, you have the right to:
- Delete your account at any time from Settings (see Data Retention for what deletion removes)
- Know what personal information we collect and how it is used
- Contact us with questions or concerns about your privacy
European Economic Area (GDPR)
If you are located in the EEA, you have additional rights under the General Data Protection Regulation:
- Right of access: Request information about the personal data we hold about you
- Right to rectification: Request correction of inaccurate personal data
- Right to erasure: Request deletion of your personal data
- Right to restrict processing: Request limitation of processing of your personal data
- Right to data portability: Request transfer of your data to another service
- Right to object: Object to processing of your personal data
Our legal basis for processing personal data is legitimate interest in providing and improving the Service.
California Residents (CCPA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act:
- Right to know: Request disclosure of the categories and specific pieces of personal information we have collected
- Right to delete: Request deletion of personal information we have collected
- Right to opt-out: Opt out of the sale of personal information (note: we do not sell personal information)
- Right to non-discrimination: Not receive discriminatory treatment for exercising your rights
To exercise your rights, contact us. We will respond to verified requests within the timeframes required by applicable law (typically 30 days for GDPR, 45 days for CCPA).
Children's Privacy
SereneReader is not intended for use by children under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will take steps to delete such information.
International Data Transfers
JonesLabs LLC is based in the United States, and we process your information there. Our service providers may process it in the United States and in other countries.
By using the Service, you consent to the transfer of your information to the United States and other jurisdictions where we or our service providers operate.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this policy.
Your continued use of the Service after changes become effective constitutes your acceptance of the revised Privacy Policy.
Contact
If you have questions about this Privacy Policy or our data practices:
For EU residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.