Privacy policy

Who we are

This is the single privacy policy for all of StoryHoard: the weeb.ltd website and account, the StoryHoard browser extension, and the StoryHoard mobile app. The two app sections below describe what each app does with data; everything else applies across all three.

The data controller for StoryHoard is weeb.ltd. The postal address is available on request. For anything about your data write to privacy@weeb.ltd. Other addresses are on the contact page.

What we collect and why

You can read everything on weeb.ltd without an account, and the extension works without one. Nothing here applies until you sign up.

• Account. Your email address, a username, and which provider you signed in with (email and password, AniList, Google or Discord). Passwords are stored as scrypt hashes. Basis: contract, to run your account.
• Library metadata. Titles, reading status and chapter progress that the extension syncs when you link a device. Never the pages you read, never the sites' content. Basis: contract.
• Community. Posts, votes, follows, clubs, reports, and the profile fields you fill in. Basis: contract for the features you use; legitimate interest for keeping the community safe (moderation records).
• Community reading statistics. The titles and chapters you read, contributed to leaderboards, trending and recommendations, always in aggregate. This is opt-in: off until you turn it on, off with the same switch. Basis: consent.
• Usage analytics. How you use the apps and site: screen and feature views, taps, app version, platform and coarse locale. It is first-party and self-hosted, tied to a pseudonymous id derived from your account (not your name or email), never sold and never shared for anyone else's purposes. It carries no reading content and no free text. This is on by default for adult accounts so a small team can see what to fix and build; it is off by default for under-18 accounts. Basis: legitimate interests (Article 6(1)(f)). You can object and turn it off at any time in Settings on weeb.ltd; one switch covers the site, extension and mobile app. Personalised recommendations and any marketing are separate and stay strictly opt-in.
• Security records. Session IP addresses (shown to you masked), browser type, sign-in times, and an audit log of moderation and account actions. Basis: legitimate interest in preventing abuse.
• Supporter payments. Handled by Stripe. We keep your Stripe customer id and subscription state, never card details.

The browser extension

• It runs on your own device and reads only the pages of the third-party sites you choose to open. Those pages, and the fact that you read them, stay on your device and are never sent to us.
• Without an account it keeps your library, reading progress and settings locally only.
• If you link a weeb.ltd account, it uploads library metadata (titles, source links, reading status and chapter progress) and the per-title fields you set (notes, tags, content flags, ratings, reader preferences) so they sync across your devices. It never uploads page images or the content you read.
• Community reading statistics (what you read, for leaderboards and trending) are opt-in and off until you turn them on.
• Usage analytics (which screens and features you use) are on by default for adult accounts as described above, first-party and self-hosted; turn them off in your weeb.ltd account settings and the extension honours it. On Firefox, the store also asks at install before any usage data is collected.
• It checks for updates and may fetch site announcements; that request carries only what any web request does (an IP address and the version), and is not used to profile you.

The mobile app

• The StoryHoard mobile app stores your library, tracking, ownership and wishlist in your account so they sync with the extension and the website. Usage analytics are on by default for adult accounts (off for under-18s), on the same legitimate-interest basis, and the same weeb.ltd account opt-out switches them off here too.
• It currently runs on a transitional backend while it moves onto the weeb.ltd platform; the same rights and controls in this policy apply throughout.

How long we keep it

A nightly job enforces these windows; the console shows the owner when it has not run.

Who else sees it

• Resend sends account email (verification, password reset, deletion notices, digests you opt into).
• Stripe processes supporter payments.
• AniList, MangaDex and MyAnimeList provide title metadata and cover art. Covers on Discover, the home page and title pages are fetched by our server and served from weeb.ltd, so those sites do not see your address. Covers in your synced library load directly from the reading site they came from, with no referrer; that site sees a request from your browser.
• Retailers and official readers receive nothing from us. A buy link takes you to their site; some links carry an affiliate tag, as the affiliate disclosure explains.

The server is in the European Union. We do not sell your personal data, and we do not share it with anyone not listed here unless the law requires it. If we add a new partner, it is named on this page before it receives anything.

Advertising and marketing

Today: weeb.ltd and the apps show no ads, and we place no advertising cookies or tracking pixels on the site. We do promote StoryHoard on other platforms, such as social networks and search engines.

• Ads you see elsewhere. When you see or click one of our ads on another platform, that platform handles your data under its own privacy policy. We receive only aggregated campaign reports from them (for example, how many people clicked), not who you are.
• Campaign links. Links from our ads and posts can carry campaign tags (such as utm_source) so we can count which campaigns bring visitors. These are recorded in the first-party usage analytics described above and follow the same rules and the same opt-out.
• If we add advertising or measurement partners later (for example Google Ads or Meta), we will name them here before they go live; load them only after you agree, wherever the law requires consent (including the UK and EU); give you a cookie settings control to change that choice at any time; and treat a Global Privacy Control signal from your browser as an opt-out.
• What we will not do. Your reading history, library and community reading statistics are never used to target ads without your separate, opt-in consent. Accounts of people under 18 are never used for ad targeting or shared with advertising partners.
• Marketing email. We only send marketing email if you opt in, and every one has an unsubscribe link. Account email (verification, security, deletion notices) is not marketing.
• US state privacy laws. We do not "sell" personal data or "share" it for cross-context behavioural advertising as those laws define the terms. If that ever changes, a "Your privacy choices" link will let you opt out, and browser opt-out signals will be honoured.

Cookies and similar technologies

• Strictly necessary (always on). Your session, a short session cache, the sign-in state during a provider login, a two-factor step, your theme, and your chosen region for buy links. The site cannot work without these, so they do not need consent.
• Analytics. The usage analytics described above are first-party and server-side. They do not use cookies, and you can turn them off in Settings.
• Advertising and marketing. None today. If we ever use them, they stay off until you agree, and you can change your choice at any time from a cookie settings link at the bottom of every page.

Because only strictly necessary cookies are used today, there is no cookie banner. If we add anything that needs your consent, we will ask before it runs.

Children

The service is all-ages and readable without an account. Accounts are for people aged 13 or over, or older where your country sets a higher minimum age for digital consent; creating one confirms that. If a parent or guardian tells us a younger child has an account, we delete it. Write to privacy@weeb.ltd.

Your rights

• Access and portability. Settings has an "Export my data" button that downloads everything as JSON.
• Correction. Profile and settings are yours to edit at any time.
• Erasure. Settings has "Delete my account". Deletion is scheduled 7 days out: you are signed out everywhere, your profile and posts are hidden, and signing in again within that window cancels it. After the window your account and library are removed and your posts become anonymous "[deleted]" entries so other people's conversations keep their shape. A hash of a banned email is kept so a ban cannot be cleared by deleting and re-registering.
• Objection and withdrawal. Every optional processing has a switch in Settings. Turn it off and the processing stops.
• Complaints. Write to privacy@weeb.ltd first. You can also complain to your local data protection authority; in the UK that is the Information Commissioner's Office.

Security

Passwords are hashed and checked against known breaches at sign-up. Staff accounts require two-factor authentication. Sessions can be reviewed and revoked from Settings. Report a vulnerability through security.txt.

Changes

When this page changes in a way that matters, the date at the top moves and the change is listed below. For significant changes to how your data is used, we also tell account holders by email or a notice on the site before the change takes effect. Where a change needs your consent, we ask for it rather than assume it.

• 28 September 2026. Added the Advertising and marketing section and set out cookie categories, so the rules are clear before any advertising partner is ever used. Nothing we collect today changed.