Privacy
Unread is built so that it needs very little about you, and so that what it does hold is yours to export or delete at any time. No analytics, no advertising, no third-party trackers.
What is stored
| Data | Where | Why | How long |
| Your position in a title (a beat index, the tier, whether you finished) | Store (local JSON or Supabase) | So recaps and the companion stop at the right place | Until you delete it |
| Reading ledger (one row per day: date, beats advanced) | Store | For the pace forecast and the Markdown ledger export | Until you delete it |
| Predictions (your text, the position it was written at, the score once you finish) | Store | The prediction journal | Until you delete it |
| Clubs you created or joined, and messages you posted (text, your display name, your position at the time) | Store | The spoiler-safe club | Until you delete your data; the club itself stays for other members |
| "That spoiled me" reports and corrections you submit | Store | To fix ladders for everyone | Kept with the ladder, without your identity once you delete your account |
| Display name | A cookie in your browser | Shown in clubs | Until you clear it |
| Anonymous id (local mode only) | An httpOnly cookie | To tell your browser apart from another one | A year, or until you clear it |
| Email address (Supabase mode only) | Supabase Auth | Magic-link sign in | Until you delete your account |
| Ladders (story beats for a title) | Store, shared | Built once for everyone; contain no user data | Indefinitely |
| Tripwire log (work, tier, position, the spans removed) | Store, server only | To catch spoiler leaks; contains no user id | Rolling, last 1000 entries |
| Readers on your account (a name each) | Store | Household mode: separate positions per person | Until you remove the reader or delete your data |
| Shared recap links (the recap text, the position, your reader id) | Store, public by link | So a friend can read a spoiler-safe recap | Until you delete your data |
| Digest subscription (on/off, an unsubscribe token) | Supabase only | The weekly counts-only email | Until you turn it off or delete your account |
| Subtitle timings (seconds per beat, which episodes are timed) | Store, shared ladder | The TV Exact tier | With the ladder; the subtitle text itself is not stored |
Imports from Kindle, Kobo and Audible are parsed in your browser; only titles and a percentage, page or location are sent to propose a position, and highlights, notes and listening history stay in the file. Subtitle files are parsed in your browser too; cue text is sent once for alignment and discarded.
Your uploaded EPUB is parsed in your browser. Only the plain chapter text is sent once, to build the Exact ladder, and the file itself is not stored unless you explicitly choose Supabase Storage in a future version. Unread keeps a short hash of the text to label the ladder's provenance.
What is sent to the model
Every generation (recap, cast list, open threads, companion answer, prep brief, parent guide) sends:
- A fixed system instruction (the text is in prompts/ and shown in the "What was sent" panel on every result).
- The beats of the ladder up to your position only. Nothing beyond it is sent.
- For the tripwire check, the full ladder and the generated text, so that a second pass can catch leaks. The tripwire never sees your identity.
- Your question, for the companion, and your previous turns in the same conversation (up to ten).
- Your quiz answers (which character names you said you remembered).
Nothing else: no email, no id, no reading history, no other titles. Prompts are versioned so you can see exactly which text produced a result. With the Stub provider, nothing leaves the server at all.
Metadata lookups
Searching sends your query to Open Library (books) and TMDB (TV and film), or to Google Books when a key is configured. These services see the query and your IP address. With UNREAD_METADATA=fixtures nothing is sent.
How to export or delete
Open Account. "Export JSON" downloads everything above that is tied to you. "Delete everything" removes it immediately and signs you out. In local mode this also clears the cookie, so you become a new reader. Ladders are not deleted because they contain no user data; corrections you contributed stay attached to the ladder but lose their link to you.
Cookies
Unread sets at most three cookies: the anonymous id (local mode), the display name, and the Supabase session (Supabase mode). None are used for tracking.