Privacy Policy

Account information

You can create an account with Sign in with Apple, Google, or a six-digit code sent to your email. With Apple or Google we receive your name and email address from the provider. With a code, you give us your email address and type your own name. Your name is your display name within the app, and you can change it at any time. Your email is used for account recovery, for receipts and messages about your account, and for the mail described under "Email from us".

Where your reading lives

The app keeps your reading in a database on your own device: your reading list and log, your rankings, your laurels and streaks, your highlights and notes, your Commonplace Book, and how far through a book you are. That is why it opens instantly and works with no signal at all. The same records are mirrored to your account on our server, so that a new phone finds your reading again and the website shows you the same thing. Books you download and pictures the app has cached stay on the device and are sent nowhere.

Reading activity

To power features like streaks, laurels, reading stats, your own canon and your reading list, we store your reading activity. This includes which works you open, mark as read and save, your visit dates, your personal rankings, the passages you highlight and any notes you keep with them, the entries in your Commonplace Book, your progress through a book, and the minutes counted by the reading timer if you use it. We also keep the searches you make in the app, with what each one found, so we can see what readers look for and add what is missing; clearing your recent searches removes them from your device.

This data is tied to your account and protected by row-level security. It is shared only with the service providers named in this policy, for the features that need it.

If you dictate a Commonplace Book entry, your phone's own dictation turns your speech into text and nothing is recorded. The words you keep are stored like any other entry.

Push notifications

If you enable push notifications, we store your device token (provided by Apple's Push Notification service), your timezone, and your preferred notification time and frequency. Your timezone is also what decides when your own day turns over, so the work for the day arrives at your midnight rather than ours. We use this to send your daily notification and notifications about your streak, replies from the team and activity in the Salon, and we record that a notification was sent and whether it was opened. You can change your preferences or disable notifications at any time in Settings.

If you choose to add your date of birth, we store it so we can send you a short birthday greeting, and the Salon reads it to refuse a reader under 18. It is optional and used for nothing else.

AI features

Some features of The Daily Canon are powered by Anthropic's Claude: Bloomy (your literary companion), your reading summary, Reading Plans, Where You Left Off, the word definitions in the reader, the reading of what kind of reader you are, and Your Way In, the starting page Bloomy draws for a new reader. Most are Folio features. Without Folio you still get Your Way In and two free answers from Bloomy about a passage in the reader. Every one of them runs only when you choose to open it.

When you join, you may write Bloomy a short note about your reading life. It is optional. If you do, we send it once, with the goals and tastes you tapped, to Anthropic through our own server to draw Your Way In, and we keep the note and the page it produced on your account so you can return to them and so Bloomy knows how you arrived. Nobody else sees the note, it is used for nothing else, and it is deleted with your account.

When you use one of these features, we send the data needed to generate a response to Anthropic through our own server; the app never talks to Anthropic directly. For your reading summary, Reading Plans and the reader-type reading, that is your reading activity (works read, reading list, and rankings). For Where You Left Off it is the book and how far into it you have got. For a word definition it is the word and the book it was found in. For Bloomy, your display name, your notification time and the city in your timezone are sent, along with your conversation history so it can follow the thread of what you are discussing. Anthropic processes this data on our behalf and does not use it to train its models.

Your Bloomy conversations are stored in our database for two reasons: so you can return to them, and so that we can review conversations to provide support, keep these features safe, and improve how they work. We limit any such review to those purposes.

Looking out for readers

Messages to Bloomy and messages to the team pass through an automatic check for signs that someone may be in distress, so that we can point them towards help. Most are cleared by a pattern match on our own server. An ambiguous one is sent to Anthropic, with the conversation around it, for a second opinion. We keep a record against your account that the check fired, where, and what it concluded. That record never contains your words. The team can see a flagged message you sent to us, as it can any message you send us.

Folio and payments

If you subscribe to Folio or buy a book in the app, your payment is processed entirely by Apple through the App Store. We never see or store your payment details. Subscription status is managed by RevenueCat, which receives your app user ID and subscription entitlement. RevenueCat does not receive your name, email, or reading data. A book you buy on its own is recorded on your account so that you can keep opening it.

On the website, Folio, gifts and books are paid for through Stripe. Stripe receives your email address and the payment itself, with a reference that ties the payment to your account or your order, and we keep that link. Stripe collects your card details, and we never see or store them.

