Privacy

Short version: accounts are optional and off by default, so nothing you save leaves your device unless you choose to sign in. No ads, no sale of personal data, and no cookies unless you sign in. Last updated 25 October 2026.

What this site counts

We use Cloudflare Web Analytics to count visits: which pages are read and roughly where visitors come from. Cloudflare describes it as cookie-less and says it does not use client-side storage or fingerprinting to build a profile of a person. We use the totals to see which texts are read; we do not look at individuals and we do not sell or share the data. Cloudflare also serves the site and, like any host, handles the technical details of a request (such as the IP address) to deliver pages and block abuse, under its own privacy policy.

What stays on your device

The reader remembers your theme, reading position, saved verses and any diary notes in your browser’s local storage, and keeps an offline copy of pages through a service worker. Unless you sign in (next section), this data is on your device only; the site has no server that receives it, and clearing your browser’s site data removes it.

Optional accounts

You never need an account. If you want your saved verses and notes on more than one device you can sign in with your email address. There is no password: we email you a one-time link that works once and expires in 15 minutes.

What is stored on our server if you sign in:

• your email address;
• the things you chose to keep: saved verses (with the verse text and reference), your notes on them, your diary entries, your reading position, and a few settings (theme, text size, listening speed and pace and similar);
• a hash of your current sign-in session on each device, and, for a short time, a hash of an unused sign-in link;
• abuse-limit counters keyed by a hash of your address and connection, not the address itself, kept for at most two days.

What is not stored: any password (none exists), your search history, which chapters you read or listen to, or any profile of you. Signing in does not change how the Cloudflare visit counter above works.

Cookie. Signing in sets one cookie, tbm_session. It is HttpOnly, sent only to this site’s sign-in and sync addresses, and lasts 30 days (renewed when you use it). Signing out removes it. Nobody who has not signed in is given a cookie.

Who handles it. The data is held in a Cloudflare D1 database in our Cloudflare account. The sign-in email is sent through Resend, which therefore sees your address and the message. We do not sell or share the data, and we do not use it for advertising.

Keeping it, taking it, deleting it. Your data is kept until you delete it. On the Account page you can download everything held for you, sign out, or choose Delete my account and data, which immediately and permanently removes your email address, your items and all your sessions from our database. Items you delete yourself are kept as small deletion markers, without their content, for up to 90 days so your other devices learn of the deletion, and then removed. Copies already in your own browsers are not touched and remain yours. Cloudflare’s database platform keeps point-in-time recovery history for a short period (up to 30 days), so deleted data can persist there until it ages out. If you cannot use the page, write to us and we will delete it by hand. We do not currently delete inactive accounts automatically.

Other services your browser contacts

• Internet Archive (archive.org) — when you play the recorded reading, your browser fetches the audio from there, so it sees your IP address and the file requested, under its terms.
• Kick and decapi.me — the front page checks whether our streams are live by asking kick.com and decapi.me (a Twitch uptime lookup). Those requests carry no cookies from us, but those services see your IP address.
• Links out — YouTube, Twitch, Kick and GitHub. Once you follow a link, that site’s policy applies.

What we do not do

• No required accounts, newsletters or advertising, and no sign-up wall.
• No selling or renting of personal data, and no data brokers.
• No health, location or other sensitive data is asked for or collected.

• Email. If you write to us, we keep your message and address only to reply and to fix what you reported. They are not shared or sold.

Questions about any of this? Ask through the contact address on the Contact page. If this page ever stops matching how the site works, that is a bug we want to hear about.