This Privacy Policy explains what personal data Koda collects, why we collect it, and the choices you have. It applies to kodabooks.com and any related Koda apps. We wrote it with GDPR (EU/UK), CCPA (California), and Indonesia's Personal Data Protection Law in mind, since Koda serves readers across all of these regions.

1Data we collect

Account data

• Email address, and name/profile photo if you sign in with Google;
• Authentication data: hashed passwords or passkey public keys, and an encrypted TOTP secret if you enable two-factor authentication;
• Language and timezone preferences;
• Subscription tier and billing status (managed by Stripe, see Section 4).

Usage data

• Summaries you read, like, or save to your library, and your reading progress;
• Affiliate link clicks (e.g., "Buy this book"), for attribution only;
• Session metadata: IP address, browser/device user agent, and login timestamps.

Cookies

Cookies are small text files stored on your device that let a website remember who you are and what you prefer between visits. Koda keeps cookie use to a minimum, we run no advertising trackers and no third-party analytics today. The cookies we set:

• Session cookie (strictly necessary), issued when you sign in, keeps you authenticated for up to 30 days (5-minute local cache for performance).
• CSRF token (strictly necessary), protects account and billing actions from cross-site request forgery.
• koda-lang (functional), remembers the language you chose for one year.

Because these cookies are essential to running the Service, we don't show a cookie-consent banner for them. If you play an embedded audio summary hosted on YouTube, or complete checkout through Stripe, those providers may set their own cookies on their own domains, governed by Google's and Stripe's privacy policies. Most browsers let you block or delete cookies in their settings, blocking the session cookie signs you out; blocking the language cookie means we fall back to your browser's language. If we ever add analytics or advertising cookies, we'll update this section and add a consent banner where required by law before those cookies are set.

2How we use your data

• To create and secure your account, and to keep you signed in;
• To deliver the Service in your preferred language and remember your progress;
• To process subscription payments and manage billing through Stripe;
• To respond to support requests sent to hello@kodabooks.com;
• To detect abuse, enforce rate limits, and keep the Service secure;
• To send essential account and billing emails (we do not send marketing email).

We do not use your reading history or account data to train third-party AI models, and we do not sell your personal data.

3Legal basis for processing (EU/UK users)

We process account and usage data under contract (to provide the Service you signed up for), consent (for optional cookies), and legitimate interest (for security, fraud prevention, and improving the Service).

4Who we share data with

We share the minimum data necessary with the following processors, each bound by their own data-protection terms:

• Stripe - payment processing and subscription billing (Stripe receives your payment details directly; Koda only sees your subscription status and a customer ID);
• Google - if you choose Google sign-in, for authentication only;
• Cloudflare - hosting, content delivery, and DDoS/security protection;
• Turso - our managed database provider, which stores account and content data at rest;
• YouTube (Google) - if you play an embedded audio summary, YouTube may set its own cookies per Google's privacy policy.

We do not sell personal data or share it with data brokers or advertisers. We may disclose data if required by law, to enforce our Terms, or to protect the rights and safety of Koda and our users.

5International data transfers

Koda serves readers worldwide, and our infrastructure providers (Cloudflare, Turso, Stripe) operate globally. Where personal data crosses borders, for example from the EU to the US we rely on our processors' standard contractual clauses or equivalent safeguards.

6How long we keep data

We keep account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we're required to keep billing records for tax or accounting purposes (typically up to 7 years) or need to retain limited data to prevent fraud or abuse.

7Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data; to object to or restrict certain processing; and to withdraw consent at any time. California residents have the right to know what data we collect and to request deletion under the CCPA; Indonesian residents have equivalent rights under the PDP Law. Since we don't sell personal data, there's nothing to opt out of on that front.

You can access and update most of your data directly in account settings, or delete your account outright. For anything else, email hello@kodabooks.com and we'll respond within 30 days.

8Children's privacy

Koda is not directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child has created an account, contact us and we'll remove it.

9Security

We use industry-standard safeguards, encrypted connections (HTTPS/TLS), hashed credentials, encrypted TOTP secrets, and access controls limiting who on our team can see user data. No system is perfectly secure, so we can't guarantee absolute protection, but we treat account security as a first-class concern.

10Changes to this policy

We'll post updates here and, for material changes, notify active users by email at least 14 days before they take effect.

11Contact

Questions or requests about your data? Email hello@kodabooks.com.