Privacy

Last updated 23 August 2026

RisoRead holds your library and your reading: the books you keep, the passages you marked, and the page you stopped on last night. What somebody reads is more sensitive than most software has to handle, and this page is meant to be read rather than agreed to.

The short version

Your books are visible to the people you invite onto your shelf, and to nobody else.
Where you got to in a book, and what you bookmarked, is visible to you alone.
Our admin console cannot query your content. That is enforced by the database, not by policy.
We do not train models on your books, sell them, or share them with advertisers. There are no advertisers.
Our engineers hold infrastructure credentials that could technically reach stored data. What we do about that is below.
You can download every book and delete everything, without asking us.
RisoRead and RisoDesk are one account and one database, so everything here describes both.

What we store

Account records. Your email address, your name if you give one, an encrypted password, the labs you belong to, your plan and what was charged for it. Sign-in times, so you can spot an account being used by someone else.

Your content. Uploaded PDFs and EPUBs, the metadata read out of them, reading positions, bookmarks and the notes on them, tags and folders. If the same account also uses RisoDesk, its papers and manuscripts are in the same database, under the same rules.

Operational records. Error traces and request logs, which may contain identifiers such as a document id, and are kept for 30 days. Short links you create record a count of how often they were followed, and not by whom.

Your activity record. So that the usage page can show you your own year, we count how many things you did on each day: a book added, a bookmark written, a day on which you read something. The granularity is a day and that is deliberate — there are no timestamps, so it cannot say when in the day you read, and there are no targets, so it cannot say which book. It is readable by you and by nobody else: not other people on your shelf, and not our admin console, which has no query path to it.

We do not measure time on page, hours logged, or sessions. Doing that would need a feed from your browser reporting that you are still there, and we would rather not know.

What we deliberately do not store. No analytics or advertising trackers on any page, signed in or out. No profile of you assembled for anyone else’s benefit. No record of how long you spent on a page, or which pages you lingered on, beyond the single reading position you asked us to remember so you could pick up where you left off — which is yours alone and is not visible to others on your shelf.

What our administrators can see

This is the part usually written vaguely, so here it is exactly.

RisoRead is multi-tenant, and every row of content in the database carries the id of the lab it belongs to. Postgres row-level security decides, on every single query, whether the person asking is a member of that lab. An administrator account is subject to the same check as anyone else — there is no administrator exemption in any content policy. Not one that is switched off; one that was never written.

The admin console — which lives in RisoDesk, not here — reads through three database functions that return account records and aggregate counts. They return numbers. Asked how many books a lab holds, they answer with a number. There is no function that returns a book, a title, a filename or a file, and the console has no other way to ask.

Concretely: an administrator can see that a lab is called Chen Lab, is on the lifetime plan, has four members, 62 books and 4.1 GB stored. They cannot see the title of a single one of them.

Where that claim stops

RisoRead is not end-to-end encrypted, and any product offering these features while claiming to be is describing something it has not built. Our servers process your files because that is what the features are:

PDFs are rendered to images page by page on our servers, so they display on a phone.
EPUBs are unpacked and their chapters sanitised before being shown.
When you ask for tag suggestions, the book’s title, description and a short opening extract are sent to Anthropic’s API. Anthropic does not train on it, and nothing is sent unless you ask.
Backups are taken of the whole database, and someone has to be able to restore them.

So: our engineers hold credentials that could read stored data. We hold them because a service nobody can restore is a service that loses your work the first time a disk fails. What we commit to is narrower and, we think, more honest than a promise we could not keep:

No product surface exposes your content to us. Reaching it requires deliberately going around the application.
We access stored content only when you ask us to for support, when required to keep the service running, or where the law compels us.
We will tell you if we are legally compelled to hand over your data, unless we are forbidden from telling you.
Your work is never used to train any model.

Who else touches your data

Supabase hosts the database, authentication and file storage. Cloudflare R2 stores uploaded books. Anthropic processes the extracts you send for tag suggestions, and does not train on them. That is the list. There is no analytics vendor, no advertising network and no data broker in it.

Leaving

Every book downloads as the file you uploaded, byte for byte, from its own page. Nothing about that is behind a paid plan, and none of it requires a support request. Deleting your lab deletes its content, and backups age out within 30 days.

Asking us anything

Write to privacy@risoread.com. If you are in a jurisdiction with rights of access, correction, portability or erasure, those rights apply to you here, and the export and delete controls in the product are the fastest route to most of them.

The terms of use cover what we each owe the other.