Privacy Policy

This Privacy Policy describes how Bookable America, Inc., 442 5th Ave, Manhattan, NY 10018, United States (“Bookable America,” “Readoh,” the “Company,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal information in connection with the Readoh mobile application, the readoh.com website, and all related services, features, and communications (collectively, the “Services”), and explains the rights and choices available to you.

For users in the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland, Bookable America, Inc. is the “controller” of your personal data for purposes of the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and the Swiss Federal Act on Data Protection, except as described in Sections 8 and 9.6.

This Privacy Policy is incorporated into and forms part of the Readoh Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service. If you do not agree with this Privacy Policy, please do not use the Services.

Summary of our core commitments: we do not sell your personal information; we do not share your personal information for cross-context behavioral advertising; we do not display third-party advertising in the Services; and we do not use the contents of your private messages or unpublished drafts to market to you.

This Privacy Policy applies to personal information processed in connection with the Services, including the App, the Site, our communications, and our creator, publishing, and payment programs. It does not apply to: (a) third-party services that you access through the Services (including App Stores, Stripe, Distribution Channels, and linked websites), which are governed by their own privacy policies; or (b) the independent processing activities of Creators who lawfully export follower lists (Section 8).

We collect personal information in three ways: information you provide to us, information collected automatically, and information from other sources.

3.1 Information You Provide

• Account and profile data. When you register, we collect your name, username, email address, date of birth, password or third-party sign-in credentials, and country. Your profile may also include an avatar, biography, links, and other information you choose to add. Your username, avatar, display name, biography, and public activity are visible to other users.
• Content you create. We collect the content you create, upload, or share through the Services, including posts (text, images, voice recordings, polls, GIF selections), Articles, Stories, books and manuscripts, cover art, comments, reviews, ratings, notes, reading lists, club posts, and profile content. Some content is public by design; other content (such as drafts and direct messages) is not.
• Communications. We collect direct messages you send and receive through the Services, your communications with our support team, survey responses, and reports you submit about content or conduct. Voice contributions to Live Audio sessions are processed in real time to deliver the feature; we do not retain recordings of Live Audio sessions unless a recording feature is expressly enabled with notice to participants.
• Reading and activity data you log. We collect the books you add to your library, check-ins, reading progress, goals, streaks, ratings, and related activity you record.
• Identity verification data. If you use features that require identity verification (such as the Verified Badge, monetization, publishing, or withdrawals), our identity verification provider may collect, on our behalf, images of your government-issued identity document, a live selfie and liveness data, and information extracted from your document (such as name, date of birth, document number, and expiration). This process may involve biometric identifiers or biometric information (such as facial geometry derived from your selfie and document photo) used to confirm that you are the document holder. Biometric data is processed subject to Section 12 (Biometric Data Notice) and is not used for any purpose other than identity verification, fraud prevention, and legal compliance.
• Payments, payouts, and tax data. Star purchases and subscriptions are processed by the App Stores or our payment processors; we receive transaction records (such as product, amount, timestamp, and transaction identifiers) but not your full card number. If you withdraw Earnings, our payment processor, Stripe, collects your bank account or payout details, identity information, and, where applicable, business information under its own terms and privacy policy. For tax compliance, we (or Stripe) may collect tax forms and taxpayer identification numbers (for example, IRS Forms W-9/W-8, or information required under DAC7 or UK digital platform reporting rules for EEA/UK creators).
• Contacts.If you choose to use contact-based discovery features, and only with your permission through your device’s permission system, we access your device contacts to help you find people you know. You are responsible for ensuring you are authorized to share contact information you upload.
• Promotions and programs. If you participate in promotions, referral programs, beta programs, or research, we collect the information described at the point of collection.

3.2 Information Collected Automatically

• Device and technical data. Device model, operating system and version, app version, language, time zone, device identifiers (such as advertising-independent identifiers used for functionality and security), push notification tokens, IP address, and crash and diagnostic logs.
• Usage data. Information about how you use the Services, such as the features you use, content you view, unlock, or interact with, search queries, session information, referral sources, and interaction timestamps. We use this to operate features (such as feeds, trending, streaks, and statistics), for analytics, and for safety and integrity.
• Approximate location. We may infer your approximate location (such as country or region) from your IP address for purposes including content availability, legal compliance, tax determination, fraud prevention, and localization. The App does not collect precise GPS location.
• Cookies and similar technologies (Site). The Site uses cookies and similar technologies that are strictly necessary for operation and security, plus, where enabled, limited analytics. Because we do not serve third-party advertising, we do not use third-party advertising cookies.

