Privacy Policy
Last updated: November 8, 2026
Privacy at a Glance
- What we store: Your email address, the feeds you follow, your reading activity and settings, and what we need to keep you signed in.
- No data selling: We don't sell, trade, or rent your personal information to anyone.
- Analytics: We count page views on serenereader.com and use of our apps with Umami, a cookie-free analytics tool we host ourselves. It doesn't store your IP address, and we don't use it to identify you.
- In-app purchases: If you subscribe to Pro in our iOS or macOS app, Apple bills your Apple Account and sends us the records to unlock Pro. In our Android app, Google Play bills your Google account the same way. We never see your card details, and we don't use this data for tracking or ads.
- Deleting your account: You can delete your account at any time, in Settings or on our account deletion page. We delete a free account after 180 days without a sign-in, and we email you twice before we do. Some records held by other services, such as Apple's, Google's, and Polar's purchase records, remain afterward.
Introduction
SereneReader is operated by JonesLabs LLC ("JonesLabs", "we", "us", or "our"). This Privacy Policy explains how we collect, use, and share information when you use SereneReader on the web at serenereader.com or in our apps for iPhone, iPad, Mac, Apple Watch, and Android (together, "the Service").
By using SereneReader, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service.
Information We Collect
Information You Provide
- Email address: We collect your email address when you create an account. You can sign in with a one-time code sent to that address, and we don't store passwords.
- Google, GitHub, or Apple sign-in: If you sign in with Google or GitHub (on the web or in our apps) or with Sign in with Apple (in our apps only), we store your account ID with that provider and the email address it shares with us (encrypted). If your account doesn't have a display name or profile picture yet, we may also save the ones the provider shares.
- Profile: An optional display name and profile picture address, which you can change in Settings.
- Feed subscriptions: The RSS/Atom feed URLs you subscribe to, along with any folders or organizational preferences you configure.
- Reading activity: Which articles you've read, starred, added to Read Later, filed in article folders, or hidden, with the time of each action, and any filter words you set. This is stored with your account so it syncs across your devices.
- Preferences: Theme selection, display settings, and other customizations you configure.
- Purchase information: When you subscribe to Pro inside the iOS or macOS app, Apple sends us the records needed to activate your subscription: Apple transaction identifiers (including the original transaction ID), the product identifier, your subscription status and current period, and a per-account purchase token (appAccountToken) we generate to link the purchase to your account. When you subscribe inside the Android app, the app gives Google Play a random identifier that we generate for your account and that holds no personal data. Google then gives us a purchase token, which we check with Google, and we store it with that identifier and your subscription status and current period. When you subscribe on the web, Polar sends us your Polar customer and subscription IDs, your plan, and the subscription's status and billing period. Apple, Google, and Polar process the payments; we never receive your card or bank details.
- API keys: If you create API keys (Pro and Team), we store a hash of each key rather than the key itself, along with its name, a short prefix for display, and when it was last used. We also log the time of each key's requests for 24 hours to show usage counts.
- Messages you send us: If you use the contact form or in-app feedback, your message reaches us by email through Resend, with the name and email address you enter (contact form) or your account email (feedback).
- Feed reports: If you report a feed, we keep the report and a link to your account so we can review it. If you delete your account, we keep the report without that link.
Information Collected Automatically
- Analytics data: We use Umami, a cookie-free analytics tool that we host ourselves, to count page views on serenereader.com and use of our apps. Your browser sends page views to our own domain, and a Cloudflare Worker forwards them to our Umami server. For each page view, Umami records the page address and title (we remove search terms first), the referring page, your browser, operating system, device type, screen size, and language, and your approximate location (country, region, and city), which it looks up from your IP address. When you use one of our apps while signed in, our server sends Umami a usage record at most once every four minutes. The record holds the app's platform and version, your device type and language, and your approximate location, which Umami looks up from your IP address. It doesn't include your account, your feeds, or what you read. Umami doesn't store your IP address. It groups page views and app usage into visits with a hashed identifier that resets every month.