If you buy Folio as a gift, we store your name and email address, the recipient's name and email address, any message you write and the delivery date, and we send the gift through Resend, our email provider. We keep the code that was minted and, once it is used, the account that redeemed it, so that a gift can only be claimed once.

The Bookshop

If you buy something from the Bookshop, in the app or on the website, we collect the name and address it is going to, your email address for the receipt and, if you give one, a phone number for the courier. These go to Stripe with the payment and we keep them on the order. Your card details are collected by Stripe or Apple Pay and never reach our server. Stripe's software in the app also records how its checkout is used, as its own privacy declaration sets out.

We use these details to fulfil your order and to handle a return. A note of the order, with your address, comes to our own mailbox, which is hosted by Google, and your name and address go on the packing sheet and the parcel, which is carried by Royal Mail or another courier. Our book supplier, Gardners, receives only the titles we order. The same applies to a book box. Your orders are kept on your account, or on your device if you are not signed in.

Forms you fill in

• Student discount: your name, email address and message, which we read to decide. We ask for no documents. A code is sent to you by email and lasts 60 days.
• Schools: the school, your name, email address and role, the class size and your message.
• The book box survey: your answers and any note, with your app version and whether you hold Folio.
• Asking to be told when a book is in: your email address, the book and your country.
• How you found us: when you join, the app may ask how you heard about us and, if it was a creator, who. The answer is kept against your account and used to see what is reaching readers.

Email from us

We send service mail when we need to: receipts, gift deliveries and answers to your requests. The Canon Post, a letter on Sundays, goes to readers who ask for it, and we keep your address, where you signed up, the wording you agreed to and when. We may also occasionally write to account holders with a note about The Daily Canon, whether or not they subscribe to the Canon Post. Every letter and note carries an unsubscribe link. If you unsubscribe, we keep the address marked as such so that we do not write to it again. This mail is sent through Resend.

The Salon

The Salon is a set of rooms for readers aged 18 and over. Nothing in it changes for you unless you join. You join by making a calling card, or at a read-along's table by a tick that declares you are 18 or over and accepts the guidelines.

Your calling card

It holds a Salon username, your date of birth, your gender and, if you like, your country and a few words about yourself. We ask your date of birth to check that you are 18 or over and to show your age. It cannot be edited once given, and it is kept if you leave the Salon so that a refusal stays true. Your gender and country are shown on your card and used for nothing else: not for adverts, recommendations or analytics. When you make your card we also ask Apple whether you are 18 or over, and we keep the answer and the date we asked. A username you give up is held back for ninety days.

What other members see

Other members see your card: your username, the portrait you chose, your age and gender as you gave them (we do not check them), your country if you gave it, your reading tier and whether you are a Folio member. Your profile also shows the laurels you pinned, your leaves, the days you have visited, your words about yourself if you wrote any and, only if you switched it on, your top ten books. Only signed-in members aged 18 or over can see a card. It is not public, and nobody can sort or filter readers by age or gender. A member who knows your username can ask to be your friend or to write to you. Members never see your name, your email address or anything else from your account.

What you write

What you post on the board, in the Common Room, in a book club or at a read-along's table is seen by other members with your card. A notice on the board lasts up to 21 days. A Common Room post stays until you, the team or a block takes it down. Chats between reading partners or friends, and pigeon post letters, are between the two of you. All of it is stored on our servers and none of it is end-to-end encrypted. We do not record whether a chat message has been read, whether you are online or whether you are typing. For a letter we record the day it was first opened, and its sender is never told.

A notification from the Salon shows a username and a book, never anybody's words. Inviting someone to write uses Apple's contact picker, which gives the app only the person you choose. Their details stay on your phone, and the message is yours to send.

Photographs

A photograph you post in the Common Room or a book club is rebuilt on our server before it is stored, which removes its location and every other tag. It may then be sent to Anthropic for an automatic check, and a photograph that shows a child, nudity, violence, someone's details or an advert is held for the team to look at.

The filter, reports and blocks

Everything written in the Salon passes an automatic filter. It refuses links and a short list of slurs, and in most rooms it refuses contact details too. Between reading partners and friends, a phone number or email address may pass. We do not read chats or letters, except that when one is reported to us by the reader it was sent to, the team reads it, and for a message up to twenty before it and a few after, from both readers, including any deleted in the last thirty days.

