Privacy Policy

1. Introduction

This Privacy Policy explains how MovaReader collects, uses, shares, and protects personal information when you visit our website, create an account, use learning features, participate in community features, or buy a subscription.

If you do not agree with this Privacy Policy, you should not use the Service. This policy is written for transparency under EU/UK data protection rules and US privacy expectations for a small online subscription service.

2. Data controller

Data Controller: Serhii Khomenko, a self-employed professional / autónomo registered in Spain, operating MovaReader as a product and trade name.

Privacy contact: serhii.khomenko2411@gmail.com. Full service-provider details are available in the Legal Notice.

3. Information we collect

We collect personal information that you provide directly, information created through your use of the Service, and technical information needed to operate, secure, and improve MovaReader.

The categories of personal information we may collect include:

• Account and authentication information: email address, password-based account data handled through Supabase Auth, account ID, and, if you sign in with Google, the email address, display name, and profile picture made available by your Google account.
• Profile and settings information: username, full name, avatar URL, interface language, target learning language, visibility-related profile fields, role, credits, and learning preferences.
• Learning and usage information: articles and books you read or mark as learned, words and phrases you save or study, training answers, spaced-repetition progress, bookmarks, notes, statistics, and subscription-gated feature usage.
• User-generated content: comments, support or direct messages, custom articles or lessons, pasted text, links, vocabulary entries, dictionary details, and other content you submit to the Service.
• Community and public-feature information: username, avatar, comments, leaderboard position, and selected learning statistics such as learned words, learning words, learned phrases, and reading progress when you use public or community features.
• Payment and subscription information: Stripe customer ID, subscription ID, plan, payment status, billing period, cancellation status, and limited checkout metadata. We do not directly store your full card number.
• AI feature inputs and outputs: words, sentences, pasted text, article links, generated learning material, translations, meanings, AI article credits, and audio/TTS generation requests sent to AI services when you use AI-powered features.
• Technical and analytics information: necessary session and OAuth data, language and reader settings, and your analytics-consent choice. With your consent, our self-hosted Umami service at stats.movareader.com records page paths without query strings or fragments, referring domain, browser and device type, operating system, language, screen size, and country. We do not send account IDs, email addresses, learning content, UTM parameters, or other custom user identifiers to Umami.

4. Legal bases for processing

For users in the EEA, UK, and similar jurisdictions, we rely on the following legal bases:

• Account creation, login, subscriptions, paid access, learning progress, saved content, and customer support: performance of a contract with you.
• Payment processing, billing records, tax, accounting, fraud prevention, and required legal records: performance of a contract and compliance with legal obligations.
• Security monitoring, abuse prevention, debugging, service reliability, and basic product improvement: our legitimate interests in operating and protecting the Service.
• Community features such as comments and leaderboards: performance of the Service you request and our legitimate interests in providing interactive learning features.
• Optional aggregate analytics through self-hosted Umami: your consent. You can withdraw it at any time through Cookie settings.
• Responding to legal requests, enforcing terms, and protecting rights: legal obligations and legitimate interests.

5. How we use your information

We use personal information for the purposes described below:

• To create accounts, authenticate users, maintain sessions, and provide secure access to the Service.
• To provide reading, translation, AI lesson, vocabulary, trainer, statistics, comments, leaderboard, support, subscription, and billing features.
• To maintain, secure, debug, measure, and improve MovaReader and to prevent fraud, abuse, unauthorized access, and policy violations.
• To send service, account, billing, security, support, and legal communications and to respond to lawful requests.

6. How we share information

We share personal information only where needed to provide the Service, process payments, authenticate users, run infrastructure, use AI features at your request, perform analytics with consent where required, comply with law, protect rights, or complete a business transfer.

We do not sell your personal information. We do not use your private learning content to build a public database of third-party articles.

7. Service providers and processors

We use third-party providers that process data for us or independently provide parts of the Service, including Supabase for authentication, database, storage, generated audio, images, and backend infrastructure; Stripe for checkout, subscriptions, billing, payment processing, and fraud prevention; Google services for Google login and Google Gemini / Generative Language API for AI translation, article, lesson, and audio features; and our self-hosted Umami analytics service at stats.movareader.com when you consent.

These providers may process information in the United States, the European Union, or other countries according to their own legal terms, privacy policies, data processing agreements, and transfer safeguards.

8. Public and community features

If you use comments, leaderboards, or similar community features, your username, avatar, comment text, and selected learning statistics may be visible to other users or public visitors. Do not include sensitive personal information in public comments or profile fields.

9. Cookies and similar technologies

We use necessary cookies, local storage, and session storage to keep you signed in, handle Supabase and Google OAuth sessions, store PKCE/OAuth callback data, remember language and reader preferences, save demo progress, and remember your cookie choice. With your consent, we load self-hosted Umami at stats.movareader.com for aggregate analytics. The tracker is configured not to include URL query strings or fragments and does not use analytics cookies. We store only the mr_analytics_consent_v1 choice in local storage for this purpose. You can accept, reject, or withdraw consent through Cookie settings.

10. How long we keep information

We keep account information while your account is active. Learning data, comments, subscriptions, and billing-related records are kept as long as needed to provide the Service, resolve disputes, enforce terms, prevent abuse, and comply with legal, tax, accounting, and payment obligations. Analytics records in our self-hosted Umami instance are retained until the controller deletes them; the service does not automatically expire those records. We may anonymize or aggregate information when it is no longer needed in identifiable form.

11. Account deletion and data requests

You may request account deletion or a privacy request by emailing serhii.khomenko2411@gmail.com. When your account is deleted, we will delete or anonymize personal information unless we must keep certain records for legal, tax, accounting, payment, security, fraud-prevention, dispute, or legitimate operational reasons. Public comments may be deleted, anonymized, or retained in a de-identified form where appropriate.

12. Your privacy rights

Depending on where you live, you may have rights to request access to your personal information, correction, deletion, restriction of processing, portability, objection to processing, withdrawal of consent, and a complaint to your local data protection authority. California and other US residents may also have rights to know, access, correct, delete, opt out of sale or sharing where applicable, limit certain sensitive information uses, and not be discriminated against for exercising privacy rights.

13. International data transfers

MovaReader and its providers may process and transfer personal information outside your country, including between the EEA/UK, Ukraine, Spain, the United States, and other locations where our providers operate. Where required, we rely on appropriate safeguards such as contractual commitments, data processing agreements, and standard contractual clauses or equivalent transfer mechanisms.

14. US state privacy notice

For US state privacy laws, the categories we collect are identifiers, account records, commercial/subscription information, internet or electronic network activity, user-generated content, approximate location inferred from technical data, and inferences from learning activity. We use these categories for the purposes described in this policy and disclose them to the provider categories listed above. We do not knowingly sell personal information.

15. Children

MovaReader is not directed to children under 13 and should not be used by children under 13. If local law requires parental consent for a younger user, the Service may be used only with valid consent from a parent or guardian. If you believe a child provided personal information without required consent, contact us so we can take appropriate action.

16. Updates to this policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date and will be effective when posted. If changes are material, we may provide additional notice where required.

17. Contact us

If you have questions, comments, or privacy requests, email us at serhii.khomenko2411@gmail.com.