- Sign-in sessions: When you sign in, we store the IP address and User-Agent (which identifies your browser or app) with that session, and we record when you last signed in.
- Rate limiting: To prevent abuse, we keep short-lived counters tied to your IP address or account for some actions, such as requesting a sign-in code or sending the contact form. They expire within two hours.
- Server logs: Our servers log requests and errors, which can include IP addresses, request times, and error details. We use these logs for security and debugging.
How We Use Information
We use the information we collect to:
- Provide the Service: Fetch and deliver RSS feeds, store your reading progress, and sync across devices
- Authenticate you: Sign you in with a one-time code or your Google, GitHub, or Apple account, and keep you signed in
- Improve the Service: Review page-view statistics and overall usage counts to understand how the Service is used
- Maintain security: Monitor for abuse, detect threats, and protect the integrity of the Service
- Communicate: Send emails about your account, such as sign-in codes, Team invitations, and Team notices, through our email provider
- Comply with legal obligations: Meet legal requirements and respond to lawful requests
Data Retention
- Articles: Articles come from the feeds people follow and are shared by everyone who follows the same feed. Unsaved articles are removed once they're more than 90 days old, except that we keep the newest 50 articles of each feed whatever their age, and feeds with more than 500 articles are trimmed to the newest 500. Articles you save (starred, in Read Later, or filed in an article folder) are kept for 90 days on Free, 180 days on Pro, and with no limit on Team, counted from the article's publish date. When nobody follows a feed anymore, its articles are deleted, saved ones included.
- Feed data: Your feed subscriptions and folders are kept until you remove them or delete your account.
- Sessions: Sessions expire 7 days after you sign in, or end when you sign out, and are then deleted. We cache session details in Redis for up to 5 minutes. You can be signed in on any number of devices.
- API keys: Revoked keys are deleted 30 days after you revoke them. All your keys are deleted with your account.
- Server logs: Kept on our server for a limited period.
- Analytics data: Page-view and app usage data is kept in our Umami instance indefinitely and isn't linked to your account.
- Subscription records: Your plan, subscription status, and the purchase identifiers from Apple, Google, or Polar are kept with your account and deleted with it. Apple, Google, and Polar keep their own records of your purchases under their own policies.
- Account data:We keep your account data until you delete your account from Settings, or until it goes 180 days without a sign-in. Before we delete an inactive account, we email you 30 days and again 7 days ahead, and one sign-in keeps it. We don't delete inactive accounts that have a paid plan, an open subscription or a team. Deletion removes your account, sessions, feed subscriptions, folders, reading activity, share links, and API keys from our database.
- Subscriptions when you delete your account: Deleting your account cancels an active web (Polar) subscription immediately, before anything is deleted. If we can't cancel it, the account isn't deleted and you can try again. We can't cancel App Store or Google Play subscriptions: cancel yours in your Apple Account settings or in Google Play, because Apple and Google keep billing until you do. If you lead a Team, deleting your account disbands the team and moves its members to the Free plan.
- What deletion doesn't remove: Purchase records held by Apple, Google, and Polar, delivery logs kept by our email provider (Resend), messages you've sent us through the contact form or feedback, page-view and app usage analytics, server logs until they expire, and copies in our nightly database backups, which we delete within 14 days. We also keep feed reports you've sent, without a link to your account.
Data Security
We protect your data with these measures:
- Email encryption: We store your email address encrypted with AES-256-GCM, plus a SHA-256 hash used to look up your account. The Service decrypts it when needed, for example to send you email, show it to your Team, or provide support
- HTTPS encryption: All data sent between your browser or our apps and our servers is encrypted with TLS
- Security headers: Our servers send security headers, including a Content Security Policy
- Session management: Session cookies are HTTP-only, session tokens are stored hashed, and sessions expire automatically
- Infrastructure security: Only our administrators can sign in to our server, over a private encrypted network, and its databases aren't reachable from the internet
While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any security incidents.
