Privacy Policy — DeepReader

1. General provisions

1.1. This Personal Data Processing Policy (the “Policy”) has been prepared in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and sets out the procedure for processing the personal data of users of the DeepReader website at https://deepreader.ru/ and the DeepReader mobile apps for iOS and Android.

1.2. The personal data controller is:

Sole proprietor Утюж Илья Николаевич
OGRNIP (state registration number): 322774600747400
INN (taxpayer identification number): 772864420416

hereinafter referred to as the “Controller”.

1.3. This Policy applies to all information that the Controller may obtain about users of the website https://deepreader.ru/ and the DeepReader Service.

1.4. DeepReader is a web service for tracking book reading, recording reading sessions, maintaining a personal library, and viewing statistics, an activity calendar and reading progress.

1.5. This Policy explains data processing in DeepReader. Reading it does not replace separate consent where consent is required. Objecting to geographic personalization of book offers does not require account deletion or discontinuing use of the Service (section 15.6).

2. Definitions

2.1. Personal data means any information relating directly or indirectly to an identified or identifiable User.

2.2. User means any person using the website https://deepreader.ru/ and/or the DeepReader Service.

2.3. Controller means the person who independently organizes and carries out personal data processing and determines the purposes of processing, the personal data to be processed and the operations performed on those data.

2.4. Personal data processing means any operation or set of operations on personal data, including collection, recording, systematization, accumulation, storage, correction, use, transfer, blocking, deletion and destruction.

2.5. Automated personal data processing means processing personal data using computing equipment.

2.6. Personal data confidentiality means the obligation not to disclose personal data to third parties without the User’s consent, unless otherwise provided by law.

2.7. Website means the website at https://deepreader.ru/.

2.8. Service means the features of DeepReader that allow the User to create an account, add books, record reading sessions, track progress and statistics, and use other website features.

3. Personal data processed

3.1. The Controller may process the following User data:

username / login;
email address;
password stored as a secure hash;
account information: role, account status, subscription type and Premium access expiry date;
data about books added by the User: title, author, page count, reading progress and additional book information provided by the User;
reading session data: date, time, duration, start and end pages, pages read, reading speed and session status;
activity calendar data and reading statistics;
information about an active reading session, including timer status, pauses, duration and the selected book;
information about promo code use;
technical data: IP address, browser or app data, device type and model, app and operating system versions, date and time of access to the Service, error information and technical server logs;
data stored in the User’s browser or app: authentication token, active session state, interface settings and sound settings.
partnership application data: last name, first name, middle name, phone number, Telegram contact and selected participant type;
social graph data: friend requests, friends list, friend codes and visibility settings for friends;
approximate location (country, region and city) derived from the retained IP address to protect sign-in and confirm QR sign-in;
account, installation and device identifiers used for sign-in, synchronization, security and, with separate consent, product analytics;
technical parameters of internal website and web-admin requests, including search terms entered there, that may be included in authenticated client diagnostics; the free DeepReader 1.0 App Store app does not collect such search data;
product interaction and diagnostic data: screen views, commands and actions, launch, navigation, resource-loading and API-request timings, long tasks, network errors and software errors;
financial data of a participant in the partnership program: commission income, accruals, holds, refunds, available and paid balances, payout requests and their status.
website order and payment records: the product purchased, amount and currency, applied discount, payment provider, order and payment identifiers and status, payment and refund dates, refund details and the entitlement granted;
inferred reading language and limited derived information about connection countries and observation days, linked to the account, for initially selecting a suitable book offer;

3.2. The Controller does not aim to process special categories of personal data, including information about racial or ethnic origin, political opinions, religious beliefs, health or intimate life, or biometric personal data.

3.3. The Controller does not request passport details, a residential address, bank details, payment card information or other excessive data from the User unless those data are required to operate the Service or comply with the law.

3.4. For payments on the website, payment credentials are processed by the connected payment providers under their own rules and policies. The Controller receives and stores the order and payment-result records listed in clause 3.1, but does not receive or store Users’ full payment card details or bank account credentials. In the free DeepReader 1.0 app for the App Store, external payments and in-app purchases are disabled, so that app does not send purchase history or payment credentials to the Controller. In the TestFlight test build with explicitly enabled Sandbox mode, the Operator receives and stores Apple test transaction and product identifiers, the Sandbox environment, purchase, expiry and revocation dates, a server-issued account binding identifier and a snapshot of the selected regional book. Transaction signatures are verified against trusted Apple certificates; the journal stores a signature hash. This data is used to test in-app purchases, does not grant live paid access, and is deleted with the account. The Operator does not receive Apple payment credentials.

