Privacy policy

Who is responsible for your data

Toread is run by one person, in Taiwan. Their legal name is being added to this page. A postal address will be published here with it; until then email is the way to reach us, and every address below is read. Toread is the controller of the data described here. Questions and requests about your data: privacy@toread.app.

What we collect

• Your account. Your email address, used to send sign-in codes. Codes are stored encrypted and expire after five minutes. If you turn on two-factor authentication we also keep what that needs: the authenticator secret and your backup codes.
• When you signed up, and to what. The moment you agreed to the terms and which version was in force then — our record that you signed up under the line above the sign-in button, or pressed “Got it” on the notice that asked you.
• Your library. The links and files you save, the copy of each page Toread fetches from the link, and what is made from it: text, translations, summaries, categories and tags. Also your highlights, notes, folders and settings.
• Your sessions. Each sign-in writes a row with the IP address and browser user agent it came from. A session lasts 30 days; the row is deleted 7 days after it expires.
• Your subscription. If you subscribe to Plus or Pro, the sale is made by Lemon Squeezy, not by us. We keep only your plan, its status, its billing period, the date it is set to end if you cancelled, and Lemon Squeezy's customer and subscription ids. We never see or store card details, your billing address or your tax id.
• Accounts you connect. If you connect Bluesky or X under Settings → Saved elsewhere, we keep the account’s handle and display name, the access tokens the platform gives us (encrypted), and the posts you bookmark there, so they can wait in Bookmarks until you save or dismiss them.
• Newsletters. If you turn on a newsletters address, we receive the mail sent to it: the sender, subject, date and the message itself.
• Notifications. The notifications we show you in the app — about your library and your own account’s activity, such as a save that failed or an export being ready — and, if you turn on push notifications, the address your browser gives us for delivering them, the keys that encrypt them and your per-category choices.
• The waitlist. If you join the waitlist we keep your email address, the interface language you were using, your place in the queue, when you joined, the one-click token that takes you off the list, and a salted hash of your IP address — used for nothing but stopping one connection from filling the queue, and erased after 30 days. The rest of the row stays until you leave the list, which takes one click in the email. Each row also records whether it came from the form on the front page or from a list an operator imported, so we can always say how an address got there. When we are counting where people find Toread, a signup from the front page also records what brought you there: the source and campaign named in the link you followed (its utm_source and utm_campaign), or the name of the site that linked to us — its host, never the page on it or anything after it. That is read from the page request itself; no cookie or script is involved, and it stays on the row until you leave the list.
• Where you stopped reading, and what your devices need to stay in step. So an article opens where you left it on any of your devices, we keep, for each item you have read, how far through it you got and when. So a device that was away learns what changed, we keep a record of each item, folder, tag, highlight or note you delete — which one, and when — for 90 days; and so a change a device sends twice is only made once, the id it gave that change, for 30 days. All of it belongs to your account and is read only by your own signed-in session: the browser extension’s connection and a Raycast key cannot reach it. It is deleted with your account.
• On your device. A copy of your library kept in your browser, described below, plus a few interface conveniences in its local storage. The layout choices that have to be right on the first paint are cookies instead — see below.
• Which version of a feature you were shown. Only while we are testing a change — see Experiments.

Cookies

Every cookie Toread sets is strictly necessary or functional. There are no analytics, advertising or third-party tracking cookies, and nothing on this site loads a third party’s script — which is why there is no consent banner to click past. Signing in sets the first three; the rest remember a choice you made in the interface, and are cookies rather than local storage only so the first paint after you reload is the layout you left.

• better-auth.session_token — your session — this is what signs you in. Kept 30 days.
• better-auth.session_data — a short cache of that session, so drawing a page does not re-read the database every time. Kept 5 minutes.
• better-auth.two_factor — only if you use an authenticator app: it holds the half-finished sign-in while you type the code. Kept 10 minutes.
• sidebar — the width of the sidebar, and whether you collapsed it. Kept 1 year.
• folders-collapsed — which folders you collapsed. Kept 1 year.
• viewport — which of three window widths you are at, so the right layout is drawn. Kept 1 year.
• tz — your time zone, so dates and "Good evening" are right. Kept 1 year.
• locale — the interface language, if you chose one. Kept 1 year.
• brief-dismissed — which brief cards you dismissed on Home. Kept 1 year.
• brief-position — where you got to in the last brief you played. Kept 30 days.
• terms-accepted — only if you were shown the terms notice: that you pressed "Got it", so it is not shown again while your session catches up. Kept 15 minutes.