3.3 Information from Other Sources

We receive information from: App Stores and purchase-infrastructure providers (purchase and subscription status); Stripe (payout onboarding status and compliance signals); our identity verification provider (verification outcomes and fraud signals); Distribution Channels (sales and transaction reporting for your distributed Works); book metadata providers (bibliographic data, which is generally not personal information); security and anti-fraud partners (signals about compromised credentials, abusive automation, or payment fraud); other users (for example, reports or mentions that include your details); and publicly available sources where relevant to safety investigations.

We use personal information for the following purposes:

• (a) Providing the Services. Creating and maintaining your Account; operating profiles, feeds, posts, Articles, Stories, books, clubs, Live Audio, messaging, libraries, statistics, streaks, and discovery surfaces such as trending and Top People; synchronizing your data across devices; and providing customer support.
• (b) Payments, monetization, and payouts. Processing Star purchases and subscriptions; operating Paywalls and gifting; calculating and crediting Earnings; facilitating withdrawals through Stripe; detecting and preventing payment fraud and abuse of the Stars economy; maintaining transaction records; and meeting tax, accounting, and audit obligations (including IRS 1099-series and, where applicable, DAC7/UK reporting).
• (c) Publishing and distribution. Preparing, publishing, and distributing your Works; transmitting Works, metadata, and author information to Distribution Channels you enroll in; receiving and reconciling sales reporting; and calculating print costs.
• (d) Identity verification and platform integrity. Verifying identity where required; preventing impersonation; detecting and preventing fraud, spam, fake engagement, manipulation, unauthorized automation, and security incidents; enforcing our Terms of Service and Community Guidelines, including through content moderation (automated and human); and protecting the rights, property, and safety of users, the public, and the Company.
• (e) Communications. Sending transactional and service communications (such as receipts, security alerts, enforcement notices, and changes to terms); sending push notifications you have enabled; responding to your inquiries; and, with your consent where required, sending marketing communications about our own Services (you can opt out at any time).
• (f) Improvement and analytics. Understanding how the Services are used; debugging, fixing, and improving features; conducting internal research and analytics; and developing new features. Where we use analytics, we use aggregation, pseudonymization, or de-identification where practicable.
• (g) Legal compliance.Complying with applicable law, regulation, legal process, and governmental requests, including tax, sanctions, anti-money-laundering, consumer protection, platform-reporting, and child-safety obligations (including mandatory reports to the National Center for Missing & Exploited Children).
• (h) Corporate transactions. Evaluating or carrying out a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to Section 9.5.

No AI training on your content for external models; no ad profiling. We do not use your User Content to train generative artificial intelligence foundation models, we do not sell personal information, and we do not build advertising profiles about you. Automated systems we use (such as spam detection, recommendation ranking, and AI-content detection) are used only to operate and protect the Services as described in this Policy.

Where the GDPR or UK GDPR applies, we process personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): providing the Services and features you request, including accounts, content hosting and delivery, messaging, Stars, Paywalls, Wallet and withdrawals, subscriptions, publishing, and distribution.
• Legitimate interests (Art. 6(1)(f)): securing and protecting the Services and our users; preventing fraud, abuse, and manipulation; enforcing our terms; moderating content; improving and analyzing the Services; establishing, exercising, or defending legal claims; and communicating service information — in each case balanced against your interests, rights, and freedoms.
• Legal obligation (Art. 6(1)(c)): tax, accounting, platform reporting (including DAC7), sanctions screening, responding to lawful requests, and child-safety reporting.
• Consent (Art. 6(1)(a)): contacts access; non-essential cookies; marketing communications where consent is required; optional features that request consent at the point of use; and, where required, biometric identity verification (Section 12). You may withdraw consent at any time without affecting prior processing.

Where we process special category data (for example, biometric data for uniquely identifying you during verification), we rely on your explicit consent (Art. 9(2)(a)) or, where applicable, establishment, exercise, or defense of legal claims (Art. 9(2)(f)), together with the safeguards described in Section 12.

We use automated systems for: identity verification (document authenticity and face-match checks performed by our verification provider); fraud, spam, and abuse detection (including in payments, gifting, and engagement); content moderation triage; AI-generated-content detection; and content ranking and recommendations (feeds, trending, Top People). Where an automated decision would produce legal or similarly significant effects for you — for example, a verification denial that blocks withdrawals, or an automated account termination — you have the right, where required by law (including GDPR Art. 22 and applicable US state laws), to obtain human review, express your point of view, and contest the decision, via the appeal channels in the Terms (Section 16.3) or by contacting [email protected]. Our content ranking systems do not use special category data, and we do not perform profiling for third-party advertising.