If you report something, we keep the report, your reason and a copy of what you reported for twelve months if we act on it and ninety days if we do not. If you block a reader, we keep the block until you remove it, and they are not told.

Leaving

A chat message you delete is hidden at once and erased within thirty days. A line in a book club or a comment in the Common Room that you delete is hidden at once and stays on our servers, where no member can see it. A reading partner chat that has ended is readable by both of you for thirty days and then deleted. A friend chat closes when the friendship ends, and its messages are deleted thirty days later. If you leave the Salon, your card, your notices and your asks go; your date of birth, your username, your blocks and any decision the team made about you are kept, so that leaving and coming back changes nothing. What you already posted and wrote stays where it is, under your username, until you delete it or your account.

Crash and diagnostic reports

When the app crashes or hangs, we want to know. There is no third-party crash reporting service in the app: reports come from Apple's own MetricKit, which means they already follow the "Share with App Developers" setting on your phone, under Settings, Privacy & Security, Analytics & Improvements. If that is switched off, MetricKit tells us nothing.

The app also keeps a small record of how each launch ended, so that a crash MetricKit never reports still shows up to us as a launch that did not finish cleanly. Attached to a report is a short trail of the screens you were on and whether syncing succeeded, with everything after a question mark in an address stripped out before the trail is written. What is never in a report: any text you wrote, any passage you read, and anything you said to Bloomy.

Reports are stored in our own database and are linked to your account, so that when you write to us about a problem we can find what actually happened to you. They are never used for advertising, profiling, or tracking of any kind.

Importing your library

If you bring a library across from Goodreads or StoryGraph, the app gives you a short code and you upload your export file on a computer at thedailycanon.org/import. We read the titles, authors, dates and ratings in that file to match books against our catalogue and fill in your log. The uploaded file is not kept once the import has finished.

Messages to the team

If you write to us from inside the app, your message is stored with your account so that we can read it, answer it, and have the answer reach you. It also passes the check described under "Looking out for readers".

Appraisals

If you write an appraisal of a work and it is approved, other readers see it under your first name, with your surname's initial if you chose that. If you sign your appraisals with your Salon name, Salon members see that username instead.

Counting where readers are

Your country, region and city are worked out from your IP address by our host. No permission is asked and nothing precise is involved: an IP address resolves to a city at best. We use this in two ways. When you first use your account, we write it onto your profile, where it stays and is not refreshed, so that we can count readers by place. Separately, each recorded visit adds to a running count of countries and cities, held against nobody, which produces the totals we publish, such as the number of countries the app is read in.

Widgets, photos, the calendar and the microphone

The home-screen widgets read the day's work and whether Folio is active from a shared container on your own device, and nothing a widget shows is sent anywhere. Saving a quote card asks permission to add to your photo library, and adding a read-along's schedule asks permission to write to your calendar. Both are add-only: the app cannot read your photo library, and it cannot read the events already in your calendar. If you choose a photograph to post, the picker gives the app that photograph alone. The microphone and speech recognition are used only for dictation, when you ask for it.

The App Blocker

The App Blocker uses Apple's Screen Time controls. The apps you choose stay on your phone as sealed tokens, and nothing about which apps they are is sent to us. We do keep on your account whether the blocker is on, the settings you chose, that you gave Screen Time consent, and counts of your doors, your unlocks and the times you chose to read instead.

The painting on the Folio page

To choose between two paintings on the Folio page, the app compares your first name with a list held on your device. Your name is not sent anywhere for this, and the result is not stored.

Links and sharing

A tracked link or a printed QR code records the country and city it was opened from, the browser and the time, with no account attached. Opening a shared quote, recommendation or invitation records the country. If you share your personal link, we keep a scrambled form of your IP address so that your own taps are not counted. When someone opens it, we keep a scrambled form of theirs, with their country and browser, to count each person once.

The website, cookies and storage

thedailycanon.org counts page views with Vercel Analytics, which works without cookies and is not in the app. The site's fonts load from Google, so Google sees a visitor's IP address, and some of our emails do the same.

The site uses only the cookies it needs: to keep you signed in, to remember that your location has been recorded, and to remember which version of the site you are on. It keeps your bag, your reading progress, your preferences and your drafts in your own browser's storage.

