Privacy Policy

This Privacy Policy explains how Sideways Lab ("we", "us", or "our") collects, uses, shares, and protects information when you use ChapterUp, our gamified reading app for iOS and Android. It supplements our general Sideways Lab Privacy Policy; where the two differ, this ChapterUp policy governs the app.

1. Who We Are

Sideways Lab Ltd is the data controller for the personal data described in this policy — we decide why and how it is used. We are registered in England and Wales under company number 17139067, with a registered office at Apartment 405 Manor Apartments, 2-4 Manor Row, Bradford, BD1 4AZ.

For any privacy question or to exercise your rights, email [email protected] or write to us at the address above.

Responsibility for data protection at Sideways Lab Ltd sits with our Privacy Officer, who can be reached at [email protected] or at the registered office above. Requests and complaints reach a person, not an unmonitored inbox.

2. Information We Collect

We collect only what we need to run ChapterUp. Most data is tied to your account; some is processed by the service providers listed in section 5.

Account information

• Your email address (required to create an account).
• Optional profile details you choose to add: username, display name, and avatar.
• Your date of birth. This is required when you create an account — we use it to work out whether you are below the age of digital consent where you live, and to apply the protections described in section 7. You can update it later in Settings.
• Preferences such as time zone, reading speed, and daily/weekly/monthly goals.

Reading activity

• Books you add and their status (want to read, reading, finished, did not finish).
• Reading sessions: time spent, pages read, dates, and optional mood and environment tags.
• Streaks, daily progress, experience points (XP), levels, achievements, and quests.

Content you create

• Book reviews and ratings, reading notes, highlights, and quotes.
• Book-club discussion posts and book recommendations (including any message you add).
• Custom bookshelf names and descriptions.

You control the visibility of your reviews (public, friends only, or private). Some content, such as public reviews and book-club posts, is visible to other users.

Social connections

• Friend relationships you create and the book clubs you join or create.
• Your standing on friends-only weekly and monthly leaderboards.

Purchases

ChapterUp lets you buy "Runes" (an in-app currency) with real money. When you do, we keep a record of the transaction — the store, product, transaction identifier, price, and Runes credited. Payment itself is handled by Apple, Google, and our payments provider RevenueCat; we never receive or store your card details.

Device and advertising data

• When ads are shown, our advertising provider (Google AdMob) may access your device's advertising identifier, approximate location (derived from your IP address), and device information to deliver and measure ads. For users under 13, ads are requested in a child-directed mode that does not use the advertising identifier.
• RevenueCat receives a transaction identifier and device information to manage and restore your purchases.
• We use Sentry to capture crash and error reports so we can fix bugs. We configure Sentry not to send personal information and strip network-request details from these reports.

Camera and book search

If you scan a book's barcode, the camera image is processed on your device to read the ISBN — the image is not stored or transmitted. When you search for books, your search terms are sent to book-data providers (Google Books and Open Library) to return results; we do not store your search history on our servers.

3. How We Use Your Information

• To provide your library and sync your reading progress across devices.
• To power gamification — streaks, XP, achievements, quests, and leaderboards.
• To enable the social features you choose to use.
• To process and validate in-app purchases.
• To show and measure ads. Users identified as under 13 are shown only non-personalised, child-directed ads.
• To diagnose crashes and improve the app.
• To enforce age-based restrictions and keep the service safe.
• To send you service messages, such as password resets.

We do not sell your personal information for money. Where you have consented to personalised ads, we share advertising identifiers with our advertising provider, which some US state privacy laws treat as a "sale" or "share" of personal information — see "Your US Privacy Choices" below.

4. Our Legal Bases for Using Your Data

If you are in the UK or the EU/EEA, data protection law requires us to have a legal basis for each purpose. Ours are:

• Performance of a contract — running your account, library, reading history, sync, gamification, the social features you opt into, and processing your in-app purchases. Without this data we cannot provide the app.
• Consent — showing you personalised ads, and storing or reading ad-related information on your device. In the UK, EEA, and Switzerland we ask for this through an in-app consent form before any ad is requested, and you can change your mind at any time (see section 6). Withdrawing consent does not affect anything we did before you withdrew it.
• Legitimate interests — crash and error diagnostics, keeping the service secure, preventing fraud and abuse, and moderating reported content. We have weighed these against your rights; the data involved is limited and diagnostics are configured to exclude personal information.
• Legal obligation — applying age-based restrictions and responding to data protection rights requests.

5. Third Parties & Service Providers

We share data only with providers that help us operate ChapterUp:

• Supabase — our backend, authentication, and database host. Your account data is stored on Supabase infrastructure located in the European Union.
• Apple App Store, Google Play, and RevenueCat — process and validate in-app purchases.
• Google AdMob — serves ads. Users under 13 are served only non-personalised, child-directed ads.
• Sentry — crash and error diagnostics, configured to exclude personal data.
• Cloudflare — serves our website and handles sign-in confirmation links.
• Google Books and Open Library — provide book metadata and search results.