Your Privacy Rights
All Users
Regardless of your location, you have the right to:
- Delete your account at any time from Settings, in our apps, or on our account deletion page (see Data Retention for what deletion removes)
- Know what personal information we collect and how it is used
- Contact us with questions or concerns about your privacy
European Economic Area (GDPR)
If you are located in the EEA, you have additional rights under the General Data Protection Regulation:
- Right of access: Request information about the personal data we hold about you
- Right to rectification: Request correction of inaccurate personal data
- Right to erasure: Request deletion of your personal data
- Right to restrict processing: Request limitation of processing of your personal data
- Right to data portability: Request transfer of your data to another service
- Right to object: Object to processing of your personal data
Our legal basis for processing personal data is legitimate interest in providing and improving the Service.
California Residents (CCPA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act:
- Right to know: Request disclosure of the categories and specific pieces of personal information we have collected
- Right to delete: Request deletion of personal information we have collected
- Right to opt-out: Opt out of the sale of personal information (note: we do not sell personal information)
- Right to non-discrimination: Not receive discriminatory treatment for exercising your rights
To exercise your rights, contact us. We will respond to verified requests within the timeframes required by applicable law (typically 30 days for GDPR, 45 days for CCPA).
Our Android App
JonesLabs LLC publishes the SereneReader app for Android on Google Play. The rest of this policy applies to it too, and this section covers what's specific to it.
What the App Sends
- To our server: The app sends your account data only to serenereader.com. Each request carries the app's platform and version, such as SereneReader-android/1.0.0, and your session token once you sign in. We record the platform as the place where you signed up. Article images load from other sites, as Content Loaded From Other Sites describes.
- No tracking code: The app has no advertising, analytics, or crash-reporting code, and it doesn't use your device's advertising ID. Our server counts signed-in app use, as Analytics data describes.
- Permissions: The app uses the internet, checks whether you're online, and uses Google Play's billing service. It never asks for your location, contacts, camera, microphone, or permission to send notifications.
Google Services in the App
- Google Play Billing: Pro subscriptions in the app go through Google's Play Billing Library, which works with the Google Play Store app on your device to show the price and take the payment. Google bills your Google account and handles that information under its own privacy policy. Purchase information above lists what Google sends us.
- Ratings: From time to time, the app asks Google Play to show its rating card. Google Play decides whether to show it, and a rating or review you leave goes to Google, not to us.
- Safe Browsing: The article reader turns on Google Safe Browsing, which Android provides, to check the sites that article images load from against Google's list of unsafe sites.
- Your browser: Signing in with Google or GitHub, and links you open from an article, open in a tab of your default browser. That browser's own privacy policy applies there.
What the App Keeps on Your Device
The app keeps these in its private storage on your device:
- Offline copy: Your feeds, folders, articles, and account details, the images the app has shown, and changes you made offline that haven't reached our server yet. This lets the app open quickly and work without a connection.
- Session token: Encrypted with a key kept in the Android Keystore.
- Recent searches: Your last 10 searches.
- Device settings: Your theme, article list style, whether unread counts and the Discover tab show, and the counts the app uses to decide when to ask for a rating.
Signing out deletes everything on this list except the device settings. Uninstalling the app deletes all of it.
If Android backup is on, Android copies only the device settings to your Google account's backup, and to a new phone when you move your data. Your session token, the offline copy, and your searches stay on the device, so you sign in again on a new phone.
Deleting Your Account
In the app, open Settings, then Account, and tap Delete account. You can also use our account deletion page, which works without the app. Deleting your account doesn't cancel a Google Play subscription, so cancel it in Google Play first.
Children's Privacy
SereneReader is not intended for use by children under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will take steps to delete such information.
International Data Transfers
JonesLabs LLC is based in the United States, and we process your information there. Our service providers may process it in the United States and in other countries.
By using the Service, you consent to the transfer of your information to the United States and other jurisdictions where we or our service providers operate.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this policy.
Your continued use of the Service after changes become effective constitutes your acceptance of the revised Privacy Policy.
Contact
If you have questions about this Privacy Policy or our data practices:
For EU residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.