Privacy Policy

1. Overview

Vellum ("we", "us", "our") respects your privacy. This policy explains what data we collect, how we use it, and your rights regarding that data.

2. Data We Collect

• Account information: Your email address, name when you provide it, and Vellum account identifier. This is stored in Supabase, our authentication and database provider.
• Subscription data: Plan type, billing dates, payment status, and subscription identifiers. Website subscriptions are processed by Stripe; App Store subscriptions are processed by Apple. We never see or store your full credit card number.
• Reading data: Books, reading sessions, goals, statistics, and other library data you create in the iPhone app. This data is stored on your device and can sync through iCloud/CloudKit. When you use a registered Vellum account, Vellum also syncs account-linked reading and progress data through Supabase to provide the service.
• Device, usage, and diagnostic data: We collect an installation or device identifier, app interactions (including searches and feature use), and crash or performance information through Firebase Analytics and Firebase Crashlytics. These services use identifiers to measure usage and diagnose problems; Vellum does not use them to track you across other companies' apps or websites.

3. How We Use Your Data

• To provide and maintain the Vellum service
• To process website subscriptions through Stripe and recognize App Store purchases
• To send transactional emails (receipts, account confirmations)
• To sync your reading data between your devices when you use iCloud
• To improve the App and diagnose crashes and reliability problems

4. Third-Party Services

We use the following third-party services that may process your data:

• Supabase — Authentication and database hosting
• Stripe — Payment processing
• Apple — App Store subscriptions and iCloud/CloudKit syncing
• Resend — Transactional email delivery
• Firebase — App analytics and crash diagnostics
• Vercel — Website hosting

Each service operates under its own privacy policy. We require service providers that process Vellum data to protect it appropriately and use it to provide their service. We do not sell your data to third parties.

5. Data Retention

We retain Vellum account and service data while your account is active. If you cancel a subscription, your account and data remain available unless you delete the account. When you delete a registered Vellum account, we remove its active Vellum account and server-side data. This does not automatically delete your library from your device or iCloud/CloudKit; use Delete All Reading Data in the app for that. Apple and Stripe retain purchase records under their own policies, and limited copies may remain in secure backups for normal backup cycles.

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Delete your registered Vellum account and its server-side data
• Export your reading data

To delete a registered Vellum account, open Settings > Subscription > Delete Account in the iPhone app. To erase your device and iCloud reading library, open Settings > Data > Delete All Reading Data. To exercise any of these rights or ask a question, contact us at support@vellumread.com.

7. Children's Privacy

Vellum is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

8. Security

We use industry-standard security measures including encrypted connections (HTTPS), row-level security on our database, and secure authentication via Supabase. No system is 100% secure, but we take reasonable steps to protect your data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email. Continued use of the App after changes constitutes acceptance of the updated policy.

10. Contact

Questions or concerns? Contact us at support@vellumread.com.