Public by design. Your username, display name, avatar, biography, public posts, Articles, Stories, published books, public reviews and ratings, club memberships in public clubs, follower/following counts, and appearances in discovery surfaces (such as trending and Top People) are visible to other users and, where features permit, may be visible to the public. Paywalled content previews (title, excerpt, cover) are visible to prospective purchasers.

Audience-limited. Direct messages are visible to their participants. Private clubs are visible to their members. Live Audio contributions are audible to session participants. Reading activity, goals, streaks, and statistics are shared according to the feature design and your settings.

Recipients’ devices. Anything you share with other users can be saved, screenshotted, or re-shared by them. Please exercise judgment about what you share.

Readoh lets creators own their relationship with their followers/readers. If you choose to share your email address with users/creators you follow, those creators can export it as part of their follower mailing list — much like subscribing to an author’s newsletter, so they can share their work with you directly. Email sharing is turned OFF by default, and changes you make apply to future exports. Once a creator exports their list, the creator becomes an independent controller of that data and is responsible for how they use it. Our Terms of Service (Section 21) hold creators to newsletter-professional standards: your information may be used only to tell you about that creator’s own work; it may never be sold or given to others; and unsubscribes, opt-outs, and deletion requests must be honored promptly, along with all applicable privacy and anti-spam laws (including the GDPR/UK GDPR and CAN-SPAM). If you believe a creator has misused your information, contact us at [email protected] and we will investigate and enforce our Terms; you may also exercise your legal rights directly against the creator.

We do not sell personal information, and we do not share personal information with third parties for their own marketing or for cross-context behavioral advertising. We disclose personal information only as follows:

• 9.1 Service providers (processors).Vendors that process personal information on our behalf and under our instructions, in categories including: cloud hosting, storage, and content delivery; databases and caching; payment and purchase infrastructure, payout processing (Stripe, which also acts as an independent controller/regulated entity for certain compliance processing); identity verification providers; communications infrastructure; customer support tooling; analytics and crash reporting; content moderation and safety tooling; and professional advisers’ platforms. Each processor is bound by a data processing agreement (Section 10).
• 9.2 Distribution Channels. If you enroll Works in External Distribution, we disclose to your selected Distribution Channels the Work and its metadata, your author name and related publishing information, and pricing/territory instructions. Distribution Channels are independent controllers of the data they process for their own retail operations.
• 9.3 Other users and the public, as described in Sections 7 and 8.
• 9.4 Legal, safety, and compliance disclosures. To comply with applicable law, regulation, subpoena, court order, or other legal process; to respond to lawful requests from public authorities (we require valid legal process for content of private communications, absent emergency); to make mandatory child-safety reports to NCMEC; to report to tax authorities (including 1099-series and DAC7/UK platform reporting); to enforce our Terms and policies and to investigate fraud, security, or technical issues; to protect the rights, property, or safety of the Company, our users, or the public, including in emergencies involving risk of death or serious injury; and to our professional advisers under duties of confidentiality.
• 9.5 Corporate transactions. In connection with any merger, acquisition, financing, reorganization, bankruptcy, receivership, or sale of assets, personal information may be disclosed to counterparties and their advisers under confidentiality obligations and may be transferred to a successor, who will remain bound by commitments materially consistent with this Privacy Policy or will provide you notice and any legally required choices.
• 9.6 App Stores and platforms. Apple, Google, and other platforms independently collect information in connection with your download, purchases, and use of the App under their own privacy policies.
• 9.7 Aggregated and de-identified data. We may create and use aggregated or de-identified data that cannot reasonably be used to identify you, and we commit to maintaining such data in de-identified form and not attempting re-identification, except to test the effectiveness of our de-identification.

We maintain a vendor privacy and security program under which: (a) each service provider that processes personal information on our behalf is bound by a written data processing agreement (“DPA”) meeting the requirements of GDPR Article 28 and UK GDPR Article 28 and, for CCPA/CPRA purposes, qualifying the vendor as a “service provider” or “contractor,” including obligations of confidentiality, purpose limitation, security, sub-processor flow-down, assistance with data subject rights and breach notification, and deletion or return of data at the end of services; (b) international transfers under those DPAs are protected by the mechanisms described in Section 11; (c) sub-processing requires equivalent contractual protections; and (d) we assess vendors’ security practices proportionate to the sensitivity of the data they handle. A current list of the categories of our sub-processors (and, where legally required, their identities) is available on request by emailing [email protected].

