This Privacy Policy describes how Hashtag Publishing LLC, publishing as Stan Taylor ("we", "us", "our"), collects, uses, and protects your personal information when you use the Stan Taylor mobile app and the web reader at my.stantaylor.com (together, the "App"), including the Readers' Room, the members-only community inside it. Our store, stantaylor.com, has its own privacy policy at stantaylor.com/policies/privacy-policy; this document governs the App.
The short version: no ads, no selling your data, ever, and nothing tracks what you read. Your highlights and notes are private to you. What you post in the Readers' Room is seen by signed-in members only, and it is checked for safety by an automated system before anyone sees it. You can delete your account and everything synced to it yourself, inside the App, at any time.
• Your email address, when you sign in. Sign-in works by one-time email code; there are no passwords, so we never store one.
• Your library activity, if you sign in: reading positions, listening positions, bookmarks, highlights, and the personal notes you attach to them. These sync to your account so your library follows you across devices. They are private to you: no other reader can see them, and no one at the company reads them in the course of normal operations.
• Purchases and claim codes. When you buy a book on stantaylor.com or redeem a claim code, we record which books your account owns. To unlock purchases automatically, we match the email you sign in with against the order email from our store records. If your order carried a phone number, we keep it with the order record for two uses only. When you ask, we can send your sign-in code by text to that number instead of by email. And if an email about your order cannot be delivered to the address you gave, we may send one text to that number with a link to check and correct your email address. We send no marketing by text, and we do not share the number with anyone for their own marketing.
• The devices signed in to your account: a random identifier for each installation, the device's name and model, its operating system version, the App version, the IP address and country or region it last connected from, and when it was first and last seen. This is what enforces the two-device limit and lets you sign a device out from Settings.
• Email delivery records. If you use "Email a copy" to send yourself or someone else a PDF, we log the recipient address and the time of sending, to prevent abuse and enforce sending limits.
• Basic technical data. Like nearly every internet service, our servers keep standard short-lived request logs (such as IP address and device type) for security and troubleshooting. If the App crashes or misbehaves, a crash and performance report (device model, OS version, App version, the steps the App was taking, and a random installation identifier, never your email, name, or account) is collected so we can find and fix the problem. The App does not collect your precise location or your contacts. It reads your photo library only when you choose a photo to attach in the Readers' Room, through the system picker, and adds an image to your photo library only when you explicitly save a quote card or wallpaper.
• Books you download are stored on your device so they work offline. They stay on your device and leave it only if you delete them, reset the App, or delete the App itself.
• The Readers' Room, if you enter it: your display name, which is by default the first and last name from your book order (taken from the order record and shown to signed-in members beside what you post) unless you switch once to a random name the App assigns; optional profile photo, short bio, and the colour or emoji you pick for your circle; the posts, comments, reactions, and private messages you write, and the photos you attach; who you block, mute, save, or report, and reports made about your contributions; the result of your age check and the method used (not your date of birth); the version and time of your acceptance of the Community Guidelines and Terms; moderation records about your contributions, including automated safety scores, decisions, strikes, and appeals; your email notification choices; the country of your device, used to decide where the Room is available; and the time of your last visit.
• No advertising networks and no advertising SDKs inside the App. The App shows no third-party ads.
• No analytics or advertising trackers inside the reader, the Library, the Readers' Room, the Store, or your account pages. The two exceptions are our promotional pages, described under "Advertising pages" below, and an arrival through a partner's link, described under "Partner links".
• We do not sell your personal information. On our promotional pages only, and only with your consent where the law requires it, we share limited browsing data with Meta and Google as described below, which some laws count as sharing for cross-context behavioral advertising. You can refuse or withdraw that at any time.
• The only artificial-intelligence processing of your personal data is the Readers' Room safety check described below. Your books, highlights, notes, and contributions are never used to train any model, ours or anyone else's.
• To run the App: deliver the books you own, sync your positions, bookmarks, highlights, and notes, unlock purchases tied to your email, and keep your devices within the limit.
• To run the Readers' Room: show your profile and contributions to other members, deliver private messages, check every contribution for safety before it appears, handle reports and appeals, apply the strike ladder, and keep the records the Community Guidelines and the law require.
• To send the emails you request: sign-in codes, PDF copies, and, if you turn them on, Readers' Room notifications.
• To reach you about an order when email fails: if an email about your order cannot be delivered, one text to the phone number on the order with a link to correct your email address.
• To provide support when you contact us, and to answer notices about content in the Room, including from people who are not members.
