Privacy Policy
Last updated 2026-10-08.
1. Who we are
Grimoire (grimoire.meme) is operated by Grimoire, a sole proprietorship based in Minnesota, United States, which is the "controller" of the personal information described here. Contact: [email protected].
2. What stays on your device
Your documents, library, reading positions, highlights, notes, sticky notes and settings are stored in your browser's local storage and are not sent to us — unless you are signed in with Pro, in which case Your Library is also kept in your account (section 3). Clearing your browser data deletes them; use Library → Export backup to keep a copy. When you use "From a web address", your browser fetches that page directly from the website you named.
3. What we collect
| Data | When | Why | Kept |
|---|---|---|---|
| Reading counters (words read, time read, best speed) | As you read | To show lifetime totals | Stored as totals on our server, not linked to your name or email |
| Email address, sign-in link token, session cookie | Only if you create an account | To sign you in and identify your account | Until you delete your account; sign-in links expire in 15 minutes; sessions in 30 days |
| Synced reading stats | If you sign in with Pro | To sync stats across your devices | Until you delete your account |
| Your Library: the text of documents you open (extracted text, not the original PDF or EPUB file), their titles, chapters, reading positions, highlights and notes | Only if you are signed in with Pro | So your library is there on any device you sign in on | Until you delete the document or your account |
| Pro key record: a one-way hash of your key, plan, Square order and customer ID, when it was used and how often | When you buy or use Pro | To unlock Pro, renew monthly plans, handle refunds, and spot keys shared publicly | For as long as the key is valid, plus 7 years for tax and accounting records |
| Your suggestion, and your email if you choose to give it | If you use "Have any suggestions?" | To read and reply to it | Until it's dealt with, then up to 2 years |
| IP address | Every request | Delivered by our network provider; used in memory only to rate-limit the suggestion box | Not written to our logs |
We don't receive your card number or bank details. Square collects them, along with your name, email, phone and address, under Square's privacy notice.
4. Cookies and similar technology
One cookie: a session cookie, set only when you sign in. Your browser's local storage holds your reading data (section 2) and, if you have Pro, your key. We use no analytics, advertising or tracking cookies today.
5. Who processes data for us
- Cloudflare — domain, network delivery and security for grimoire.meme.
- Brevo — delivers sign-in emails and forwards suggestions to us.
- Square — payments, receipts and subscriptions.
They process data on our behalf to provide the service. We don't currently share personal information with anyone else.
6. What we don't do today
- We don't sell or share your personal information.
- We don't show ads targeted at you. The free tier's banner is the same for everyone and is served by Grimoire itself.
- We don't use your documents or notes to train AI — we don't receive them (section 2).
7. Uses we plan for the future
As Grimoire grows we expect to fund it partly through data. We're telling you now so it's never a surprise. In the future we may:
- publish or sell aggregated, de-identified reading statistics (for example, average reading speeds or what kinds of material are read most) that can't reasonably be linked back to you;
- show personalised advertising based on how you use Grimoire;
- sell or share personal information with partners such as advertisers or data companies;
- use material from Grimoire to train AI models.
None of these happens until all of the following are true:
- this policy has been updated to describe that use specifically — what data, who receives it, and why — at least 30 days before it starts, with an email to account holders and a notice in the reader;
- for uses 2–4, we have asked for your opt-in consent where the law requires it (including in the EU and UK, and in US states that require it), and we offer a clear opt-out ("Do Not Sell or Share My Personal Information") everywhere else;
- for anyone we know is under 16, uses 2–3 happen only with opt-in consent; we will never knowingly do them for anyone under 13;
- for use 4, only with your separate permission, and never with text you don't have the rights to share.
Data we collected before such a change will not be used for that new purpose unless you consent.
8. Your rights
You can ask us to access, correct, delete, or give you a copy of your personal information, and (once any of section 7 is in use) to opt out of sale, sharing and targeted advertising. Depending on where you live — including California, other US states with privacy laws, the EU and the UK — you may have further rights, including to complain to your data protection authority. Email [email protected]; we'll respond within 30 days (45 where state law allows) and won't treat you differently for using these rights. Where EU or UK law applies, our legal bases are: performing our contract with you (accounts, Pro), our legitimate interests (security, rate limits, aggregated counters), legal obligations (payment records), and your consent (anything in section 7 that requires it).
9. Children
Grimoire is not for children under 13, and we don't knowingly collect personal information from them. If you think a child under 13 has given us information, contact us and we'll delete it.
10. Where data is stored and how it's protected
Our servers are in the United States, so if you use Grimoire from elsewhere your information is transferred to the US. Account data is stored on servers we control; Pro keys are stored only as one-way hashes; connections are encrypted with HTTPS. No system is perfectly secure; if a breach affects your personal information we'll notify you as the law requires.
11. Changes to this policy
We'll update this page and the date at the top whenever this policy changes, and give 30 days' notice of material changes as described in section 7.