1. Scope and who operates what
This policy applies to the Fiction Reader application and to this website. In it, "the maintainer" is the independent developer of Fiction Reader, and "the operator" is whoever installs or runs a particular copy. If you installed it for yourself, you are the operator.
The maintainer does not provide a Fiction Reader account, a hosted library, a sync server or a content service. The maintainer has no access to an operator's library, reading history, site logins, Google account, OAuth tokens or synced files, and receives none of them. An operator who runs Fiction Reader for other people controls that copy, and is responsible for administering it and for any privacy obligations that come with doing so.
2. This website
This site is static HTML, CSS and images. It has no accounts, forms, advertising, analytics, tracking pixels or cookies of its own, and it does not collect personal information.
The site is hosted by Cloudflare. To deliver and protect it, Cloudflare processes ordinary request information such as IP address, time, the page requested, browser details and abuse signals. Cloudflare's privacy policy governs that processing. Links to GitHub, Google and other sites lead to services with their own policies.
3. Data the application handles
Depending on which features the operator turns on, a Fiction Reader installation may hold:
- library details, the addresses of subscribed stories, author and site details, downloaded and cleaned chapter text, cover and chapter images, and earlier versions of edited chapters;
- ebook files the operator imports, and the chapters read out of them;
- profiles, reading positions and history, read and unread markers, annotations, notes, tags, collections, saved searches and reading preferences;
- job history, per-site settings, error details and logs;
- usernames, passwords or session cookies the operator supplies for third-party fiction sites;
- addresses the operator supplies for notifications; and
- Google OAuth credentials and sync or backup data, when Google Drive is connected.
This data is used only to provide the features described on the What it does page. The application does not use it for advertising, for profiling, for sale or for surveillance.
A server encrypts saved site logins and notification addresses before storing them, and its API never returns them. The operator controls the server, the encryption key, the devices, the backups, the profiles and who can reach it over the network. A Fiction Reader server is built for a trusted home network or a VPN and should not be exposed directly to the internet.
The optional browser extension sends the address of the story page you choose to subscribe to, and only to the Fiction Reader server whose address you entered in its options.
4. Google Drive data
Connecting Google Drive is optional. Fiction Reader requests one scope, https://www.googleapis.com/auth/drive.appdata, which Google classes as non-sensitive and describes as access to the application's own data folder. It does not ask for permission to see the rest of the user's Drive.
| Question | Fiction Reader's use |
|---|---|
| What can the app access? | Only the hidden appDataFolder that belongs to Fiction Reader's OAuth client. It cannot list, read or change any other file in the user's Drive. |
| What is stored there? | Only Fiction Reader's own data. For sync between devices, that is sync bookkeeping and the library's identity; reading positions and history; annotations, tags and collections; selected application and per-site settings; site logins or session records, already encrypted by the operator's installation; short-lived device-pairing messages; and copies of the user's own imported books when book sync is on. If the operator turns on a server's backup to Google Drive, the folder also holds backup copies of that server's whole library: its database, downloaded chapters and images, the same encrypted site logins, and imported books if the operator includes them. Unencrypted site passwords and the key needed to decrypt the encrypted records are never stored in Drive. |
| Why is it used? | Only for features the user sees and asks for: sync, device pairing, backup and recovery between copies of Fiction Reader the user controls. |
| Who receives it? | Google Drive stores it in the user's own account, and the user's authorised Fiction Reader devices read and write it. The maintainer does not receive it. |
| Is Google user data sold or shared? | No. Neither Fiction Reader nor the maintainer sells Google user data or shares it with third parties. It is not used for advertising, not passed to data brokers, and not used to train machine-learning models. |
The desktop app authorises through the system browser, with a loopback callback and PKCE. Its long-lived refresh credential is kept in the operating system's secure storage. It is never given to the web interface or to the Fiction Reader server process, and the sync engine receives only a short-lived access token. In the standalone Android app, the short-lived Drive access token is held in native memory only. It is not passed to the web layer or stored by it. A server that backs up to Google Drive keeps its refresh credential in its own database, encrypted with the operator's encryption key. No OAuth token and no encryption key is ever placed in Drive.
Fiction Reader's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Third-party fiction sites
When the operator turns on a supported site, the installation sends requests directly to that site to search it, sign in, read story details and download the works the operator chooses. The site sees the network and account information that normally comes with such requests, and its own privacy policy and terms apply.
Fiction Reader never sends site logins to the maintainer. It gives no access beyond what the operator's own account already has. It does not solve CAPTCHAs, it does not get past logins, paywalls or content the account cannot open, and it does not republish what it downloads. Some sites run an automated check that a visitor is using a real browser. Where the operator has made a browser available, Fiction Reader loads that page in it as any browser would. Otherwise it waits and tries again later.
7. Security
The project takes measures to reduce risk. They include encrypting saved site logins, keeping tokens in the operating system's secure storage, cleaning downloaded HTML, checking addresses before fetching them, confining file access to the application's own directories, keeping credentials out of logs, pacing requests conservatively, and asking Google for a narrow permission. No software or storage system can be guaranteed secure. The operator remains responsible for device security, server access, backups, encryption keys, updates, VPN configuration and the people allowed to use the installation.
8. Retention, revocation and deletion
Application data stays in the operator's database, content directories, device storage and backups until the operator removes it with the application's own controls, or deletes the installation and its backups. The maintainer holds no copy and so has nothing to delete.
A user can disconnect Google Drive in Fiction Reader. That removes the authorisation held on that device and stops sync there. The standalone Android app also has a separate Forget the local Drive library action, which deletes that device's standalone database, its book copies and its stored library key, and leaves the copy in Drive unchanged. To cut off every device at once, remove Fiction Reader on the Google Account connections page. Revoking access stops future API calls. It does not delete data already stored in the hidden folder.
To delete the Fiction Reader data held in Drive, open Google Drive's settings, choose Manage apps, find Fiction Reader, and use the option to delete its hidden app data. This removes the remote copy, and can make recovery or reconnection impossible. For a complete deletion, also delete the Fiction Reader data on each device separately. The support page has more detail.
9. Choices and privacy rights
The operator can choose not to connect Google Drive, not to sign in to any site, and not to turn on sync, backup or downloading. Application data is held by the operator and not by the maintainer, so a request to see, correct, export or delete it should be carried out in the installation itself, or sent to whoever operates it.
Anyone with a privacy question about this site or the software can use the contact route on the support page. Include enough detail for the question to be understood and answered. Do not send passwords, OAuth tokens or private library content.
10. Children
Fiction Reader is a general-purpose personal tool and is not directed at children. The maintainer does not knowingly collect children's personal information through this site. A parent or guardian remains responsible for a child's installation, accounts, site access and stored content.
11. Changes and contact
This policy will be updated when the application's handling of data changes, or when the law requires it. The effective date at the top identifies the current version. Before the application uses Google user data for any new purpose, this policy will be updated to say so.
For questions about this policy, use the contact route on the support page. This policy describes the project. It is not legal advice for an operator who runs Fiction Reader for other people.