Privacy Policy

1. Information we collect

Account information. When you create an account we collect your email address and, if you sign in with Google, the display name and profile image Google provides. Authentication is handled by Supabase using a Google OAuth flow or a one-time numeric code sent to your email address; we do not create, see, or store a password.

Reading and activity information. When you use the Service we collect information about how you interact with it, including papers and passes you open, reading progress, favorites, notes, library organization, time spent reading, searches, interface actions, and other product events. When you are signed in this information is associated with your account; otherwise it is associated with a random identifier stored on your device.

Payment information. Subscriptions are processed by Stripe. You enter your card details on Stripe's hosted checkout, and your full card details never reach our servers. We receive and store your Stripe customer identifier and your subscription status (plan, billing dates, renewal state, and whether a payment succeeded). Stripe processes your payment information as an independent controller — see Stripe's privacy policy.

Device and usage information. When you access the Service we and our providers automatically collect technical information, which may include your IP address, device and browser type, operating system, referring and exit pages, pages viewed, links clicked, approximate location derived from your IP address, and the dates and times of your activity. This is collected through server logs, cookies, pixels, and similar technologies.

Advertising and measurement information. The Service uses advertising and measurement technologies, such as the TikTok Pixel, which set cookies and collect information about your visit and the actions you take on the Service — for example papers opened, sign-ups, checkout starts, and completed subscriptions (including subscription amount and currency). When you are signed in, we may also transmit a SHA-256 hashed version of your email address and your account identifier to our advertising and measurement partners, and we may receive advertising click identifiers. See section 5 for the partners involved and section 6 for your choices.

Communications. If you contact us for support or otherwise correspond with us, we collect the information you provide, such as your email address and the contents of your message.

Cookies and local storage. We use first-party and third-party cookies, local storage, and similar technologies to keep you signed in, remember preferences, run analytics, and support advertising and measurement. Your authentication token, a random analytics identifier, and interface preferences are stored in your browser's local storage. See section 4 for details and controls.

2. How we use information

We use the information we collect to:

• provide, maintain, secure, and operate the Service and your account;
• save and sync your reading progress, favorites, notes, and settings across devices;
• process your subscription, billing, renewals, and related transactions;
• personalize and improve the Service and develop new features and content;
• understand how the Service is used through analytics, including product events and session analytics;
• measure, operate, target, and improve our advertising and marketing, including reaching new and similar audiences on third-party platforms;
• respond to your support requests and communicate with you;
• detect, prevent, and address fraud, abuse, security, and technical issues; and
• comply with legal obligations and enforce our terms.

Where required by law, we rely on the following legal bases: to perform our contract with you (operating your account and subscription), your consent (for certain cookies and advertising where required), our legitimate interests (securing, improving, and promoting the Service), and compliance with legal obligations.

3. Session analytics

We use PostHog and Cloudflare for product and web analytics. PostHog may capture recordings of how pages are used to help us diagnose issues and improve the Service; where such recordings are captured, typed input is masked. This helps us understand behavior and provide a better experience. You can limit our first-party analytics as described in section 4.

4. Cookies and tracking technologies

We and our partners use cookies, pixels, software development kits, local storage, and similar technologies to operate the Service, remember your preferences, keep you signed in, measure performance and usage, and support advertising. Some of these are set by us (first-party) and some by our providers and advertising partners (third-party), including TikTok.

You have choices. Most browsers let you block or delete cookies and clear local storage through their settings; doing so may affect how the Service works. For our first-party analytics (Cloudflare and PostHog), you can opt out at any time by setting analytics.opt-out to 1 in your browser's local storage. For advertising, see section 6. We honor recognized browser-based opt-out signals (such as Global Privacy Control) where required by law.

5. How we share information

We do not sell your personal information for money. We share information only as described here:

Service providers. We use vendors that process information on our behalf to run the Service: Supabase (database, authentication, and serverless functions), Stripe (payments), Cloudflare (hosting, content delivery, and analytics), Brevo (delivery of transactional email such as sign-in codes), and PostHog (product analytics). Each receives only the information needed to perform its function.

Advertising and measurement partners. We share information with advertising and measurement platforms, including TikTok, for advertising, analytics, and measurement purposes, as described in section 1. These platforms are independent controllers of the data they receive, may combine it with data they hold, and may use it to profile you across other sites and apps. This activity may be considered “sharing” or a “sale” of personal information for cross-context behavioral advertising under certain laws; see sections 6 and 7 for your choices and rights. See TikTok's privacy policy.

Legal, safety, and compliance. We may disclose information if required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of us, our users, or others, or to detect and prevent fraud, security, or technical issues.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.

6. Advertising and your choices

The Service supports interest-based advertising and measurement. You can limit this in several ways:

• adjust the ad-personalization settings in your TikTok account and other platform accounts;
• use your browser and device controls to block cookies, reset or limit your advertising identifier, and enable “Do Not Track” or Global Privacy Control signals;
• use industry opt-out tools such as the Digital Advertising Alliance (optout.aboutads.info) and the Network Advertising Initiative (optout.networkadvertising.org); and
• exercise your rights under section 7, including the right to opt out of the sharing or sale of your personal information where applicable.

7. Your rights and choices

Depending on where you live, you may have some or all of the following rights: to access the personal information we hold about you; to correct inaccurate information; to delete your information; to receive a portable copy; to object to or restrict certain processing; to withdraw consent; and to opt out of the sharing or sale of personal information and of targeted advertising. We will not discriminate against you for exercising these rights.

Access and portability. You can download a complete JSON export of your account data (profile, progress, favorites, sessions) at any time from your account page.

Correction. You can edit your display name and preferences on your account page.

Deletion. To delete your account and associated data, or to make any other privacy request, email support@dailyepoch.ai. We will respond within the time required by applicable law (generally within 30–45 days) and may need to verify your identity before acting. We remove account data from our systems within 30 days of a deletion request; Stripe retains transaction records as required by financial regulations, and we may retain limited information where the law allows or requires.

Opt out of sharing/sale and targeted advertising. You can opt out using the methods in section 6, by emailing us at the address above, or through a recognized browser opt-out signal where we are required to honor it.

EEA/UK and California. If you are in the EEA or UK, you may lodge a complaint with your local data protection authority. If you are a California resident, you have rights under the CCPA/CPRA, including the rights to know, delete, correct, and opt out of the sale or sharing of personal information; you may exercise them using the methods above.

8. Data retention

We keep your personal information for as long as your account is active and as needed to provide the Service, and thereafter as necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and for legitimate business purposes. Aggregated or de-identified information may be kept for longer.

9. Security

We take reasonable technical and organizational measures to protect your information: traffic is encrypted in transit (TLS), database access is restricted by row-level security so each user can read only their own rows, and subscription state can be written only by our payment webhook, not by browsers. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. International data transfers

We operate in the United States and use providers that may process information in the United States and other countries. If you access the Service from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States and elsewhere, where data protection laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers.

11. Children

The Service is not directed to children under 13 (or the higher minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

12. Third-party links and services

The Service may link to or rely on third-party sites and services (such as Google, Stripe, and TikTok). Their handling of your information is governed by their own privacy policies, and we are not responsible for their practices. We encourage you to review them.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “last updated” date above and, for material changes, take additional steps required by law, which may include notifying you by email. Your continued use of the Service after an update means you accept the revised policy.

14. Contact

Questions, requests, or complaints about this Policy or your information: support@dailyepoch.ai. This Policy is governed by the laws of the State of Delaware, United States. See also our Terms of Service.