Your reading stays with you.

Files you open are read inside your browser and kept on this device. They stay there, and only there, until you choose to upload them — the first time you sign in with books already saved, NeuroLens asks, tells you exactly how many, and does nothing unless you agree. Declining leaves everything where it is.

Once you do upload, a book and everything you have done to it — highlights, notes, drawings, bookmarks, reading position and settings — are stored in your account so they reach whatever you next read on. A copy stays on the device, which is what lets you keep reading with no connection.

• Stored in NeuroLens's database, hosted by Supabase in Ireland, inside the EU.
• Encrypted on the way there, and encrypted where it rests.
• Readable by your account alone. The database refuses to return one reader's rows to another — a rule enforced by the database itself, not by application code that could forget.
• Never read by us for any purpose, never sold, and never used to train anything.

You can download all of it, or erase all of it, from your account at any time. Erasing removes it from your account and from this device.

With your permission, NeuroLens records anonymous events about how the app is used: which tab was opened, which file type was read, that a highlight or pen stroke was made, which setting changed. That is the whole list. It is off until you switch it on.

This is enforced by the code, not just promised. Every event is checked against a fixed list, and each field only accepts a handful of fixed values — a file type, a colour, a tool — so there is nowhere in an event for a book's text, a file name, a name or an email to go. Sizes and counts are rounded into ranges, and times to the hour. The same check runs again on arrival, so an event that is not on the list is refused rather than stored.

One more thing is measured: how quickly a page drew, how soon it answered a tap, and whether the text moved under you while you read. Those are kept only as good, needs work or poor — never the actual timings, which vary enough by device and moment to identify one.

• Events go to NeuroLens and nowhere else. There is no analytics company involved.
• The random number your device makes stays on it and is never sent or stored with an event.
• Nothing is attached to your account; there is no column for a person to go in.
• Switching analytics off deletes that number and everything recorded.
• If your browser sends Global Privacy Control or Do Not Track, you are never asked.
• The account page shows every recorded event, word for word, before it is sent.
• Events are deleted after 90 days, automatically. Nothing older than that answers the question "how is the app used", so there is no reason to keep it.

If part of NeuroLens fails while you are using it, it sends a short report so the fault can be found and fixed. This is separate from analytics above, and it is the one thing that is not switched off by default — a reading app that only hears about crashes from people who went looking for a settings page does not hear about them at all.

The awkward part is that an error message is written by whatever broke, and a file reader that chokes on a page will quote that page back in its complaint. So the message is rewritten on your device before it is sent: anything in quotation marks is replaced, along with every web address, every email address and every number. What is left is the shape of the fault — Unexpected token <q> in JSON at position <n> — which tells a developer what to fix and tells them nothing about what you were reading.

• What is sent: that rewritten message, which part of the app it came from, the list of components involved, and the app version.
• What is not: your account, your address, your name, your IP address, your browser, the page you were on, and any part of your text. The table it is stored in has no column for any of them.
• The same crash is sent once, not once per attempt, and at most ten per visit.
• Reports are deleted after 30 days — a crash report is useless once the version it came from is gone.
• Switching analytics off also stops these. If you have told NeuroLens not to send things, that covers this too, and a browser sending Global Privacy Control or Do Not Track is never asked and never reports.

Reading needs an account. Sign in with Google and they confirm who you are; NeuroLens never sees your password, and stores nothing from them but your name and email address. Your avatar is drawn on your device from a random seed — no photo is fetched or stored.

A few features reach other services, and only when you use them:

• Bible passages — bible-api.com and bible.helloao.org
• Library records — the British Library and Open Library
• Poems — poetrydb.org
• Word definitions — dictionaryapi.dev and datamuse.com

Those requests contain the passage, title or word you asked for, and nothing else.

• Uploaded text cannot run as code. Everything a file contains is escaped before it is shown, so a document built to smuggle in a script is displayed as plain text.
• Only the app's own code runs. A security policy tells your browser to refuse scripts from anywhere else and to connect only to the services named above.
• No third-party trackers or ad scripts, and HTTPS only.

Because a copy of your books stays on this device, its passcode and the browser extensions you trust protect them too — an extension allowed to read every site can read what a site stores. Your account password protects the other copy, which is why signing in uses Google rather than a password we would have to hold.

Get in touch, or read the terms.