Privacy Policy
What we hold, and who else ever sees it
Reading notes are among the more revealing things a person writes. They record what you were thinking about, and when, and what you did not say out loud. This page is specific about where all of that goes.
The short version
- We do not sell your data, and we do not advertise against it.
- Your notes are never used to train an AI model, by us or by anyone we use.
- There are no analytics and no trackers. No Google Analytics, no pixels, no session recording, no product analytics of any kind.
- The clustering runs on our own machine. Your writing is turned into numbers locally and never sent to an AI provider.
- You can export everything and delete everything, and deletion means deletion, with backups aged out within 30 days.
IWho is responsible
Anphase Ltd, based in Auckland, New Zealand, is the agency responsible for your personal information under the Privacy Act 2020. If the GDPR applies to you, Anphase Ltd is the data controller.
Privacy questions go to privacy@writingread.com and are answered by a person, because there is only one.
IIWhat we collect
What you write
Your note blocks, the books you shelve, reading statuses and dates, corrections you make to catalogue records, books you remove and restore, and any expansions you write against a block. This is the heart of it, and it is the most sensitive thing we hold.
If you import from Apple Notes, the import runs on your own computer and sends us the notes you chose to bring. We do not have access to your Apple Notes, your device, or anything you did not import.
What an account needs
An email address, so you can sign in and so we can reach you about the service. Sign-in is handled for us by a specialist authentication provider, which verifies your email and issues the session that lets you through to your library.
What a web server sees
Requests to writingread.com are logged by our hosting provider in the ordinary way a web server logs them: IP address, time, the page requested, and a user-agent string. These exist to keep the service running and to stop abuse. They are not joined up into a profile of you, and they are not used for analytics.
What we deliberately do not collect
No advertising identifiers. No cross-site tracking. No behavioural analytics. No location beyond whatever a country-level IP lookup implies. No contacts, no calendar, no files other than the notes you bring.
IIIWhy we hold it, and on what basis
| What | Why | GDPR basis, if it applies to you |
|---|---|---|
| Notes, books, blocks | To provide the library. This is the service. | Contract |
| Email address | To sign you in and contact you about the service | Contract |
| Server logs | Security, abuse prevention, keeping it working | Legitimate interests |
| Embeddings of your blocks | To cluster, shelve and connect what you wrote | Contract |
| Backups | So a mistake or a failure does not lose your writing | Legitimate interests |
Under the Privacy Act 2020, we collect this from you directly, for the purposes above, and we do not use it for an unrelated purpose without asking you first.
IVThe AI question, answered specifically
"We use AI" covers arrangements that are nothing like each other, so here is exactly what happens.
Clustering and connections run locally. Every block is turned into a vector by a small open model that runs on our own machine. Those numbers, and the neighbour links computed from them, never leave our infrastructure. No AI provider is involved at any point in producing your shelves or your constellation.
Book blurbs use a language model, and it never sees your notes. Where a public catalogue has no description of a book, we ask a model to describe the book from its title and author. Your blocks are not in the prompt. The model is asked to return nothing rather than guess, and a book we could not describe stays blank rather than getting an invented description.
Nothing you write trains anything. Not our models, not a provider's. Where we use a third-party model we use it on terms that exclude training on the input.
VWho else is involved
The list is short, and it is the whole list.
| Who | What for | What they get | Where |
|---|---|---|---|
| Hosting and infrastructure | Running the service: servers, database, file storage, protection | Everything, as the provider our systems run on | Global |
| Authentication | Verifying your email and issuing your session | Your email address | Global |
| Public book catalogues | Book records and cover art | A book title, author or ISBN we look up. Never your notes. | Mainly United States |
| An AI provider | Blurbs about published books | A book title and author. Never your notes. | United States |
| Web fonts | The typefaces these pages are set in | Your IP address, when your browser fetches a font | United States |
Two things worth drawing out. Catalogue lookups happen when a book is added, and they carry a book title, never a line of your writing. And once we have fetched a cover we keep our own copy and serve it ourselves, so browsing your shelf does not tell a catalogue what you read.
The exception is the fonts, which your browser fetches directly from their provider and which therefore reveal your IP address to it. That is the one third party your browser contacts while you use the site, and we mention it here rather than leave you to find it in a network tab.
VISending information overseas
We are in New Zealand and our infrastructure is not. Our hosting provider stores and serves data from locations around the world, and the catalogue services are mostly in the United States.
Under Principle 12 of the Privacy Act 2020 we only send personal information overseas where the receiving party is subject to comparable safeguards, which for our providers rests on their contractual commitments and, where relevant, standard contractual clauses. If you are in the EU or the UK, note that New Zealand holds an adequacy decision from the European Commission, so your information coming here does not need additional safeguards; onward transfers rely on the clauses in our providers' terms.
VIIHow long we keep things
- Your notes and books: until you delete them or close your account.
- After you delete: removed from the live service immediately. Backup copies age out within 30 days, after which they are gone.
- Server logs: retained by our hosting provider on their standard schedule, which is a matter of days, not years.
- Email correspondence: kept while it is useful to have the thread, and not longer than two years.
One deliberate exception. Removing a book from your shelf leaves a tombstone: a record that this book was removed, and when. It exists because without it the next sync would cheerfully put the book back. It holds no note content. Deleting your account deletes it along with everything else.
VIIIKeeping it safe
Access to the library requires a verified sign-in, and the application checks that sign-in itself rather than assuming someone else already did. Everything travels over HTTPS. Writes are checked to make sure they came from the app rather than from another site that happened to be open in your browser. Only one person has administrative access, and that access is used for operating the service, not for reading what you wrote.
No service is perfectly secure. If a breach happens that is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as the Privacy Act requires, and we will tell you what we actually know rather than what sounds best.
IXYour rights
Under the Privacy Act 2020 you can ask for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. We will respond within 20 working days.
Most of this you can do without asking. Export gives you your notes in a form you can keep. Corrections to titles, authors and years are yours to make in the app, and they hold against everything the catalogue later says. Deletion is a button.
If the GDPR or UK GDPR applies to you, you also have rights to erasure, restriction, portability, and to object to processing based on legitimate interests. Write to us and we will do it.
If you are not satisfied with how we have handled a privacy matter, you can complain to the Office of the Privacy Commissioner in New Zealand, or to your local supervisory authority if you are in the EU or the UK.
XChildren
writing|read is not for people under 16, and we do not knowingly collect their information. If you believe a child has an account, tell us and we will remove it.
XIChanges to this policy
If we change something that materially affects how your information is handled, we will tell you before it takes effect rather than quietly revising this page. The date below is always current.
XIIContact
Anphase Ltd, Auckland, New Zealand.
privacy@writingread.com
Last updated 30 August 2026 · Effective 30 August 2026