Privacy

What stays on your device

What the app remembers about your reading is stored on your device and is never sent to us, apart from what an account keeps (below):

• Your position in a book, plus your font size and theme choice. While you are signed in, your place in each book is also kept with your account, so another device opens it there.
• Books you import yourself. EPUB and PDF files you add to My Books are copied into the app’s private storage on your device. The files are never uploaded, and we never see their filenames. If you are signed in and keep a bookmark or a quote in one, your account stores what any bookmark stores — the passage or the opening of its paragraph, where it is, and the book’s title and author as the file gives them — together with a fingerprint of the file (a hash, from which the book cannot be rebuilt), so the same file on another device finds them again. Nothing else from the book is sent.
• On this website, EPUB files you add to My Books are kept in your browser’s own storage. They are never uploaded. Bookmarks and quotes you keep in them while signed in are stored as described above for the app, with the same fingerprint of the file.
• On this website, the shelves you sort books into (Want to Read, Currently Reading, Loved) are kept in your browser’s local storage.

Deleting the app, or clearing your browser’s site data, removes all of it.

If you make an account

Signing in is optional: every book and every recording can be read and heard without it. It exists so the library can know you next time, and it is what keeps your favorites. If you make one, we store:

• Your email address, which is what the account is.
• A name, if you choose to give one — it is only what we call you on your account page.
• A password, which we never see: it is hashed by Supabase, who handle sign-in for us.
• The picture you are shown as, if you choose one: either which of Estella's own portraits you picked, or a photo you uploaded. A photo is shrunk and cropped to a square, stored with our file host (Cloudflare), shown only to you, and deleted as soon as you replace or remove it, or delete your account. Choose neither and you are shown as your initials, and we store nothing.
• The bookmarks you keep while reading — for each one, which book it is in, where in the book, and the opening words of the paragraph, so the list can be read without opening the book.
• The quotes you keep, which are the same thing with the passage you selected stored alongside it — the words themselves, so they can be shown back to you and found again in the book.
• The books you star as favorites — which book, and when you starred it — so the shelf is the same on every device you sign in on. Unstar a book and it is gone.
• Where you stopped in each book you read while signed in — one place per book, replaced as you read on, so the book opens where you left it on your other device. It is the same handful of details as a bookmark: which book, where in the book, and the opening words of the paragraph. While you are signed in, we also keep which books you open on the website and when you last opened each, so Continue reading can show them with the most recent first.
• Whether you want our emails about new arrivals, promotions and campaigns — off unless you turn it on, on your account page or in the app, and you can turn it off there, or from the link at the foot of any of them, at any time. If you turn it on we keep when you did, as the record that you asked, and the language you were using, to write to you in; and for each email we send, that we sent it to you.
• The coming-soon books you voted for, so each counts once and you can take your vote back. Only the total is shown to anybody else; who voted is never shown.

That is the whole of it. What an account carries is what you did with a book — when you opened it, where you stopped, and what you kept — so that it is there on the next device you open the book on. Your shelves and the books you import stay on your device even when you are signed in: they are not uploaded, and an account does not move them from one device to another. Your browser also keeps its own place in every book you read, signed in or not. We email you the message that confirms your address and one that welcomes you once it is confirmed, and nothing else unless you ask for our news; we never sell or share any of it.

You can delete it yourself, at any time and without asking us: your account page on this site, or the account screen in the app. It goes immediately and for good, taking your bookmarks, your quotes, your favorites and your saved places with it, and nothing of it is kept. If you would rather we did it, ask us through the feedback form.

If you send us feedback

The feedback form stores what you write, so that we can act on it. Alongside the message we keep the topic you filed it under, the email address you give — which is optional, and only there so we can reply — and, if you happened to be signed in, which account it came from. Nothing else: not the page you were on, not your browser, not your device.

We use it to answer you and to fix what you told us about, and for nothing else. Ask us in a message and we will delete yours.

If you ask to hear when a book arrives

A book marked “coming soon” can be asked about. If you are signed in we use your account’s address; if not, we store the address you type, send it one email asking you to confirm, and nothing more unless you do. Once you have confirmed, we keep which book you asked about, your address, the language you were reading the site in, and when you asked and confirmed — and when the book arrives we send you one email and nothing else about it. Every request is deleted with your account, or by asking us through the feedback form.

What reaches our servers

To show the library, the app and this website request the book catalogue and book files from our servers over an encrypted HTTPS connection. Those requests carry no identifier for you or your device, whether or not you are signed in.

As with any website, our hosting and storage providers (Vercel and Supabase) keep short-lived operational logs of incoming requests, which include IP addresses. We use these only to keep the service running and secure, we do not use them to build a profile of you, and we do not combine them with anything else.

What we don’t do

Estella contains no advertising, no third-party tracking SDKs, and no social-network integrations, and the only analytics are the website’s, described above and off unless you allow them. We do not sell or share any information, and apart from what you choose to hand us — an email address, a message through the feedback form, a bookmark or a quote you keep, the page you stopped on — we gather none to begin with.

Children

Estella is suitable for all ages. Reading needs no account, and we collect no personal information from anyone — child or adult — who does not make one.

Changes

If this policy changes, the updated version will be posted on this page with a new date above.

Contact

Questions about privacy, or about Estella generally, can go through the feedback form. See also our support page.