We are headquartered in the United States, and personal information is processed in the United States and in other countries where we or our service providers operate. These countries may have data protection laws different from those of your jurisdiction.

Where we transfer personal data from the EEA, UK, or Switzerland to countries not deemed to provide an adequate level of protection, we implement appropriate safeguards, including: the European Commission’s Standard Contractual Clauses (2021), supplemented where appropriate by transfer impact assessments and additional technical and organizational measures; for UK transfers, the UK International Data Transfer Addendum to the EU SCCs (or the UK IDTA); and for Swiss transfers, the SCCs as adapted for Swiss law. Where a relevant service provider is certified under the EU–US Data Privacy Framework (or its UK and Swiss extensions), we may also rely on that certification for transfers to that provider.

Where identity verification involves the collection of biometric identifiers or biometric information (such as facial geometry derived from your selfie and identity document for face-matching and liveness detection), the following applies, including for the purposes of the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and Washington’s biometric and My Health My Data laws, as applicable: (a) biometric data is collected and processed only with your prior notice and consent, obtained at the start of the verification flow; (b) biometric data is used solely for identity verification, fraud prevention, and related legal compliance — never for advertising, and it is never sold, leased, or traded; (c) biometric data is retained only as long as needed for the verification purpose and applicable fraud-prevention and legal requirements, and in any event is permanently destroyed no later than thirty (30) days after you terminate your account with Readoh, unless a shorter period is required by law; (d) biometric data is protected using a reasonable standard of care at least equivalent to how we protect other confidential and sensitive information, including encryption in transit and at rest; and (e) we maintain a publicly available retention and destruction schedule, which this Section constitutes. If you do not consent to biometric processing, you may be unable to use verification-gated features.

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, and then delete or de-identify it. Retention periods vary by data type and context, based on: the duration of your Account; our legal obligations (transaction, tax, and payout records are generally retained for at least seven (7) years; DAC7 and similar platform-reporting records for the periods required by law); the needs of safety and integrity (records of serious violations, fraud, and enforcement may be retained after account closure to prevent evasion and defend claims); dispute resolution and legal holds; and backup cycles (deleted data may persist in encrypted backups for a limited period, up to 30 days, before being overwritten). When you delete content, it becomes unavailable to other users promptly (except copies already shared with recipients) and is deleted or de-identified from active systems within a commercially reasonable period, usually 30 days. When you delete your Account, we delete or de-identify your personal data within 30 days and may temporarily withhold certain information in accordance with this Section, subject to the lawful retention needs above.

We maintain administrative, technical, and physical safeguards designed to protect personal information, appropriate to the sensitivity of the data, including: encryption of data in transit (TLS) and encryption at rest for sensitive data stores; access controls, authentication, and least-privilege practices for personnel; network and application security controls; logging and monitoring; vendor security assessment and DPAs; secure development practices; and incident response procedures. No system is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials. If we become aware of a breach of security affecting your personal information, we will notify you and applicable regulators as required by law (including GDPR Articles 33–34 and US state breach notification statutes) without undue delay. Security researchers may report vulnerabilities to [email protected] with the subject “Security.”

15.1 Rights for EEA, UK, and Swiss Users

Subject to conditions and exceptions under applicable law, you have the right to: access your personal data and receive a copy; rectify inaccurate or incomplete data; erase your data (“right to be forgotten”); restrict processing; object to processing based on legitimate interests, and to object at any time to direct marketing (which we will honor absolutely); data portability; withdraw consent at any time, without affecting prior processing; not be subject to solely automated decisions with legal or similarly significant effects, except as permitted by law, and to obtain human intervention (Section 6); and lodge a complaint with your local supervisory authority (in the EEA), the Information Commissioner’s Office (UK), or the Federal Data Protection and Information Commissioner (Switzerland) — though we would welcome the chance to address your concerns first at [email protected].