The three sign-in cookies carry a __Secure- prefix in production and cannot be read by scripts. Before you have visited once, there is no time-zone cookie to read, so the server falls back to the rough time zone Cloudflare derives from the connection.

What Toread keeps on your device

When you are signed in, Toread keeps a copy of your library in your browser, so it opens quickly and works without a connection: your items’ titles, addresses and folders, your tags, highlights and notes, and where you stopped in each. The browser’s service worker also keeps copies of pages you have opened in Toread. If “Keep saved articles on this device” is on, it keeps the full text of your saved articles and their pictures as well, newest first, up to 200 articles or 500 MB. That switch is in Settings → Appearance → This device; it is on by default in the app added to your Home Screen and off in a browser tab.

This copy is only on that device, in that browser profile, and it is not encrypted beyond whatever the device itself does — anyone who can use that browser profile can read it, as they could read Toread in it while you are signed in. Signing out deletes all of it from the device, before the sign-out is even sent to us; deleting your account signs you out, and the page you land on deletes it the same way. On a browser shared between accounts, signing in as someone else deletes the previous account’s copy first.

Settings → Appearance → This device shows how much space it takes, lets you turn off keeping articles, and has “Remove downloaded articles”, which deletes the stored articles and pictures and leaves the rest of the copy, which signing out removes. Your browser can also clear it at any time, as it can any site’s storage; Safari does so on its own after seven days without a visit in a browser tab.

The browser extension

The extension only acts when you click its button or press its shortcut.

• When you open it, it reads the address and title of the tab you are on, using the browser’s activeTab permission, and asks Toread whether that address is already in your library. Nothing is saved.
• When you press Save, it sends that address and the folder you picked. Toread’s servers then fetch the page.
• It stores, in the extension’s own local storage, the connection token Toread gives it when you connect and the folder you used last.
• It never reads the content of the pages you visit, records your browsing history, runs on pages by itself, or talks to any server other than toread.app.

Its permissions are activeTab (the current tab’s address and title, only after you click), storage (the token and last folder), identity (the window where you approve the connection on toread.app) and access to toread.app.

For each connected browser we keep a name such as “Chrome on macOS”, taken from the browser at the moment you connect, when it was connected and last used, and how many saves it made. The token itself is stored only as a one-way hash.

Toread for Raycast

Raycast uses an API key you create in Settings → Extensions and store in Raycast. When you run Save Tab it reads the address and title of your browser’s frontmost tab, and sends the address only when you save. Save Link sends the address you enter. Recent Saves lists your newest saves.

How we use it

Only to provide Toread: saving and processing what you choose, showing you your library, sending sign-in codes, and running your subscription. We do not use your data for advertising, sell it, build profiles from it, use it to determine creditworthiness or for lending, or use it for anything unrelated to Toread.

To see that Toread is working, the service also records operational counts — such as how a sync of a connected Bluesky or X account went, how the check for deleted posts is keeping up, and, when the app has had to open pages from the device copy, how many it opened offline and how many it could not, with the app’s version and whether it was the installed app. Some of these carry an id: your Toread account id for the offline counts, or a connected account’s internal id for its syncs. None carry what you saved or read, or which pages. They are kept in Cloudflare’s analytics store, which deletes them after 3 months, and are read only by us. This is not analytics in the tracking sense: nothing is loaded into your browser for it, and nobody else receives it.