4. Purposes of personal data processing

4.1. The Controller processes Users’ personal data for the following purposes:

registering the User with the DeepReader Service;
providing access to the personal account and Service features;
identifying the User when they sign in;
storing and displaying the User’s book library;
recording, storing and displaying reading sessions;
calculating reading statistics, progress, reading speed and the activity calendar;
restoring an active reading session after a page refresh or another sign-in;
applying the limits of the free plan and Premium access;
activating and tracking promo codes;
administering the Service and supporting Users;
protecting accounts and preventing abuse;
diagnosing technical errors and improving the stability of the website and mobile apps;
complying with the laws of the Russian Federation.
operating friend features, friend requests and visibility settings;
receiving and reviewing partnership applications, operating the partner dashboard, calculating commissions and balances, and processing payout requests;
synchronizing across devices, protecting sign-in, managing sessions and confirming QR sign-in, including deriving approximate location from the IP address;
processing technical parameters of internal website and web-admin requests, diagnosing the client, network and performance, correcting errors and supporting Users;
conducting optional app product analytics only after the User gives separate consent.
creating and recording website orders, confirming payments and refunds, granting and revoking Premium access, Reader Boost and Book of the Month access, and complying with payment and accounting requirements.
automatically selecting a suitable language for the Book of the Month using the library, confirmed reading, paid purchases, manual interface-language choice, system languages, region, time zone and approximate connection country.

5. Legal grounds for personal data processing

5.1. The legal grounds for personal data processing are:

the User’s consent to the processing of personal data;
the need to process data to provide the User with the features of the DeepReader Service;
performance of a contract or user agreement to which the User is a party;
the exercise of the Controller’s rights and legitimate interests, provided this does not infringe the User’s rights and freedoms;
fulfilment of obligations under the laws of the Russian Federation.

5.2. Initial geographic personalization relies on the Controller’s legitimate interest in offering a book in a suitable language without requiring manual market selection, subject to the User’s rights: Article 6(1)(7) of Federal Law No. 152-FZ and, where the GDPR applies, Article 6(1)(f). Minimal derived data, limited retention and the right to object restrict this processing. This is a separate purpose, not consent to optional analytics or advertising tracking.

6. Principles of personal data processing

6.1. Personal data are processed lawfully and fairly.

6.2. Personal data processing is limited to achieving specific, predetermined and lawful purposes.

6.3. The Controller does not process personal data in a way that is incompatible with the purposes for which they were collected.

6.4. The Controller processes only the personal data necessary to operate the DeepReader Service.

6.5. The Controller does not collect personal data “just in case”.

6.6. The content and volume of personal data processed correspond to the stated purposes of processing.

6.7. The Controller takes reasonable steps to ensure that personal data are accurate, up to date and sufficient.

6.8. Personal data are kept no longer than necessary for the purposes of processing, unless a different retention period is required by law.

7. Personal data processing procedures

7.1. Personal data are processed using automated tools.

7.2. The Controller may perform the following operations on personal data:

collection;
recording;
systematization;
accumulation;
storage;
correction;
updating;
modification;
retrieval;
use;
transfer in the cases provided for by this Policy and by law;
de-identification;
blocking;
deletion;
destruction.

7.3. The User’s account data are used for registration, authentication and access to Service features.

7.4. Book and reading session data are used to display the library, reading history, progress, activity calendar and statistics.

7.5. Technical data are used to operate the website and mobile apps, protect against abuse, diagnose errors and improve Service stability.

7.6. Until reliable reading preferences are available, DeepReader may use approximate connection countries to select an initial book offer. Observations are recorded only when a signed-in user opens the visible Book of the Month screen. The existing IP-geolocation cache is used; historical logs are not imported. This feature does not retain raw IP addresses, cities, coordinates, routes or device identifiers. A country does not establish citizenship, residence or reading language. Confirmed reading and deliberate choices take priority over geography; purchased books, active orders and their prices remain unchanged.

