Privacy, in plain English.

1.Introduction

This Privacy Policy explains how Podforge Ltd ("we", "our" or "us") collects, uses, stores and protects your personal data when you use the Volumes mobile application (the "App").

We are the data controller for the personal data we process through the App. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy should be read alongside our Terms and Conditions, which govern your use of the App.

2.Who we are

Data controller: Podforge Ltd

Registered in: England and Wales

Contact email: privacy@podforge.co.uk

If you have any questions about this Privacy Policy or how we handle your data, you can contact us at the email address above.

3.What data we collect

We collect the minimum amount of data necessary to provide the App's features. We follow a principle of data minimisation: we do not collect data we do not need.

3.1 Account data

When you create an account, we collect:

1. Your email address (or the email associated with your Google account if you use Google Sign-In).
2. A display name (if you choose to provide one).
3. Your authentication credentials (managed by Firebase Authentication; we do not store your password directly).

3.2 Reading data

When you use the App, we collect data about your reading sessions. This data is stored locally on your device by default and is only synchronised to our cloud services if you opt in to cloud sync. Reading data includes:

1. Reading session records: start and end times, words read, active reading time, reading mode used, reading speed (WPM) and target WPM setting.
2. Comprehension data: quiz scores, question responses and effective WPM (eWPM).
3. Progress data: your position in each document, reading history and streak information.
4. Reading preferences: chosen font, reading mode, speed settings and display preferences.

3.3 Onboarding data

During the onboarding process, you may provide:

1. Your reading goals.
2. A cognitive profile indicating any neurodivergent traits you wish us to consider (such as ADHD, dyslexia or autism). This is entirely optional and is used only to personalise your experience within the App.
3. Baseline test results from the initial 500-word reading assessment.

Cognitive profile data is sensitive personal data under the UK GDPR. We process it only with your explicit consent, and it is stored locally on your device unless you opt in to cloud sync. You may delete this data at any time through Settings.

3.4 Social features data (The Circle)

If you use The Circle (available to users aged 18 and over), we additionally collect:

1. Your reading name (a pseudonym you choose).
2. Your optional reading biography and genre preferences.
3. Posts and replies you make within Circles.
4. Your date of birth (for age verification only, stored locally).
5. Circle membership and moderation data.
6. Reports you make about other users' content.

Your reading performance data (eWPM, comprehension scores, reading speed) is never shared with other users or displayed in social features.

3.5 Technical and device data

We automatically collect limited technical data necessary for the App to function, including:

1. Device type, operating system version and screen size.
2. App version.
3. Crash reports and error logs (via Firebase Crashlytics).
4. Basic usage analytics (via Firebase Analytics), such as which features are used and session frequency.

We do not collect your precise location, contacts, call logs, SMS messages or any data from other apps on your device.

3.6 Payment data

We do not collect or store your payment information. All subscription payments are processed by Google Play. Google may share limited transaction data with us (such as subscription status, plan type and transaction ID) to enable us to provide Premium features. We do not receive your full payment card details.

4.How we use your data

We use your data for the following purposes, each linked to a lawful basis under the UK GDPR:

4.1 To provide and operate the App

Lawful basis: Performance of a contract (Article 6(1)(b)).

This includes creating and managing your account, providing reading features, calculating and displaying eWPM and other metrics, generating comprehension questions, tracking your reading progress and managing your subscription.

4.2 To personalise your experience

Lawful basis: Performance of a contract (Article 6(1)(b)).

This includes adapting reading settings based on your preferences, personalising the App based on your cognitive profile (if provided) and tailoring the comprehension testing experience to your reading goals.

4.3 To generate comprehension questions

Lawful basis: Performance of a contract (Article 6(1)(b)).

When you complete a reading session, a portion of the text you read (up to approximately 2,000 words) is sent to Anthropic's Claude API to generate comprehension questions. This data is transmitted securely and is not stored by Anthropic beyond the duration of the API request. Anthropic's privacy policy governs their processing of this data.

For Curated Content, comprehension questions are pre-generated and stored within the App. No API call is made for curated texts.

4.4 To serve advertising

Lawful basis: Legitimate interests (Article 6(1)(f)), balanced against your rights.

For Free Tier users, we use Google AdMob to display advertisements outside of reading mode. Google AdMob may collect device identifiers and limited usage data for the purpose of serving relevant advertisements. You can manage your advertising preferences through your device's advertising settings. Premium subscribers do not see advertising and AdMob does not collect data from Premium accounts.

4.5 To improve the App

Lawful basis: Legitimate interests (Article 6(1)(f)).

We use crash reports, error logs and aggregated usage analytics to identify bugs, improve performance and develop new features. This data is anonymised or aggregated wherever possible.

4.6 To provide social features (The Circle)

Lawful basis: Performance of a contract (Article 6(1)(b)).

If you use The Circle, we process your reading name, profile information, posts and Circle membership data to provide the social reading features.

4.7 For research (opt-in only)

Lawful basis: Consent (Article 6(1)(a)).

If you opt in to our research programme, we may use your anonymised reading data (reading speeds, comprehension scores, mode preferences and improvement trajectories) to study effective reading techniques. This data is fully anonymised before use: it cannot be linked back to you. You may withdraw your consent at any time through Settings, and we will cease using your data for research purposes. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.8 Processing of special category data

Lawful basis: Explicit consent (Article 9(2)(a)).