Why we are allowed to (legal bases)

Where the GDPR or a law like it applies: running your account and your library is the performance of our contract with you. Keeping the service standing up — rate limits, the salted IP hash on the waitlist, stopping abuse, the operational counts — counting where waitlist signups came from, and finding out whether a change actually helps before everyone gets it (experiments) are our legitimate interest in a service that works and that people can find, weighed against how little each of them takes and keeps. You can object to any of them by writing to us. Push notifications and the waitlist email are consent, which you can withdraw at any time by turning push off in Settings → Notifications or by clicking the one link in the waitlist email. Where a law requires us to keep something, that obligation is the basis for keeping it.

Experiments

Sometimes we try a change to a feature — a different layout, a new default — by showing it to a share of signed-in readers and comparing, before deciding whether everyone gets it. Which version you get is worked out from your account id, so it stays the same for as long as the experiment runs. The first time you are shown one, we record your account id, the experiment, which version you saw and when. That record is used only to keep you on the same version and to count, across everyone in the experiment, whether the change helped — measured from what your account already holds, such as how many things were saved or highlighted in the days after. The result we keep is those totals, never a list of readers.

The records are deleted 90 days after the experiment ends. If you delete your account before then, your id is removed from them straight away; what is left is only that someone was shown that version. Nobody outside Toread receives any of it.

AI processing

The text of each page you save is sent to the provider running that job, under Toread’s own API keys, to translate, summarise, file and — for the daily brief — write and read aloud. What a model writes is labelled “AI-generated” wherever it appears: in the interface, in the Markdown and llms.txt outputs, and inside the brief audio itself. It can be wrong, and it is not advice. More about AI in Toread.

Who else processes it

• Cloudflare runs Toread: the servers, the database, file storage, sending our email, turning PDFs into text, and the analytics store that holds the operational counts described above.
• An AI model provider receives the text of each page you save: the provider behind the model your plan or your settings use, which may be Anthropic, OpenAI, Google, DeepSeek, xAI, Mistral, Groq, OpenRouter, Vercel AI Gateway, or an OpenAI-compatible endpoint the operator of this Toread has configured (named on Settings → Models). It receives the page text, not your email address. The daily brief’s voice is generated by OpenAI, Google or xAI.
• TypeSafe receives the text of a page you save, with its summary’s key points, to work out which paragraph each key point came from. It receives the page text, not your email address.
• Lemon Squeezy is the seller of any subscription you buy — the merchant of record. It takes your payment details, name, billing address and tax id directly, charges and remits the tax, and issues the invoice. We send it your email address and your Toread user id, and nothing else.
• Bluesky and X receive requests from Toread only if you connect an account: to sign you in to it, to read the posts you bookmark there, to check whether those posts still exist, and to revoke our access when you disconnect.
• Your browser’s push service (such as Apple, Google or Mozilla) delivers push notifications if you turn them on. Each one is encrypted so only your device can read it.

We share data with no one else, except where the law requires it.

Where it goes

We are in Taiwan; most of the infrastructure and every processor above is US-based or runs on a global network. So your data is processed outside your country, and outside the EEA and the UK, including in the United States. Where the law requires a safeguard for that transfer, we rely on the standard contractual clauses in our processors’ own terms.

Newsletters and remote images

Mail sent to your newsletters address arrives with tracking pixels and remote images stripped or held back, so opening an issue tells the sender nothing. If you press “Show images”, your browser fetches them from the sender’s own servers, which lets the sender see your IP address and that you opened it. That choice is yours and it lasts only for that visit.

Posts from Bluesky and X

Toread runs a rota that re-checks every stored post against its platform, normally within a day. A post that has been deleted, made private or whose author was suspended is confirmed gone on a second check and then has its text, author details, pictures and everything derived from them erased — usually within a day of our noticing — leaving only a note that it was deleted and a link to where it was. Bookmarks you never saved are dropped after 30 days. Disconnecting an account revokes our access and deletes its tokens.