8. Personal data storage

8.1. Personal data are stored in the Controller’s information system.

8.2. The Service’s main data are stored in a PostgreSQL database.

8.3. Users’ passwords are not stored in plain text. Cryptographic hashing is used to store passwords.

8.4. An authentication token may be stored in the User’s browser to keep them signed in.

8.5. The User’s browser may also store technical data needed for the interface to work: active session state, sound settings and other local settings.

8.6. The User understands that deleting browser data may sign them out or reset local settings, but does not necessarily delete data stored on the server.

9. Cookies and browser local storage

9.1. The website may use cookies, localStorage and similar technologies.

9.2. These technologies are used for:

keeping the User signed in;
restoring an active reading session;
storing interface settings;
ensuring the website works correctly;
maintaining security;
diagnosing technical errors.

9.3. The User can restrict or delete cookies and localStorage data in their browser settings. This may cause some website features to work incorrectly or require the User to sign in again.

9.4. The Controller does not use cookies or localStorage to disclose personal data to an unrestricted group of persons.

10. Transfer of personal data to third parties

10.1. The Controller does not sell Users’ personal data or transfer them to third parties for those parties’ independent marketing use.

10.2. Personal data may be transferred to third parties only in the following cases:

the User has consented to the transfer;
the transfer is necessary to operate the website, hosting, technical infrastructure or Service support;
the transfer is necessary to perform the contract with the User;
the transfer is provided for by the laws of the Russian Federation;
the transfer is required by a lawful request from a court, public authority or another authorized person.

10.3. The Controller may use hosting providers, server infrastructure providers, domain services and technical services. Such parties may obtain technical access to data only to the extent necessary to operate the website.

10.4. When third-party services are used, they process data under their own documents and rules, unless otherwise provided in an agreement with the Controller.

11. Cross-border transfer of personal data

11.1. The Controller may use server, technical or software infrastructure located within or outside the Russian Federation.

11.2. If a cross-border transfer of personal data is necessary, the Controller carries it out in accordance with the laws of the Russian Federation.

11.3. Before starting a cross-border transfer of personal data, the Controller takes the measures required by law, including obtaining the necessary information and notifying the competent authority where such notification is required.

12. Personal data security

12.1. The Controller takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions.

12.2. These measures may include:

restricting access to personal data;
using passwords and authentication mechanisms;
storing passwords as hashes;
using a secure HTTPS connection for the website;
separating user and administrator access rights;
keeping technical logs;
backing up data;
updating software;
controlling access to server infrastructure;
deleting or de-identifying data once the purposes of processing have been achieved.

12.3. The Controller takes reasonable measures to protect personal data. However, the User must also protect their account: use a strong password, not share sign-in details with third parties and not leave their account signed in on other people’s devices.

13. User rights

13.1. The User has the right to:

receive information about the processing of their personal data;
request the correction, blocking or destruction of personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing;
withdraw consent to personal data processing;
request that personal data processing stop;
challenge the Controller’s actions or omissions before the competent authority for the protection of personal data subjects’ rights or in court;
exercise other rights provided for by the laws of the Russian Federation.

13.2. To exercise these rights, the User may send a request to the Controller by email at:

support@deepreader.ru

13.3. The request should preferably include:

the username / login;
the email address associated with the account;
the substance of the request;
the action the User is asking to be taken.

14. User obligations

14.1. The User must provide accurate information when registering and using the Service.

14.2. The User must not provide the Controller with third parties’ personal data without a lawful basis.

14.3. The User is responsible for keeping their account sign-in details secure.

15. Withdrawal of consent and deletion of data

15.1. The User may withdraw consent to personal data processing at any time by sending a request to:

support@deepreader.ru

with the subject line “Withdrawal of consent to personal data processing”.

15.2. Upon receiving a withdrawal of consent, the Controller stops processing the User’s personal data, except where continued processing is permitted by the laws of the Russian Federation.

15.3. The User can delete their account under “Account” → “Account management” → “Delete account” on the website or in the DeepReader app for iOS or Android, or request deletion at the address in clause 15.1. In the interface, the User chooses either immediate permanent deletion or deletion with a 30-day recovery period. The action is confirmed with the word shown on screen and the account password, if one is set.

