Privacy and your data

What’s saved

Personal drafts, questions, supplied source notes, approved revisions, answer results, and refresh schedules are stored under your reader identity. Questions you approve for your bank do not become public library content.

Anonymous chapter practice

No account is needed for public practice. An HttpOnly browser cookie holds a short-lived session, the selected question variants and choice order, and your own selections or reveals. Its expiry is shown in the session. Anonymous answers are not stored as reader records, do not change personal schedules, and are not automatically imported when you sign in. Up to three practice cookies are retained; opening more can close an older browser session.

Session signing is not encryption. The cookie contains public source/version identities and compact selection state, not private notes, answer keys, or explanations. Hosting services may still process normal request metadata; this is not a promise of anonymous browsing to every infrastructure provider.

Accounts and cookies

When managed login is enabled, the login provider handles sign-in. We verify its signed identity and use an opaque, secure, HttpOnly session cookie. A separate short-lived cookie binds the sign-in request to your browser. Server-held sessions include a CSRF token to protect writes. Provider credentials never enter browser JavaScript. When email-code account linking is configured, the server holds an encrypted, short-lived provider access credential for consent, bounded to the browser session. Provider refresh tokens are discarded.

Application logout revokes that browser session. It doesn’t log your agent out or revoke its provider grant, and doesn’t promise to log you out of the provider or every other device. Expired authentication records are eligible for automatic storage cleanup; expiry is checked even before cleanup occurs.

Your agent and hosting

Your chosen agent receives question and grading context and supplies generated content. Its own provider’s data policies apply to those conversations. Configured AWS deployments store application data in DynamoDB; local development may use memory or a local database. Backups and service logs follow the hosting configuration.

Book covers and lookup

Available book covers load directly from Open Library. Its servers receive the image request and normal browser request metadata. Searching the reviewed library stays within this site; choosing Search Open Library sends your query to that service.

Recommendations and purchase links

Recommendations are reviewed book-level connections, not personalized using your private answers. No purchase is required to practice.

Supplied Amazon links may contain our affiliate tag. Clicking a paid link opens Amazon in a new tab, where its own cookies and privacy policies apply. We don’t run a redirect tracker or load Amazon scripts on these pages. Recommendation purchase links are marked before you click.

Owner quality reviews

Explicit owner reviews store the question/version identity and content fingerprint, reviewer identity, decision, optional issue note, and time, with an immutable revision history. Reviews don’t save anonymous practice answers. Publishing private questions requires a separate, explicit owner action. Review notes and status are currently shown only in owner tools.

Aggregate product counts

Optional server-side aggregate product measurement is disabled on this instance.

No ad network or tracking scripts

This website loads no advertising network, analytics script, or third-party font. A local-only ad layout preview may be displayed in development; it serves no advertisement and contacts no provider. No paid model call is triggered by a page view or quiz answer. Real advertising integration and its privacy/consent choices have not been implemented.

Retiring is not deleting

Retiring a question keeps its content, history, and schedule so it can be restored. Account export and deletion controls are not implemented in this prototype. Avoid storing sensitive personal information until those controls and a production privacy process are available.

Local development is different

Explicit development mode is for this computer, not a public service. It uses a configured local reader rather than a managed account and must not be exposed publicly. Lambda disables development identity.