If you provide cognitive profile information during onboarding (such as whether you have ADHD, dyslexia or autism), this is classified as special category data under the UK GDPR (health data). We process this data only with your explicit consent, solely for the purpose of personalising your reading experience. You may withdraw this consent and delete this data at any time through Settings.

5.Who we share your data with

We do not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary:

5.1 Service providers

Firebase (Google): Authentication, cloud database (Firestore), crash reporting (Crashlytics) and analytics. Firebase processes data in accordance with Google's data processing terms.

Anthropic: AI question generation via the Claude API. Anthropic receives limited passage text (up to approximately 2,000 words per reading session) solely for the purpose of generating comprehension questions. Anthropic does not retain this data beyond the API request.

Google AdMob: Advertising for Free Tier users. AdMob may collect device identifiers and limited usage data. Premium subscribers are not served advertising.

5.2 Legal requirements

We may disclose your data if required to do so by law, court order or regulatory authority, or if we reasonably believe that disclosure is necessary to protect our rights, your safety or the safety of others.

5.3 Business transfers

If Podforge Ltd is acquired, merged with another company, or its assets are transferred, your personal data may be transferred as part of that transaction. We will notify you of any such transfer and any changes to the way your data is processed.

6.International data transfers

Some of our service providers (including Firebase and Anthropic) may process data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place, such as:

1. transfers to countries that the UK government has determined provide an adequate level of data protection;
2. Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office; or
3. other legally recognised transfer mechanisms.

You can contact us for more information about the specific safeguards we use.

7.How long we keep your data

We retain your data only for as long as necessary to fulfil the purposes for which it was collected:

Account data: retained for as long as your account is active. Deleted within 30 days of account deletion.

Reading data: retained for as long as your account is active (locally and, if opted in, in the cloud). Deleted within 30 days of account deletion.

Social features data: posts are retained while the Circle exists. On account deletion, posts are anonymised (attributed to "Former member"). You may request deletion of your posts before deleting your account.

Crash reports and analytics: retained for up to 12 months.

Research data: anonymised research data may be retained indefinitely, as it cannot be linked to you.

Moderation reports: retained for 12 months for safety and pattern detection purposes.

8.Data storage and security

8.1 Local-first storage

The App follows a local-first storage principle. Your reading data, preferences, cognitive profile and imported content are stored on your device by default. Cloud synchronisation is available as an opt-in feature for Premium subscribers.

8.2 Security measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration, including:

1. encryption of data in transit (TLS/SSL);
2. secure authentication via Firebase Authentication;
3. access controls limiting who within our organisation can access personal data;
4. regular security reviews of our systems and processes; and
5. Firestore security rules that enforce data isolation between users.

No method of transmission or storage is completely secure. While we take reasonable precautions, we cannot guarantee absolute security.

9.Your rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of access: You can request a copy of the personal data we hold about you.

Right to rectification: You can ask us to correct any inaccurate or incomplete personal data.

Right to erasure: You can ask us to delete your personal data. You can delete your account and all associated data through the App's Settings.

Right to restrict processing: You can ask us to restrict how we process your data in certain circumstances.

Right to data portability: You can request that we provide your data in a structured, commonly used, machine-readable format. The App includes a data export feature in Settings.

Right to object: You can object to processing based on legitimate interests (including advertising). If you object to advertising, you can upgrade to Premium for an ad-free experience.

Right to withdraw consent: Where we process data based on your consent (such as cognitive profile data or research participation), you can withdraw your consent at any time through Settings.

To exercise any of these rights, you can use the relevant features in the App's Settings, or contact us at privacy@podforge.co.uk. We will respond to your request within one month, as required by the UK GDPR.

Right to complain: If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10.Children's privacy

The core reading features of the App are available to users of all ages. We do not knowingly collect personal data from children under 13 without parental consent. If you are under 16, you should have the permission of a parent or guardian before creating an account.

The Circle (our social reading feature) is restricted to users aged 18 and over. We do not allow users under 18 to access social features, post content or interact with other users through The Circle.

If we become aware that we have collected personal data from a child under 13 without appropriate parental consent, we will take steps to delete that data as soon as reasonably practicable. If you believe we have inadvertently collected data from a child under 13, please contact us at privacy@podforge.co.uk.

11.Automated decision-making

The App does not make automated decisions that produce legal effects or similarly significant effects on you. Comprehension scores, eWPM calculations and reading statistics are generated automatically, but they are personal performance indicators that do not affect your access to the App, your account status or your subscription.

The skip adaptation system (which adjusts the prominence of quiz invitations based on your usage patterns) operates automatically but does not restrict your access to any feature. You can always access comprehension quizzes manually.

12.Cookies and similar technologies

The App itself does not use cookies (which are a web browser technology). However, the following technologies may be used within the App:

Firebase Analytics: uses device identifiers to collect aggregated usage data.

Google AdMob: may use device advertising identifiers to serve relevant advertisements to Free Tier users.

Firebase Crashlytics: collects crash data using installation identifiers.

You can manage advertising identifiers through your device's privacy settings. Resetting your advertising ID or opting out of personalised advertising will limit the data collected by AdMob.

13.Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the law or the features of the App. When we make changes, we will update the effective date at the top of this document.

For material changes that affect how we process your personal data, we will notify you through the App (for example, via an in-app notification) at least 30 days before the changes take effect. If a change requires your consent, we will seek it before applying the change.

We encourage you to review this Privacy Policy periodically.

14.Contact us

If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how we handle your data, please contact us:

Data protection enquiries: privacy@podforge.co.uk

General enquiries: support@podforge.co.uk