15.4. With immediate deletion, the account and its associated data (library, reading sessions, statistics and XP, friends, sign-in methods, email address and settings) are permanently deleted immediately after confirmation and cannot be recovered. With the 30-day recovery option, sign-in is blocked on all devices immediately and the account is hidden from other users; during those 30 days, the account can be restored by contacting support and confirming account ownership, after which the data are permanently deleted and cannot be recovered. If Apple sign-in was used, the sign-in authorization is also revoked with Apple.

15.4.1. The User can also deactivate their account: sign-in is blocked, data are retained, and the account can be restored through support.

15.5. The Controller may retain certain data after account deletion if necessary to comply with the law, protect the Controller’s rights, resolve disputes, prevent abuse or confirm legally significant actions. Payment records and partnership accrual, hold, refund and payout records that must be retained by law are kept without the username, email address or other account data.

15.6. The User may object at any time to collection and use of the geographic profile for book selection by writing to support@deepreader.ru with the subject “Do not use geography for books”. After verifying account ownership, the Controller stops this processing and deletes the geographic profile. Reading, synchronization and purchased rights remain available; other signals determine the offer. This objection does not stop separate IP processing for security.

16. Personal data processing periods

16.1. Personal data are processed until the purposes of processing have been achieved or the User withdraws consent, unless otherwise provided by law.

16.2. Account data are stored while the User uses the Service: until immediate deletion is completed, or for no more than 30 days after deletion with a recovery period is confirmed (clause 15.4).

16.3. Book, reading session and statistics data are stored until the User deletes the account or deletes the relevant data themselves, where that feature is available.

16.4. Technical logs may be kept for as long as necessary to maintain security, diagnose errors and protect the Controller’s rights.

16.5. Geographic observations are used within a rolling window of up to 60 days; expired days are immediately excluded from selection and removed by scheduled cleanup. After the first confirmed paid Book of the Month purchase or the formation of a stable reading preference, the profile is deleted and collection stops permanently. An unfinished payment pauses collection. Only a stop marker, without countries or observation dates, remains until account deletion to prevent collection from restarting; the same marker applies after a User’s objection.

17. Processing minors’ data

17.1. The DeepReader Service is not specifically intended to collect minors’ personal data.

17.2. If the User is a minor, the Service must be used with their legal representative’s consent where such consent is required by law.

17.3. If the Controller learns that a minor’s personal data were provided without the required consent of their legal representative, the Controller may delete those data.

18. De-identified and statistical data

18.1. The Controller may use de-identified statistical data to analyze Service operation, improve features, assess load and develop the product.

18.2. De-identified data do not allow a specific User to be identified without additional information.

18.3. Optional product analytics for the iOS and Android apps is enabled only with separate consent in the “App analytics” section. It uses a random installation identifier, device model, app and operating system versions, and events for app opening, reading start and completion, guest use, and technical errors. Book titles, text, advertising identifiers, and immutable hardware identifiers are not transmitted for this analytics. After sign-in, the installation may be linked to the account to measure conversion from guest mode; such data are not considered anonymous.

18.4. Product analytics events are retained for no more than 90 days; the on-device queue is limited to 128 events and 14 days. Declining consent does not restrict reading or synchronization. Consent can be withdrawn and deletion of the data can be requested in the same section. When offline, collection stops immediately, and the deletion request is sent after connectivity is restored. To prevent previously submitted consent from being processed again, a technical withdrawal marker without events or account data is retained for up to 14 days.

19. Changes to the Policy

19.1. The Controller may change this Policy.

19.2. The new version of the Policy takes effect upon publication at https://deepreader.ru/, unless otherwise stated in that version.

19.3. The User is advised to check the current version of the Policy periodically.

20. Controller contact information

Controller:: Sole proprietor Утюж Илья Николаевич
OGRNIP (state registration number):: 322774600747400
INN (taxpayer identification number):: 772864420416
Website:: https://deepreader.ru/
Email for personal data inquiries:: support@deepreader.ru

21. Final provisions

21.1. This Policy remains in force indefinitely until replaced by a new version.

21.2. The current version of the Policy is freely available at https://deepreader.ru/.

21.3. For any questions about personal data processing, the User may contact the Controller by email at support@deepreader.ru.