Hosting and infrastructure

The app itself runs on your device and carries the canon inside it, which is why most of what you do in it needs no server at all. thedailycanon.org, hosted on Vercel, serves the website and the parts a phone cannot do for itself: the daily picker, the AI features, and the gate on library text. Your account data is stored in Supabase (database and authentication). Standard server logs (IP addresses, request timestamps) may be recorded by our hosting providers as part of normal operations.

What we don't do

• We don't use advertising or social media SDKs.
• We don't put an analytics platform of our own in the app.
• We don't use a third-party crash reporting service.
• We don't sell or share your data with advertisers.
• We don't use cookies for tracking purposes.

Who receives your data

These companies work for us and receive only what the parts of this policy above describe:

• Anthropic: the AI features, the check on messages and Salon photographs.
• Apple: sign-in, push notifications, App Store purchases and crash reports.
• Google: sign-in, the website's fonts and our own mailbox.
• Vercel: hosting, server logs and page counts.
• Supabase: our database, sign-in and stored photographs.
• Stripe: payments on the website and in the Bookshop.
• RevenueCat: subscription status.
• Resend: sending email.
• Royal Mail and other couriers: delivering a parcel.

We may also disclose information where the law requires it. Some of these companies process data in the United States and elsewhere outside the UK. Where they do, we rely on the UK's adequacy regulations or on the data protection terms those companies provide.

Why we are allowed to use your data

• To give you what you asked for: your account, your reading across devices, the features you open, your purchases and your deliveries.
• Your consent: the Canon Post, push notifications, and anything optional you choose to give us, such as your date of birth or a note to Bloomy. You can withdraw it at any time.
• Our legitimate interests: keeping readers and the Salon safe, fixing faults, counting readers, seeing what is working, and writing an occasional note to account holders.
• The law: keeping tax and accounting records, and answering lawful requests.

How long we keep it

• Your account, reading, Bloomy conversations, messages to the team, searches, reports of crashes and the check on messages: until you delete your account.
• The Salon: the periods given under "The Salon". A read-along table's messages are deleted ninety days after it closes.
• Orders, invoices and the records of a purchase: at least six years, which is what UK tax law asks of us.
• Gift codes, and student, school and book requests: until you ask us to remove them.
• An unsubscribe: for as long as we need to honour it.

Deleting your data

You can permanently delete your account at any time. In the app, open your profile, then Settings, then Advanced, then Delete Account, and type DELETE. On the website it is Settings > Advanced > Delete Account. You can also email us to request deletion.

Deleting your account does not cancel a subscription, so please cancel first. A subscription through Apple is cancelled in your Apple account. A subscription on the website is cancelled from your account on the website, or by emailing us.

Deleting removes your profile, reading history, highlights, Commonplace Book, conversations, laurels, diagnostic reports, Salon card and Common Room posts from our systems, and the words of any letter you sent or received are blanked at once. A few things stay, for the reasons given:

• Orders, with the name, email address and postal address on them, along with gift records, invoices and the records Stripe holds, stay because tax law requires them. Your account is removed from them.
• Your email address stays on any mailing list row until you unsubscribe or ask us to remove it, and student, school and book requests stay until you ask.
• Chat messages you sent in the Salon are held for thirty days so the reader they were sent to can still report them.
• Comments you left in the Common Room and lines you deleted in a book club stay with your account removed from them, and reports keep their copies for the periods above in the same way.
• The files of your Salon photographs disappear from view at once but may remain in our private storage until we clear them. Email us if you would like that done sooner.
• If the team suspended you, or you were marked as under 18, we keep a scrambled mark of your email address so that it cannot simply join the Salon again.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, object to how we use it, and ask for it in a form you can take elsewhere. Email us and we will answer within a month. If you are unhappy with how we have handled your data, please tell us first, and you can complain at any time to the Information Commissioner's Office at ico.org.uk.

Children's privacy

The app does not knowingly collect information from children under 13, and the Salon is for readers aged 18 and over. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Changes to this policy

If this policy changes, the updated version will be posted here with a revised date.

Contact

The controller of your information is Daily Canon Limited, registered in England and Wales under number 17424537, 18-22 Church Street, Malvern WR14 2AY. Questions about this policy can be sent to hellodailycanon@gmail.com