Privacy Policy

1. Controller (Verantwortlicher)

The controller responsible for processing personal data in connection with this app and website is:

2. What Data We Collect

When you create an account and use Chapter, we collect and process the following personal data:

• Account data: email address and display name, provided by you during registration
• Profile data: optional profile picture and favorite genres
• Reading data: books you track, reading progress (current page), notes, voice recordings, and reviews
• Usage data: app interactions, timestamps of progress updates
• Device data (mobile only): advertising identifier (IDFA / Google Advertising ID) used by Google AdMob and Meta for advertising and measurement (see section 7)
• Marketing & measurement data (mobile only): app events — such as completing registration, viewing a book, running a search, or starting a subscription — shared with Meta to measure and optimize advertising campaigns (see section 7)
• Subscription data (mobile only): whether you have an active Chapter Premium subscription, the store it was purchased through, and its renewal date (see section 6)
• Premium waitlist (website, closed): if you signed up on our pricing page before Chapter Premium launched, we hold the email address you provided

3. Purpose and Legal Basis

We process your data for the following purposes:

• Providing the service: account management, club features, reading progress — legal basis: contract performance (Art. 6(1)(b) GDPR)
• Sending invitations: emailing club invites on your behalf — legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• Advertising (mobile): displaying ads via Google AdMob — legal basis: consent (Art. 6(1)(a) GDPR) where required
• Advertising measurement (mobile): measuring and optimizing our advertising campaigns via Meta App Events — legal basis: consent (Art. 6(1)(a) GDPR) where required
• Subscriptions (mobile): recognising and managing your Chapter Premium purchase — legal basis: contract performance (Art. 6(1)(b) GDPR)
• Premium updates: emailing you about Chapter Premium, if you requested it on our website before launch — legal basis: consent (Art. 6(1)(a) GDPR)

4. Data Storage — Supabase

Your data is stored and processed using Supabase (Supabase Inc., 970 Toa Payoh North, Singapore). We use Supabase for authentication, database storage, and file storage. Supabase acts as a data processor on our behalf under a Data Processing Agreement. Data may be stored on servers in the European Union or United States (with appropriate safeguards under Standard Contractual Clauses).

More information: supabase.com/privacy

If you joined the Chapter Premium waitlist on our website before launch, your email address is also stored with Resend (Resend, Inc., USA) so we can send product announcements and manage unsubscribe preferences. Resend acts as a data processor on our behalf. You can unsubscribe from Premium updates via the preference link in any email we send.

More information: resend.com/legal/privacy-policy

5. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, unless we are required by law to retain it longer. Reading progress and notes you have shared with a club will be anonymized upon account deletion. How to delete your account, in the app or without it, is described on the account deletion page.

6. In-App Purchases — RevenueCat (Mobile Only)

Chapter Premium is sold as an auto-renewing subscription through the Apple App Store or Google Play. Payment is handled entirely by Apple or Google under their own terms and privacy policies; we never receive your payment details.

To recognise your subscription across devices we use RevenueCat (RevenueCat, Inc., San Francisco, CA, USA). RevenueCat receives the purchase receipt from the store together with your Chapter user ID, and tells our servers whether your subscription is active and when it renews or expires. RevenueCat acts as a data processor on our behalf. Data may be processed in the United States under Standard Contractual Clauses.

More information: revenuecat.com/privacy

7. Advertising & Measurement (Mobile Only)

Google AdMob. The mobile version of Chapter uses Google AdMob (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to display ads. AdMob may collect your device's advertising identifier and usage data to show personalized ads. This does not apply to the web version, and no ads are shown to Chapter Premium subscribers.

Meta App Events. The mobile version also uses the Meta SDK (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland — and Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA) to measure and optimize advertising campaigns. When you take certain actions — such as completing registration, viewing a book, running a search, or starting a subscription — the app sends a corresponding event to Meta, together with your device's advertising identifier where you have consented. This helps us understand which ads lead to sign-ups and build audiences for future campaigns. The Meta SDK is only activated after you have consented in the app's advertising consent dialog; on iOS, the advertising identifier is only shared with Meta if you additionally allow tracking in the App Tracking Transparency prompt. Chapter Premium subscribers are not shown the consent dialog and their app events are not sent to Meta. This does not apply to the web version.

You can withdraw your consent at any time and opt out of personalized ads and tracking on iOS via Settings → Privacy & Security → Tracking (and Apple Advertising), or on Android via Settings → Google → Ads.

More information: policies.google.com/privacy and facebook.com/privacy/policy

8. Cookies and Local Storage

The Chapter web app uses minimal browser storage (localStorage / session cookies) strictly necessary for authentication and maintaining your session. No tracking cookies or third-party analytics are used on this website.

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have:

• Right of access (Art. 15 GDPR) — request a copy of your personal data
• Right to rectification (Art. 16 GDPR) — correct inaccurate data
• Right to erasure (Art. 17 GDPR) — request deletion of your data
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR) — object to processing based on legitimate interests
• Right to withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, contact us at chapter@damonbasler.de. You also have the right to lodge a complaint with the competent supervisory authority. In Hamburg, that is: