Privacy Policy

1. Introduction

The Founders Ltd is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, Scrolls ("the App") for iOS and Android, and our marketing website and newsletter. The Founders Ltd is the controller of the personal information described here.

This policy explains our data practices and your choices. It does not replace a request for consent where consent is required. You can contact us about your information using the details in Section 14.

We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. We encourage you to periodically review this page for the latest information on our privacy practices.

2. Information We Collect

We collect information to provide features of the App and to operate our services. The information we collect falls into the following categories:

2.1 Information You Provide to Us

Account Registration Information. When you create an account, we collect:

• Email address. Used for account creation and authentication, including email one-time passcodes (OTP) and the email supplied by your chosen sign-in provider.
• Google and Apple account information. If you choose to sign in using Google OAuth, we receive your name, email address, and profile picture from Google in accordance with Google's OAuth scope. If you choose to sign in using Sign in with Apple, we receive your name and email address, which may be an Apple private relay email address, in accordance with Apple's OAuth scope. Your interaction with Google or Apple is governed by the applicable provider's privacy policy.
• Username. You select a username during the onboarding process. This username is visible to other users of the App in social features, including friend lists, book clubs, and discussion posts.
• Avatar. An optional profile image. If you sign in via Google, your Google profile picture may be imported. Your avatar may be shown with your profile in social features.
• Display name. An optional field that may be shown to other users in social features.

Content You Create. When you use social features, we collect and store:

• Messages and posts you publish in book club discussions
• Bookmarks you create, including any optional labels
• Reports you submit regarding other users, including the reported user's identifier, the reason for the report, and contextual information

Communications. If you contact us via email or any other channel, we retain a record of your communication in order to process your enquiry.

2.2 Information Collected Automatically

Reading Activity Data. The App collects data about your reading activity in order to deliver core functionality:

• Reading progress. Your current position within each book, measured by chunk index and total chunk count.
• Reading statistics. Experience points (XP) earned, total chunks read, number of books finished, current streak count, longest streak, and the date of your last reading session.
• Library data. Which books you have added to your personal library and the dates they were added.
• Bookmarks. The position within a book at which you placed a bookmark and any associated label.
• Daily activity. The number of scrolls performed per day and the dates on which achievements were unlocked.
• Session history. Records of scrolls and time spent reading per book, used to power reading statistics and gamification features.
• Completed books. A list of books you have finished, along with the date of completion and the last-opened timestamp for each book.

Reading data is stored locally on your device. When you sign in, your library, progress, bookmarks and supported reading statistics are also synced to our cloud infrastructure. Some details, such as local session history and preferences, remain on the device. Signing in after reading as a guest merges supported local reading data into your account.

Social Activity Data. When you use social features, we store:

• Friend relationships (mutual connections) and pending friend requests
• Your list of blocked users
• Book club memberships, including your role within each club (owner or member)

2.3 Device and Application Data

Local Preferences. Certain settings are stored exclusively on your device and are never transmitted to our servers:

• Dark mode / light mode preference
• Reader font size selection
• Dictionary lookup toggle state
• Context preview toggle state

Cached Content. The App caches the following data locally to support offline reading:

• Book content (text chunks for books you have opened or added to your library)
• Poems cached for offline use; publisher-selected poems have a 30-day cache lifetime and are removed when a successful refresh finds no published poem
• Dictionary lookup results, stored in an in-memory cache capped at 500 entries

The App attempts to delete cached book files when you remove a book or sign out. Device preferences and downloaded voice models may remain after sign-out. Local files and preferences use your device’s storage and may be included in device backups.

2.4 Product Analytics and Network Data

When analytics is enabled in the app build, usage events include book identifiers, reading-session duration, passage counts and feature use. Events use a random installation identifier rather than your account details. This is pseudonymous data, not guaranteed anonymous data. See Section 9.

Requests to our servers and external content providers reveal your IP address and request information, such as the resource requested and device or software headers. These providers may process technical logs to deliver and secure their services.

2.5 Website Newsletter

If you subscribe on our website, we store your email address and a signup timestamp in Supabase to send Scrolls news, launch updates and occasional poems. The website asks you to tick a consent checkbox. Our signup service also uses a hash derived from your IP address and request timestamps to limit repeated submissions.

To withdraw newsletter consent or request removal from the list, email[email protected].

2.6 Website Feedback Questionnaire

Our optional feedback questionnaire collects your answers to multiple-choice questions about your social media and reading habits, your impressions of Scrolls and your age range, and any free text you choose to write. Answers are stored in our Supabase database (hosted in the UK) and can be viewed only by the Scrolls team. Without an email address, your answers are not linked to you or your Scrolls account. To limit abuse, our submission service uses a hash derived from your IP address and request timestamps; these records are deleted after one day.

You may also give your email address. It is optional and used only for what you tick:

• Follow-up questions. We store your email address with your answers so we can contact you with follow-up questions about your answers (for example, an invitation to a short interview).
• Early access. We store your email address with your answers so we can invite you to try new features or test versions of the App before release.
• Newsletter. If you also tick the newsletter box, your email address is added to our newsletter list as described in Section 2.5.

Each option is a separate choice. You can withdraw any of them at any time by emailing[email protected]. When you withdraw both follow-up and early-access consent, we delete your email address and the answers linked to it.

3. How We Use Your Information

We use the information we collect to provide, maintain, and improve the App, and to operate our services. Specifically, we use your information for the following purposes:

• Account management. To create and manage your account, authenticate you when you sign in, and maintain your profile settings.
• Service delivery. To provide core reading functionality, including delivering book content, tracking your reading progress, and enabling bookmarks.
• Cross-device sync. To synchronise your reading progress, library and bookmarks across your devices when you are signed in.
• Social features. To enable friend connections, book club creation and membership, discussion posts, and the display of other members' reading progress within clubs.
• Gamification. To calculate and display experience points, streaks, achievements, and reading statistics.
• Content delivery. To fetch book content from our content providers, retrieve dictionary definitions, and serve weekly poems.
• Moderation and safety. To process user reports, enforce community guidelines, and maintain a safe environment for all users.
• Newsletter. To send the updates you request and handle subscription and removal requests.
• Product feedback. To understand how people use and value Scrolls from questionnaire answers and, where you have agreed, to contact you with follow-up questions and early-access invitations.
• Technical operations. To ensure the App functions correctly, diagnose technical issues, and maintain the security of our infrastructure.

We do not use your personal information for behavioural advertising, targeted advertising, or any form of profiling for marketing purposes.

4. Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases under the GDPR and UK GDPR:

• Contractual necessity. Processing is necessary for the performance of our agreement with you to provide the App's services (e.g., storing your reading progress, managing your account, delivering content).
• Consent. For newsletter messages you request, for storing and using the email address you give in our feedback questionnaire, and for other processing where consent is required. You may withdraw consent by contacting us. Authorising Google or Apple sign-in allows that provider to share sign-in information; it is not blanket consent to unrelated processing.
• Legitimate interests. Processing is necessary for our legitimate interests, including maintaining the security and integrity of our services, moderating user content, and improving the App, provided these interests are not overridden by your data protection rights.
• Legal obligation. Processing is necessary to comply with applicable legal obligations.

5. Sharing and Disclosure of Your Information

We do not sell, rent, or trade your personal information. We share your information only in the circumstances described below:

5.1 Service Providers

We use the providers below for infrastructure, authentication, content and analytics. Authentication and external content providers may also process requests under their own privacy policies. Network requests include the technical information described in Section 2.4.

5.2 Other Users

When you use social features, certain information about you is visible to other users of the App:

• Other signed-in users can search for your username. Profile visibility settings control additional profile and reading information shown through social features.
• Your username and avatar are visible to users with whom you are connected as friends and to members of book clubs you join.
• Your display name (if set) is visible in the same contexts.
• Your reading progress within a book club is visible to other members of that club.
• Messages and posts you publish in book club discussions are visible to other members of that club.

5.3 Legal Requirements

We may disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government regulation). We may also disclose information when we believe in good faith that disclosure is necessary to protect our rights, enforce our terms of service, protect the safety of users, or investigate fraud.