• For security: preventing fraud, abuse, and unauthorized access to books and to the Room.
• To comply with legal obligations, including the duty under United States law to report apparent child sexual abuse material to the National Center for Missing & Exploited Children.
Automated safety check by a third-party AI provider. Every post, comment, profile photo, and private message is sent to Anthropic, PBC (San Francisco, United States), which provides the Claude models, to be checked against the Community Guidelines before it is shown to anyone. We send the text and the photo, not your name, email, or account identifier. Anthropic processes this data as our processor under a data processing agreement and does not use it to train its models; it retains the data only as its API terms allow, and we have asked for the shortest retention it offers. Photos are stripped of hidden metadata, including location, before they are stored or shown. Decisions the automated system makes are shown to you as such, and you can ask a person to review any of them.
Who sees your contributions. Signed-in members of the Room, in the App and on my.stantaylor.com. Nothing you post is published on the open web or indexed by search engines. Staff (the author's team and the Room's moderators) can see held content, reports, and moderation records in a console; every staff action is written to an audit log.
Private messages. Messages are stored so the two members can read them. They are checked automatically before delivery. Our team does not read them unless one of the members reports the conversation, safety demands it, or the law requires it, and every such access is logged.
Blocks and mutes. A block is mutual and immediate; neither member is told who blocked whom. A mute hides a member from you only. Both bind to the account, so they survive name changes.
Email notifications. If you turn them on in the App, we email you when a member sends you a private message you have not read, or when the author posts in the Room. Emails are sent through Resend, Inc. Each email carries a one-tap link that turns that kind of email off.
Badges and pins. Staff may attach a badge to your profile (for example "Group expert") or pin one of your posts to the Room's sidebar. Both are visible to members; you can ask us to remove either.
We use a small number of service providers, each processing data only to run the App:
• Supabase, Inc. — our database, authentication, file storage, and server functions. Your account data, library activity, and Readers' Room content are stored in Supabase's Canada (Central) region, encrypted at rest.
• Cloudflare, Inc. — hosts the web reader at my.stantaylor.com, delivers audio files, and protects our services from attacks. Cloudflare sees the IP address of each request, as any web host does.
• Anthropic, PBC — performs the automated safety check on Readers' Room contributions, as described above.
• Apple — distributes the App through the App Store and TestFlight. The App sells nothing, so Apple never processes a payment for us.
• Expo (650 Industries, Inc.) — delivers over-the-air updates to the App's code. When the App checks for an update it sends the App version, platform, and a random identifier, and Expo sees the request's IP address.
• Resend, Inc. — delivers our transactional email (sign-in codes, PDF copies, Readers' Room notifications, and messages sent through our support form).
• Twilio Inc. — delivers our text messages: the sign-in code when you ask for it by text, and the order text described under "What we collect". Twilio receives the phone number and the message, and nothing else.
• Functional Software, Inc. (Sentry) — receives the crash and performance reports described above. Reports carry a random installation identifier, never your name, email, or account, and are used only to diagnose and fix problems.
• Shopify Inc. — runs our web store; we use order records from it to match purchases to your account email so your books unlock automatically.
• Meta Platforms Ireland Limited and Meta Platforms, Inc. — receive the advertising measurement events from our promotional pages described under "Advertising pages", through the Meta Pixel in your browser and Meta's Conversions API from our server.
• Google Ireland Limited and Google LLC — receive the Google Analytics events from our promotional pages described under "Advertising pages".
• Refersion, Inc. — the service that pays our partners; receives the partner-link visits and the order cart references described under "Partner links".
We do not disclose personal information to anyone else except: with your direction or consent; to comply with law or valid legal process; to enforce our terms or protect our rights, our members, or the public; or as part of a business transaction such as a merger, in which case this policy continues to apply.
Our database is in Canada. Our other providers process data in the United States. If you live in the European Economic Area, the United Kingdom, or Switzerland, this means your data is transferred outside your region: to Canada, which the European Commission recognises as providing adequate protection, and to the United States under the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-U.S. Data Privacy Framework where the provider is certified.
The Readers' Room safety check is automated, and it can hold or decline a contribution on its own. It never suspends or closes an account by itself: strikes, pauses, and closures are applied by a person, or follow a rule you can read in the Community Guidelines. Every automated decision is labelled as automated in the App, and you can appeal it so that a person reviews it.
