Who the operator is
Whoever runs this deployment. The software runs in one Cloudflare account; the operator of that account is the party responsible for the content and records described below. On a self-hosted install, that is you.
What we collect from authors
| Data | Why | Retention |
|---|---|---|
| Email address | Sign-in and the optional digest | Until the account is deleted |
| GitHub account id | Sign-in, if you use it | Until the account is deleted |
| API key hashes | Authenticating requests | Until the key is revoked |
| Session cookies | Keeping you signed in to the dashboard | Until expiry or sign-out |
What we store for published pages
The files you upload, in object storage, plus a record: title, expiry, gate settings, counters and timestamps. Content is stored so that it can be served — nothing more is done with it. The record is exactly what the API hands back to you:
curl https://read.botook.ai/sites/SITE_ID -H "Authorization: Bearer otr_live_YOUR_KEY"Nothing is held that does not appear in that response.
Sensitive content
Documents are scanned at publish time for identity numbers, card numbers, phone numbers and dense lists of email addresses, and the publish is refused by default if any are found. The scan is transient: nothing about it is retained beyond the decision.
What we collect from viewers
- Aggregate counters: opens, unique viewers, dwell, scroll depth, read-to-end.
- Reactions and feedback that a viewer chose to submit.
- An email address, only when a page uses a work-email gate and only to confirm the open.
Not collected: keystrokes, mouse paths, session recordings, cross-site identifiers, or an advertising profile of any kind.
Retention and deletion
Engagement rows and feedback belong to the page. Delete the page — or let it expire — and they are removed with it. Expiry is deletion of the record and the stored object, not concealment.
Sub-processors
| Provider | What it handles |
|---|---|
| Cloudflare | Runtime, database, object storage, delivery |
| Resend | Outbound email: one-time sign-in links, gate confirmations, the digest |
| GitHub | Optional sign-in, if you use it |
There is no payment processor, because there is no billing. There is no analytics vendor and no advertising network — the engagement numbers are computed by this service and stay in its own database.
Cookies
Two, both functional: a session cookie for the dashboard, and a short-lived
cookie recording that a viewer passed a password or email_gate_domain
check so they are not asked again on the next page load. No tracking cookies, no third-party
cookies, and no consent banner, because there is nothing here to consent to.
You can confirm the second claim from outside without taking our word for it — the headers on a viewer response say what is set and what policy applies:
curl -sD- -o /dev/null https://read.botook.ai/p/UNLISTED_TOKEN/ \
| grep -iE 'set-cookie|referrer-policy|x-robots-tag'End-to-end encrypted pages
When you publish encrypted, the key stays in the URL fragment and never reaches the server, so the stored bytes are ciphertext and the operator cannot read them — including for support.
Your rights over your data
Export it through the API, delete any page at any time, and delete the account to remove everything at once. Deletions are hard deletes; there is no archive to restore from.
Changes to this policy
Material changes appear in the changelog. The version of this document that applies to you is the one your deployment is running.