5.4 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the App of any such change in ownership or control.

6. Data Storage, Security, and Retention

6.1 Security Measures

We implement industry-standard technical and organisational measures to protect your personal information:

• Encryption in transit. All data transmitted between the App and our servers is encrypted using HTTPS.
• Encryption at rest. Data stored in our database is encrypted at rest through Supabase's infrastructure.
• Secure authentication. We use the PKCE (Proof Key for Code Exchange) flow for OAuth authentication. No passwords are stored directly by Scrolls — authentication is handled via a one-time passcode sent by email, Google OAuth, or Sign in with Apple.
• Local storage. Preferences and reading records use platform-native storage; book content and voice models are stored as files. These stores are not a separate encrypted vault provided by Scrolls.
• Access controls. Database access is governed by Row Level Security (RLS) policies intended to restrict private data to authorised users while allowing public catalogue and permitted social information to be shared.

No method of electronic storage or internet transmission is absolutely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable law.

6.2 Data Retention

We retain your personal information for as long as your account is active or as needed to provide the App's services. Specifically:

• Active accounts. Account data and reading activity data are retained for the duration of your account.
• Account deletion. The in-app deletion action marks your account as deleted, removes friendships and club memberships, and deletes clubs you own. It does not immediately erase your sign-in record, profile or reading data. Posts in clubs owned by other people may remain. Contact us if you want to request permanent erasure.
• Recovery window. The App supports account recovery for 365 days after deletion. Removed friendships and clubs are not restored. We cannot currently guarantee automatic permanent erasure at the end of that period; you can request erasure using the contact details below.
• Newsletter. Signup records have no automatic expiry in the current service. Contact us to withdraw consent and request removal. Rate-limit records older than one hour are cleaned up during subsequent signup requests.
• Feedback questionnaire. Anonymous answers are kept for as long as they help us improve Scrolls. An email address you give for follow-up questions or early access has no automatic expiry in the current service; we delete it and the answers linked to it when you withdraw consent.
• Local data. Local account data is cleared on sign-out, and cached book-file removal is attempted. Preferences, other caches and voice models may remain until removed or the App's data is cleared. Device backups have their own retention settings.

7. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal information. This section summarises those rights. Where your rights arise from specific legislation, we note the relevant law.

7.1 General Rights

• Account settings. Use the available profile settings to manage your profile, or contact us to request a correction.
• Account deletion. You may delete your account at any time. See Section 6.2 for what this removes, what may remain and how to request permanent erasure.
• Guest mode. You may use the App without creating an account. In guest mode, your library and progress remain local until you sign in. Content requests and analytics, when enabled in the build, can still send information described in Sections 2.4 and 9.

7.2 Rights for EEA and UK Users (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the following rights:

• Right of access (Article 15 GDPR). You may request a description of the personal data we process about you and a copy of that data.
• Right to rectification (Article 16 GDPR). You may request that we correct inaccurate or incomplete personal data.
• Right to erasure (Article 17 GDPR). You may request the deletion of your personal data ("right to be forgotten") where there is no compelling lawful ground for continued processing.
• Right to restrict processing (Article 18 GDPR). You may request that we suspend the processing of your personal data in certain circumstances.
• Right to data portability (Article 20 GDPR). You may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object (Article 21 GDPR). You may object to the processing of your personal data where we rely on legitimate interests.
• Right to withdraw consent (Article 7(3) GDPR). Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority. If you are in the UK, you may complain to the Information Commissioner's Office (ico.org.uk).

7.3 Rights for California Users (CCPA / CPRA)

If you are a resident of California, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know. You may request information about the categories and specific pieces of personal information we have collected, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share your information.
• Right to delete. You may request deletion of personal information we collected from you, subject to certain exceptions.
• Right to opt out of sale or share. We do not sell personal information or share it for cross-context behavioural advertising. Service-related disclosures are described in Section 5.
• Right to limit use of sensitive personal information. We do not use sensitive personal information beyond what is necessary to provide the App's services.
• Right to non-discrimination. We will not discriminate against you for exercising your CCPA/CPRA rights.