How long we keep it

We keep your library while your account exists. Everything else has a clock on it:

• A newsletter issue you never saved: its stored copy is deleted 90 days after it arrived. The record that this publication wrote to you on that date stays, because it is yours.
• A session: 30 days, then the row and the IP address and user agent on it are deleted 7 days later.
• A waitlist signup’s IP hash: 30 days.
• An unsaved Bluesky or X bookmark: 30 days.
• The record that you deleted something, kept for your other devices: 90 days. A device away for longer fetches your whole library again instead.
• The id of a change a device sent: 30 days.
• An experiment’s records: 90 days after the experiment ends.
• An export archive: 7 days.
• Operational counts: 3 months, by Cloudflare’s own limit.

Deleting your data

Deleting an item deletes the stored copy of the page, its indexed text, its translations, the rewritten versions of it, the pictures from its body and its cover, straight away. “Delete all items” in Settings → Data does that for every item, and also deletes the stored copy of every newsletter issue and the marks taken from them; the record that an issue arrived — who sent it, its subject and the date — stays until you delete your account. Deleting your account in Settings → Account deletes everything: items, highlights, notes, folders, tags, feed subscriptions, newsletters, connected accounts, browser and Raycast connections, notification and brief settings, your briefs and their audio, your reading positions and sync records, your export archive, and your sessions; it removes your id from any experiment’s records, and the copy on the device you deleted it from.

Three honest exceptions. Toread stores one copy of a page’s contents for everyone who saved it, so if another reader still has the same copy saved, that copy stays until the last of them deletes it — yours is no longer reachable either way. Deleting your account cancels your subscription, but Lemon Squeezy is the seller and keeps its own customer, order and invoice records for as long as the law requires it to. And to make an item open quickly, Toread keeps the assembled reading copy on Cloudflare’s network close to where you read it; deleting removes the one where the deletion is processed, and a cached copy at the network edge expires within a day.

You can also delete any single item, disconnect any browser or revoke any key in Settings → Extensions, and disconnect Bluesky or X in Settings → Saved elsewhere, which revokes our access and deletes that account’s tokens and waiting bookmarks.

Taking your data with you

Settings → Data has “Export everything”, which builds a ZIP of your library in the background and notifies you when it is ready: one Markdown file per item with its text, any translation, the summary and key points the model wrote, and your highlights and notes; a library.json with every item’s address, title, category, tags, folder and dates, your folders and tags; an account.json with your account details, settings, sessions (with their IP address and browser), browser and Raycast connections, notification and brief settings, your briefs’ scripts, connected Bluesky and X handles, and your newsletter senders and issues; and the blogs you follow as OPML. Both JSON files say which fields a model wrote. Nothing in the archive is a credential: no tokens, keys or codes. The archive is kept in our storage under your account for 7 days, then deleted by a sweep that runs every hour; deleting your library or your account deletes it straight away. Any single item’s text is also one click away as Markdown from its own page.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask for it in a portable form, and object to or ask us to restrict a particular use. Most of it you can do yourself and immediately: export in Settings → Data, delete in Settings → Data or Settings → Account. For anything else, write to privacy@toread.app and we will answer within a month.

If you are in the EEA or the UK you may complain to your local data protection authority. If you are in Taiwan, the PDPA gives you rights to enquire, review, obtain a copy, correct, and ask us to stop collecting, processing or using your data, and to delete it. If you are in California: we do not sell or share your personal information, and nothing here is a sale or a share as that law defines it.

Security

Everything travels over HTTPS. Sign-in codes are stored encrypted. Connection tokens and Raycast keys are stored only as SHA-256 hashes, so a read of the database cannot hand out a working one. The access and refresh tokens for a connected Bluesky or X account are encrypted at rest with a key derived per account, so one account’s ciphertext cannot be opened in another’s place. Every request for your data is checked against your account. If something goes wrong anyway, we will tell the readers affected and the relevant authority without undue delay, where the law requires it.

Children

Toread is for readers aged 13 and over, and is not directed at children under 13. We do not knowingly collect their data. If you believe a child under 13 has an account, write to privacy@toread.app and we will delete it.

Changes and contact

If this policy changes, the date at the top changes with it, and we will tell you in the app or by email before a change that materially affects you takes effect. Questions or requests about your data: privacy@toread.app. Toread · toread.app.