These providers process data under their own privacy policies and our agreements with them. We do not share your information with third parties for their own marketing.

6. Advertising & Your Ad Choices

ChapterUp shows interstitial and rewarded ads through Google AdMob; rewarded ads can grant Runes. ChapterUp+ subscribers see no ads at all.

If you are in the UK, EEA, or Switzerland, we show you a consent form the first time the app would request an ad, and we request no ads at all until you have made a choice. You can revisit that choice at any time from Settings → Ad privacy options in the app, which reopens the same form. You can also reset or limit your advertising identifier in your device settings.

Users identified as under 13 are shown only non-personalised, child-directed ads. We do not use the advertising identifier for them, and they are not shown the personalised-ads consent form.

7. Children's Privacy

ChapterUp is intended for a general audience and is not directed primarily at children. When a user indicates (via date of birth) that they are under 13, we apply additional protections:

• their profile is set to private and cannot be made public;
• they cannot add friends, join or create book clubs, post reviews or discussions, or appear on social leaderboards;
• they cannot make in-app purchases;
• they are not shown personalised ads and we do not collect an advertising identifier for them;
• crash diagnostics are collected without personal information.

We do not knowingly collect personal information from children under 13 beyond what is needed to provide this restricted experience and to comply with law. Age is self-reported. If you are a parent or guardian and believe your child has provided information without your consent, contact us at [email protected] and we will delete it. We handle children's data consistent with the Children's Online Privacy Protection Act (COPPA) in the US and the UK and EU GDPR. The age of digital consent varies by country (between 13 and 16); where a user is below that age we do not rely on their consent for advertising, and applicable law may require verifiable parental consent.

8. Data Storage, Security & Location

Your account data is stored on Supabase infrastructure in the European Union. Because book and advertising providers operate globally, some data — for example, searches sent to Google Books or Open Library, and ad or purchase processing — may be handled in other countries, including outside the UK and EU/EEA. Where required, such transfers rely on appropriate safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Agreement.

Data is encrypted in transit using TLS and at rest. The app's on-device database is encrypted with SQLCipher (AES-256). No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect your information.

9. Data Retention & Deletion

• We keep your account data — profile, library, reading history, content, and social connections — for as long as your account is active, so your reading history and streaks are still there when you come back.
• You can permanently delete your data at any time from Settings in the app: Delete Account if you created an account, Delete My Data if you did not. This removes your profile, reading data, content, and social connections from our servers and clears the app's local data on your device. Records of your purchases are kept without your identity on them, as set out below.
• Social activity items (such as "finished a book") are removed from friends' feeds after about 90 days.
• Crash and error reports are retained by Sentry for up to 90 days and contain no personal information.
• Records of in-app purchases are kept for up to 7 years after the transaction for tax and accounting purposes. If you delete your data, they are kept without your identity on them.
• Backup copies held by our hosting provider are overwritten on a rolling basis, no later than 30 days after deletion.

10. Your Rights & Choices

If you are in the UK or the EU/EEA you have the right to access, correct, delete, export, or restrict the processing of your personal data, to object to processing we carry out on the basis of legitimate interests, and to withdraw any consent you have given. Similar rights apply in many other countries.

You can exercise several of these directly in the app: edit your profile, control review visibility, export your reading data, change your ad choices in Settings → Ad privacy options, and delete your account. For anything else — including a full copy of your data — email [email protected]. We will respond within one month. There is no charge, and we may ask you to verify your identity first.

If you are unhappy with how we have handled your data, you can complain to your local data protection authority. In the UK that is the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, helpline 0303 123 1113. We would appreciate the chance to put things right first.

11. Your US Privacy Choices (Do Not Sell or Share)

Where users have consented, ChapterUp shows personalised ads, which involves sharing advertising identifiers with our advertising provider (Google AdMob). Under some US state privacy laws — including the California Consumer Privacy Act, as amended by the CPRA — this may be considered a "sale" or "share" of personal information. We do not exchange your personal information for money.

You can opt out of this sharing at any time:

• On Android, reset or delete your advertising ID, or turn off ad personalisation, in your device settings.
• On iOS, ChapterUp does not request the advertising identifier (IDFA), so ads are not personalised using it. You can further limit ad tracking in your device settings.

Users identified as under 13 are never shown personalised ads, and we do not collect an advertising identifier for them.

12. Changes to This Policy

We may update this policy as ChapterUp evolves. We will revise the "Last updated" date above and, for material changes, provide notice within the app.

13. Contact Us

Questions about this policy or your data? Email [email protected], or write to Sideways Lab Ltd, Apartment 405 Manor Apartments, 2-4 Manor Row, Bradford, BD1 4AZ.