7.4 How to Exercise Your Rights

To exercise any of the rights described above, or to ask questions about how we process your data, please contact us at [email protected]. We will respond to verified requests within the timeframes required by applicable law.

8. Read Aloud

Read Aloud turns book text into speech. It offers your device’s built-in voices and an optional downloaded neural voice:

• Built-in voices use your operating system’s text-to-speech service. Availability and any network processing depend on the selected voice, engine and device settings; consult that provider’s privacy information.
• An optional higher-quality neural voice engine downloads a voice model file (approximately 82 MB) once from our Supabase Storage, verifies its checksum, and caches it locally on your device.
• The downloaded neural engine synthesises speech locally and does not send book text or generated audio to a speech server. Downloading books, voice models and previews still makes network requests.
• After the optional voice model download, the neural voice engine does not require an internet connection for speech synthesis.
• The App does not request microphone access and does not record audio.

9. Analytics and Tracking

Builds configured with PostHog send product usage events to help us understand reading and feature use. Events include books opened or completed, book identifiers, passages read, session duration, voice type and social-feature actions. A book identifier can reveal which book you read. Analytics can operate in guest mode as well as when signed in.

• Events use a random installation identifier, allowing activity from the same installation to be linked. The App does not deliberately attach your account ID, email or username to these events.
• The App disables PostHog person profiles and session replay. Our custom events do not include book text, dictionary queries or discussion message bodies.
• The analytics SDK may include technical device and app information. Network requests expose your IP address to the receiving service; we do not promise that it is discarded before logging or location processing.
• The default analytics endpoint is PostHog’s EU service. Analytics is disabled in builds without an analytics project key.
• The App currently has no in-app analytics consent or opt-out control. Contact us with questions or requests about analytics data.

We do not use these events for targeted advertising or deliberately combine them with your account data. A random identifier does not by itself make reading activity anonymous.

This marketing website does not include third-party analytics or advertising trackers. The website loads fonts from Google Fonts, which receives font requests and network information. Newsletter submissions and ordinary website requests also transmit network information needed to provide those services.

Our optional feedback questionnaire does not use analytics or cookies. Answers are sent to our own database, as described in Section 2.6.

10. Device Permissions

The Android app declares permissions for the following functions:

• Background audio. Foreground-service, media-playback and wake-lock permissions support Read Aloud while the screen is off or another app is open.
• Notifications. The Android manifest includes notification permission for playback-related functionality. Availability depends on your Android version and notification settings.
• Internet access (Android: android.permission.INTERNET). Required for authenticating your account, synchronising reading progress, fetching book content, retrieving dictionary definitions, and delivering weekly poems.

The App does not request access to your camera, microphone, location, contacts, phone state, SMS or calendar. It stores downloaded content in app storage. On iOS, background audio is enabled for Read Aloud; the App does not record microphone audio.

11. Children's Privacy

The App is not directed to children under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect, maintain, or use personal information from children under 13, and no part of the App is designed to solicit personally identifiable information from children under 13.

The current App does not verify age or provide a parental-consent flow. If we learn that a child under 13 has provided personal information, we will take steps to delete that information promptly.

If you believe that a child under 13 has provided us with personal information, please contact us at [email protected].

12. International Data Transfers

Your personal information may be processed in countries other than the country in which you reside. The countries where our service providers operate (including the United States) may not have data protection laws equivalent to those in your jurisdiction.

Transfers from the UK or European Economic Area require the applicable legal safeguards, such as an adequacy decision or approved contractual protections. Contact us for details of the hosting locations and transfer safeguards applicable to your information, and how to obtain a copy of those safeguards.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal developments, or other factors. When we make material changes, we will notify you through the App (e.g., via an in-app notice) or by email before the changes take effect.

We indicate the date this Privacy Policy was last updated at the top of this page. We encourage you to review this policy periodically. Where a change requires your consent, updating this page alone does not provide that consent.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

The Founders Ltd
Email: [email protected]

We aim to respond to all enquiries within three business days.