15.2 Rights for US State Residents

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have rights that may include: knowing/accessing the categories and specific pieces of personal information we collect, use, and disclose; correction; deletion; portability; opting out of “sales,” “sharing” for cross-context behavioral advertising, and certain profiling — noting that we do not sell or share personal information within the meaning of these laws and have not done so; limiting use of sensitive personal information — we use sensitive information (such as identity documents and biometric data) only for the purposes permitted without a right-to-limit obligation, namely providing requested services, security, and legal compliance; and non-discrimination for exercising rights. California residents: Section 20 contains additional CCPA/CPRA disclosures. We honor Global Privacy Control (GPC) signals as an opt-out of sale/sharing where applicable (we do not sell or share, so there is nothing further to opt out of, but the signal is respected). Because we do not respond differently to browser “Do Not Track” beyond GPC, this paragraph serves as our DNT disclosure.

15.3 How to Exercise Rights

You may exercise rights through in-app tools (profile editing, content deletion, account deletion, notification and consent settings, data export where available) or by emailing [email protected] with the subject “Privacy Request,” specifying your request and jurisdiction. We will verify your identity and respond within the time required by applicable law (generally 30 days under GDPR, extendable; 45 days under CCPA, extendable). Authorized agents may submit requests on your behalf with proof of authorization. If we decline a request, we will explain why, and you may appeal by replying with the subject “Privacy Appeal”; if your appeal is denied, you may contact your state attorney general or supervisory authority. We do not charge for requests unless they are manifestly unfounded or excessive.

The Services are intended solely for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18, and we do not offer parental-consent pathways. If we learn that we have collected personal information from a person under 18, we will delete it and terminate the associated account promptly, subject to legal preservation obligations. If you believe a person under 18 is using the Services, please report it to [email protected].

Email. You can opt out of marketing emails via the unsubscribe link in any marketing message or in settings; transactional and legal notices (receipts, security alerts, terms changes, enforcement and privacy notices) will continue while you hold an Account.

Push notifications. Manage in your device settings and, where offered, in-app notification settings.

Consent-based features. Contacts access and other permission-based features can be revoked at any time through your device permission settings; revocation stops future collection but does not delete previously collected data (you may separately request deletion).

The Services link to or interoperate with third-party services — including Apple, Google, Stripe, our identity verification provider (Didit), External Distribution Channels, and sites linked from user content. Their processing of your information is governed by their own privacy policies. We are not responsible for the privacy practices of third parties.

Privacy contact: [email protected] (subject “Privacy”). We have not designated a statutory Data Protection Officer; privacy inquiries are handled by our privacy team at the address above.

Digital Services Act point of contact (EU): [email protected] (English).

Categories. We collect the following categories of personal information (as defined by the CCPA): identifiers (name, username, email, IP address, device identifiers); customer records information (payment/transaction records, tax forms); characteristics of protected classifications (date of birth/age); commercial information (purchases, subscriptions, Star and Wallet activity); biometric information (facial geometry processed during identity verification, with consent); internet or other electronic network activity (usage data, interactions); geolocation data (approximate, IP-derived); audio, electronic, visual, or similar information (voice posts, Live Audio participation, avatar, verification imagery); professional information (author/publishing details you provide); and inferences (limited, service-operation inferences such as content recommendations and integrity risk scores). Sensitive personal information we may require includes government identifiers, identity documents, and account credentials — used only for providing the Services, security, integrity, and legal compliance.

Sources: you; your devices; our service providers; App Stores and payment platforms; Distribution Channels; other users. Purposes: as described in Section 4. Disclosures for business purposes: to the categories described in Section 9. Sales/sharing: we do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so; we have no actual knowledge of selling or sharing the personal information of consumers under 16. Retention: as described in Section 13, by category. Rights: as described in Section 15.2, exercisable via Section 15.3. Shine the Light: California Civil Code § 1798.83 permits requests about disclosures to third parties for their direct marketing; we make no such disclosures.

Nevada residents may opt out of the sale of certain covered information. We do not sell covered information within the meaning of Nevada law; you may nonetheless submit an opt-out request to [email protected].

Please keep your Account information accurate and current through profile and settings tools. We may reject or correct data that we determine is inaccurate for safety, verification, or legal reasons.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice appropriate to the circumstances — such as in-app notice or email — before the changes take effect, and where required by law, we will obtain your consent. The “Last Updated” date reflects the latest revision. Your continued use of the Services after the effective date of an updated Privacy Policy indicates your acknowledgment of it; where processing requires consent, we will ask for it.

Bookable America, Inc.
Attn: Privacy
442 5th Ave, Manhattan, NY 10018, United States
Email: [email protected] (subject line “Privacy”)

EEA users may lodge complaints with their local supervisory authority; UK users with the ICO (ico.org.uk); Swiss users with the FDPIC. We ask that you contact us first so we can try to resolve your concern directly.

By using Readoh, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described herein.