Privacy

What this is

skipto.page is a book catalogue and reader. It is a personal project in beta, free to use, with no ads. We collect only what is needed to run your account, and this page lists all of it.

What we store about you

• Your email address and, if you chose a password, a hash of it. We never keep the password itself.
• If you sign in with Google, the Google account id and email address. We do not receive or keep anything else from your Google account.
• Your sessions: for each browser you are signed in on, a label from its user agent, its network address and when it was last seen. You can see them on your account page.
• Your marks on books: status, rating and dates, and your reading queue.
• Your theme choice and, if you set it, your display name.

Searches that find nothing are counted by day and text, with no account, session or address attached, and those counts are deleted after 30 days.

Like any web server, ours writes technical logs of requests to keep the site running and to fix faults.

Cookies and browser storage

We set one cookie, the session cookie that keeps you signed in. While you sign in with Google, a short-lived cookie guards that exchange. Nothing optional is set, so there is no consent banner. We do not use localStorage or similar browser storage.

The pages load no analytics, no tracking and no third-party scripts. Cover images are served from this site.

Your own storage and files

Connecting your own WebDAV storage and adding book files is a feature that is switched off for now. When it is on: we keep the storage address, your user name there and the app password, sealed with encryption, and small facts about each file: a hash, its format, its title and other metadata, and a reduced cover. The text of a book is never written to our database or disk. We pass the file through between your storage and your browser.

Your copy and deleting your data

From your account page you can download your marks, and your account details, as JSON or CSV.

You can also delete your account yourself, there, at any time. Deleting is immediate and cannot be undone. It removes your account, your sign-in methods, your sessions, your marks and queue, and, when the files feature is on, your storage connections and file records. An invitation you used stays in the administrators' list with its dates only, without your address, and any request for an invitation from your address is removed. Files in your own storage are never touched.

Backups of the database may still hold your data for a short time after you delete it.

Who sees your data

The administrators of the site can see accounts and sessions in order to run it. We do not sell or share your data. We send email only about your account: address confirmation, password reset and invitations.

Changes

When this page changes, the date above changes with it.