Privacy and retention

Libraries, manual entries, notes, ratings, lists, saved views, import files, progress events, and notification preferences are private by default. Public catalog browsing does not require authentication. Source adapters perform shared catalog checks, never one fetch per reader. The application does not collect unrelated browsing history, external chapter bodies, or cookies from source sites.

Local development uses a SQLite file at .data/chapterdock.sqlite. Demo accounts are explicitly selected and fixtures are labeled. These are demonstrations, not user statistics, real publishers, or licensed third-party content. Do not deploy with CHAPTERDOCK_DEV=1 to a public production environment.

Production uses Better Auth and PostgreSQL on the dedicated server. HttpOnly session cookies and database-validated sessions authorize personal operations. PostgreSQL is private to server processes. Service credentials never ship to a browser. Private responses use Cache-Control: private, no-store.

CSV and JSON exports are available without a paid tier. JSON is the lossless transfer format for source progress, notes, tags, ratings, source references, preferences, and lists. CSV prefixes spreadsheet formula-like fields with an apostrophe for safety. Imports preserve unresolved entries privately and never infer completion from an unverified mapping. Novel Updates XML is intentionally unavailable until a genuine user-provided export fixture is inspected. XML entity expansion and external entities must remain disabled.

POST /api/auth/delete requires the exact confirmation DELETE MY ACCOUNT. Application records, authentication identities and sessions are removed in one database transaction, with related audit records redacted.

Undo snapshots last 24 hours and are intended for short-term recovery. Operators must run daily expiry deletion for snapshots older than 24 hours, completed import previews older than 30 days, webhook replay markers older than the replay window plus 24 hours, and application operational logs older than 30 days. Source catalog history and anonymous source health are retained. Deleting an account removes its undo/import snapshots immediately.

Production backups are encrypted for an operator-held recovery key. Server copies expire after 14 days; off-server copies must expire within 30 days. Restores must account for deletions since the backup before allowing traffic. Test a restore quarterly and after substantial schema changes.

The progress-event API is scoped to an authenticated account, source, edition, release, idempotency key, and explicit event type. Currently only the authorized internal reader writes reliable positions. A future browser extension or partner integration needs per-site consent and scoped credentials, explicit and undoable completion, and no unrelated history or chapter-body collection. An ordinary website cannot observe reading activity on arbitrary external sites.

Reader profiles and public reviews

Series view sorting uses visits recorded here, not claimed publisher readership. A first-party HttpOnly catalog_visitor cookie expires after 24 hours. The server counts at most one visit per account or anonymous visitor, series, and UTC day. Daily deduplication uses keyed hashes, not stored IP addresses or external browsing history; the next day's first visit replaces the previous daily hashes. Only aggregate series totals are public. Account deletion removes matching current-day hashes and redacts account-management audit targets; aggregate totals are retained. Request-limit keys are separate and expire automatically.

Administrators can list account contact information, grant or remove administrator roles, and suspend or restore application access. Every change requires a reason and is audited. Suspension is enforced against current server-verified account metadata for personal APIs, including existing sessions; it does not delete a reader's data. Suspended readers retain the authenticated account-deletion endpoint. Administrators cannot change their own role or suspend themselves.

/ opens Discover. /updates is the public catalog release feed; its optional library filter is account-scoped. /library contains the private reading hub and Continue shelf. /profile edits the signed-in reader's name, picture, bio, and reading interests.

Profile bios and interests are private until the reader enables public visibility. A public review always displays its author's chosen display name and picture, even when their profile page is private. Public projections never include account IDs, email addresses, library entries, private notes, or reading history. Picture uploads accept PNG, JPEG, or WebP up to 650 KB; the server decodes, crops, resizes to 256 pixels, and re-encodes them as WebP without source metadata. Arbitrary remote picture URLs and SVG uploads are not accepted.

Public reviews are separate from private library ratings. Each account can publish one review per edition, with a rating from 0.5 to 5 in half-star steps and an independent Recommended or Not recommended choice. Retries update that record. Empty editions show no invented score. Readers can edit or delete their own reviews, mark spoilers, and report other reviews. Administrators can hide reviews; hidden reviews do not contribute to scores, and editing one does not republish it.

JSON exports include the reader's profile and reviews. CSV remains a library export. Importing a backup does not automatically publish reviews or enable public profile visibility. Account deletion removes profile and review records immediately under the retention policy above.

Apply database/migrations before enabling production features. Public profile/review views are sanitized by server endpoints. Development browser tests use separate local accounts.