Privacy Policy

The data controller responsible for your personal data is:

Vinyar
Finland
Contact: support@vinyar.app

We collect and store the following categories of data:

Account information — your email address, full name, an optional profile image (avatar), your subscription status, and trial end date.

Your reading content — the books you add to your library (title, author, cover, ISBN, page count, genre, publication year, reading status, your rating, your review, current page, start and finish dates), your journal entries (notes, quotes, and reflections, including page numbers), your reading sessions, and any reading goals you set. This content belongs to you.

Authentication data — your email address and a securely hashed version of your password. Passwords are hashed and managed by our authentication provider (Supabase Auth); we never see or store your password in plain text.

Billing data — a customer and subscription identifier from our payment provider (Paddle), your subscription product, price, status, and billing period dates. We do not collect or store your card number, CVV, or full payment details — these are handled entirely by Paddle.

We do not sell your personal data, and we do not use it for advertising or profiling.

We use a small number of trusted third-party providers to operate the Service. Each processes data only as needed to provide their function:

• Supabase (via Lovable Cloud) — database, authentication, and file storage. Your account and reading data are stored here.
• Paddle — our payment provider and Merchant of Record. Paddle processes your payment and is the legal seller of your subscription. See Paddle's privacy policy at paddle.com/legal/privacy.
• Lovable — the platform our application runs on.
• Google Books API — when you search for or add a book, the title or ISBN you enter is sent to Google's Books API to retrieve book details and covers. No account information is sent.

We may also disclose data where required by law or to protect our legal rights.

Account and reading data are hosted within the EU/EEA. Where any provider processes data outside the EEA, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

We use only what is necessary to run the Service:

• Authentication session — stored in your browser's local storage to keep you signed in.
• Theme preference — stored in your browser's local storage to remember light or dark mode.

We do not use advertising, analytics, or tracking cookies. Our payment and infrastructure providers may set cookies necessary for their own functions when you interact with them.

We keep your personal data for as long as you maintain an account. If you delete your account, your reading data, journal entries, reading sessions, goals, subscription records, and profile are permanently deleted from our database, and your authentication record is removed. We may retain limited billing records for as long as required by law (for example, for tax and accounting purposes).

You have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data (you can edit most of this directly in your account);
• Erase your data ("right to be forgotten") — you can delete your account at any time from Settings → Account, which permanently removes your data;
• Restrict or object to certain processing;
• Data portability — request a copy of your data in a portable format. While we do not yet offer an automatic export tool, you can request a copy by emailing us and we will provide it;
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at support@vinyar.app. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

We rely on industry-standard security measures provided by Supabase and Paddle, including encryption in transit, hashed passwords, and access controls. No system is completely secure, but we take reasonable steps to protect your data.

The Service is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has provided us data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for significant changes, notify you by email or within the Service.

For any questions about this policy or your data, contact us at support@vinyar.app.