Privacy Policy

This policy covers two groups of people: visitors of websites that use Coldreader, and Coldreader customers. It is written to be read, not skimmed. The controller for customer data is Filip Johansson, sole trader, Sweden. Contact details are in the footer.

1. Visitors of websites that use Coldreader

If you are reading this because a website you visited uses Coldreader, this section is for you.

What the script sends

When a page loads, the Coldreader script sends one request containing: the site's Coldreader ID, the page path without query string, the address of the referring page, and the width of the browser window. It sets no cookies, writes nothing to local storage, and reads nothing from your device.

What we store per pageview

  • The time of the pageview.
  • The site ID.
  • The page path, with query strings removed.
  • The hostname of the referring site only, with the path and query string removed. Referrals from the site itself are discarded.
  • A device class (mobile, tablet or desktop), a browser family (for example "Firefox"), an operating system family (for example "Android"), and a screen-width range (for example "768 to 1023 pixels"). We never store version numbers or exact sizes.
  • A two-letter country code, derived from the IP address's range using a database held in memory.
  • A visitor hash, described below.

What we do not store

Your IP address and your user agent string are processed in memory for a few milliseconds and are never written to a database, to log files, or anywhere else. Our web server's access logging is disabled for this reason.

The visitor hash

To count how many different browsers visited a site on a given day, we compute a SHA-256 hash of the site ID, your IP address, your user agent, and a random salt. The salt is generated fresh every day and the previous day's salt is deleted. The hash therefore cannot be reversed or recomputed after the day ends, by us or by anyone else, and cannot link your visits across days. We consider the stored data to be anonymous, but we describe it here for completeness.

Legal basis and your rights

The website operator, not Coldreader, decides to use analytics on their site and is the controller for that decision. Coldreader acts as their processor and processes the request data only to produce aggregate statistics. Because no stored data can be linked to you, there is nothing we can look up, export, correct, or delete for an individual visitor. If you have questions about a specific website's use of analytics, please contact that website.

2. Coldreader customers

If you have a Coldreader account, this section is for you.

What we collect

  • Your email address and a salted hash of your password. If you sign in with GitHub or Google, we receive your verified email address from them and nothing else.
  • The domains of the websites you add.
  • Session tokens so you stay logged in, stored in a cookie on coldreader.io only.
  • If you subscribe: a Paddle customer ID, a Paddle subscription ID, and the subscription status. Paddle collects and stores your payment details and billing address under its own privacy policy; we never see your card number.
  • Emails you send us, to answer them.

Why

To provide the Service, to bill you, to let you log in, and to respond to support requests. The legal basis is the contract between us, and for support correspondence our legitimate interest in answering you.

Where

Data is stored on servers in Frankfurt, Germany, operated by DigitalOcean. Paddle is based in the United Kingdom and processes payments under its own safeguards. We do not transfer customer data outside the EU and UK.

How long

For as long as you have an account. Deleting your account from the settings page deletes your account record, your sites, and all statistics immediately. Paddle retains transaction records for as long as tax law requires them to.

Your rights

You can access and correct your email address and sites in the dashboard. You can delete everything yourself. You can object to processing, request a copy of your data, or complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority. Email us for anything you cannot do from the dashboard.

3. Cookies on coldreader.io

The coldreader.io website itself sets one cookie, the session cookie, when you log in. It is necessary for the dashboard to work and needs no consent. We use Coldreader to measure traffic to coldreader.io, which sets no cookies.

4. Changes

We will update this policy when the Service changes. The date at the top shows the current version. Material changes will be announced to customers by email.