Privacy

Illuminory keeps the least it can and tracks nobody. This page says exactly what that means.

Who is responsible

Illuminory is operated by its owner, A. Eccles. Write to help@illuminory.com about anything on this page.

What we store

• Your email address, which is your account. We use it to send you a six-digit sign-in code when you ask for one, a "your audiobook is ready" note when you buy a book, the emails about your account that you ask for (a change of address, finding your account, a refund request), and, unless you turn it off on your account page or in the email itself, one email asking how it was when you finish a book.
• An account id and the date you joined.
• Your purchases: which books your account holds, the reference Stripe gave each purchase, the amount, the currency and the country you paid from, any refund, and the last message Stripe sent us about it, which can carry the name and billing address you gave Stripe. Each book sold is also a line in the sales record the authors' statements are made from, with the price, the country and Stripe's reference but no name, email address or account.
• Your listening position in each book, so every device picks up where you left off, the speed you chose for it, and whether you finished it.
• Your reviews, if you write any in the app or on this site: the stars, the headline and text, the display name you chose, and how far through the book you were. An approved review is public on this site under that display name, with "Verified purchase" or "Verified listener" beside it; it never shows your email.
• Whether you want that "how was it?" email, and for each book you finish, the day we noticed and the day the one email went, so it never goes twice.
• Your signed-in devices: a device id and name, the platform, the app version and when each was last seen, so "Sign out everywhere" can do what it says. We never store a password; there is none.
• A refund request, if you make one: which books, why, what you wrote, and how far into each book you were, kept with your account so we can decide and reply.
• An access log of sign-in codes sent, sign-ins and sign-outs, books granted or taken away, purchases, downloads, refunds, deletions, changes of email address, two accounts merged into one, and what the owner did in the admin area (sending a "ready" email again, say), kept for 13 months. It holds no IP addresses and no browser or device fingerprints. A download line names the book and the chapter fetched, and when; nothing else in the log says what you listened to, with one exception: if a book is refunded and then played anyway, one line records that it was. A sign-in code is kept for an hour, as a fingerprint, with the address it went to, and a request to find your account is counted for an hour as a fingerprint of the address; both carry a fingerprint of the connection, so one inbox cannot be flooded.
• An address you give us to be told when a book is out, if you ask on a coming-soon book: kept with that book, with the day its one email went, until you ask us to remove it or delete the account that uses the address.
• An enquiry you send as an author through the form on the authors' page: your name, email, the book's title, your note and any sample link, kept so we can reply and pick the conversation up again; removed on request.
• Counts, not visits: how many times each page on this site was viewed, a book added to the cart, shared or sampled, the newsletter signed up for, which site a visit came from and where it went, as totals per day. No address, cookie, account or time of day is written with them, so nothing in them can be traced back to you.

What we do not do

• No analytics scripts, no advertising pixels, no third-party scripts in the apps, no tracking cookies. The only cookie on this site keeps you signed in. If you arrive through a link tagged for a newsletter or a share (?ref=), your browser keeps that tag for thirty days and sends it with a purchase, so the author's sales statement can say where the sale came from; it names nobody. The counts above are ours alone and name nobody.
• We do not sell, rent or share your details with anyone for marketing.
• We do not record what you listen to or when, beyond the position that lets you resume and the download lines in the access log.

Who processes data for us

• Cloudflare hosts the service and stores the database, its restore history and the audio files.
• Resend delivers the emails we send you.
• Kit keeps the newsletter list, if you sign up for it from the box on this site, and sends those emails under its own privacy policy. Every one carries an unsubscribe link; we keep no copy of the address. If you change your account's email address, a subscription moves to the new one; if you delete your account, its address is unsubscribed.
• Stripe takes payment as the merchant of record (Stripe Managed Payments; your receipt may say Sold through Link, Stripe's checkout). It sees your email, your payment details and your billing address, under its own privacy policy; we never see your card.
• Pushover carries our own alerts to the owner's phone, among them a purchase, a refund or a refund request, a review to approve and an author's enquiry, each naming the email address it is about.
• Fastmail hosts the help@illuminory.com mailbox, so it holds what you write to us.

How long we keep it

Your account and everything on it stay until you delete the account; the delete page says what is kept after that, and for how long. The access log is pruned after 13 months. Copies of the database, the restore history Cloudflare keeps and our own backups, are kept for up to 30 days. The sales record the authors' statements are made from names no listener and is kept with the business's accounts.

Your choices

• Delete your account at any time in the app, under Settings, Account, Delete account, or at illuminory.com/account/delete. Deletion is immediate: your email address, devices, positions, reviews, refund requests and purchase records go together. The delete page lists everything that is kept and for how long, among it the access log's lines about the account, under its id or a fingerprint of your email address, until they are 13 months old; the sales record, which names nobody; Stripe's own records; and the copies of the database, for up to 30 days. If the address is on the newsletter list, Kit unsubscribes it at the same time and keeps only the record that it was unsubscribed; ask at help@illuminory.com and we will have Kit erase that too.
• Sign out of every device from your account page.
• Ask for a copy of what we hold, or anything else, at help@illuminory.com.

This page is written in plain words on purpose. Where the law needs a particular term, the plain word here means that term.