Data moves over encrypted connections (TLS) and is encrypted at rest. Book files and Readers' Room photos are served through signed, expiring links. Access to the moderation console is limited to named staff and logged. No security is perfect, and we cannot guarantee it, but we design for the assumption that your reading life is nobody else's business. If you believe you have found a security issue, email hello@stantaylor.com.
• Account data, library activity, and Readers' Room profile: for as long as your account exists.
• Readers' Room contributions: until you delete them or your account. Deleted contributions are erased 30 days later, unless a report about them is open or a legal hold applies.
• Moderation records (decisions, scores, strikes, appeals): up to 12 months after the contribution is gone, with your identity replaced by a code. Reports you file keep your identity only while your account exists.
• Age-check results and acceptance records: for as long as your account exists; after deletion, the record that a check was made is kept without your identity.
• Device records: until you sign the device out, it is replaced under the device limit, or your account is deleted.
• Purchase and claim-code records: kept as business records (they are what lets a book you bought stay yours, and stay re-claimable).
• Server logs: short-lived. Crash reports: up to 90 days.
• Formal notices (copyright notices and counter-notices, intimate-image removal requests, trademark and illegal-content notices, legal process), with the name, email, address and statements the sender gave and the record of what we did: at least three years.
• Fingerprints (SHA-256 hashes) of images removed after an intimate-image request, a child-safety match, or a staff block: kept indefinitely so identical copies cannot be uploaded again. The hash cannot be turned back into the image; we do not keep the image.
• Reports you file about content: 12 months after they are reviewed. Notices the App sends you: 12 months.
• Staff audit records (who did what in the console, including exports and legal holds): 24 months.
• Anything under a legal hold, or that the law requires us to keep: for as long as that requires.
You can permanently delete your account inside the App: Settings → Delete account. This immediately and permanently erases your account and everything synced to it, including reading and listening positions, bookmarks, highlights, notes, and your Readers' Room profile, posts, comments, reactions, and the messages you sent (they disappear from the other member's inbox too). It cannot be undone. Moderation records are kept with your identity replaced by a code, as described above, and reports you filed are kept without your identity.
Purchase and claim-code records tied to your order email are retained as order records (this is also what lets you reclaim books you paid for if you ever return), along with anything we must keep for legal, tax, or fraud-prevention reasons. If you prefer, email hello@stantaylor.com from your account email and we will delete your account for you. You can also ask us for a copy of everything the Room holds about you.
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to appeal a decision we make about a request. Exercise any of these in the App where available, or by emailing hello@stantaylor.com. We will verify the request comes from the account email, respond within the time your law requires (30 days in most places, 45 days for California residents), and never discriminate against you for exercising your rights.
For readers in the European Economic Area, the United Kingdom, and Switzerland: our legal bases are performance of a contract (delivering the App, your library, and the Readers' Room you asked to enter), legitimate interests (security, keeping the Room safe, handling reports, service improvement, and support), consent where required (email notifications), and legal obligations (including content moderation duties and responding to valid legal requests). You have the right to obtain human review of an automated decision that affects you. You may lodge a complaint with your local supervisory authority.
For California readers: in the last 12 months we have collected the categories described above (identifiers such as email and device identifiers; commercial information such as purchase records; internet activity limited to service logs; and user content you create such as highlights, notes, and Readers' Room contributions). We disclose them only to the service providers named above, for the purposes described. We do not sell or share personal information as defined by the CCPA/CPRA, we do not use or disclose sensitive personal information to infer characteristics about you, and we do not knowingly collect information from anyone under 16.
For readers in Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Utah, and other U.S. states with privacy laws: you have the rights listed above, and you may appeal our decision on a request by replying to it; we will tell you the outcome and how to reach your state's attorney general. For readers in Brazil, Canada, Australia, and elsewhere: we honour the rights your law gives you through the same address.
The App is for adults. It is not directed at children, we do not knowingly collect information from anyone under 18, and the underlying content carries an 18+ eligibility requirement. The Readers' Room checks age before entry and closes to any account found to be under 18, removing its contributions. If you believe a minor has created an account, contact us and we will delete it.
Some pages at my.stantaylor.com are advertisements for our books: a page about one book, reached from a link in an advertisement or a post. On those pages, and nowhere else on the site, we may use the Meta Pixel and Meta's Conversions API (Meta Platforms Ireland Limited and Meta Platforms, Inc.) and Google Analytics (Google Ireland Limited and Google LLC) to measure whether our advertising brings readers. These tools receive the address of the page you visited, the actions you took on it (opening the page, viewing a book, pressing a button that leads to our store), a random event identifier, your IP address, your browser's technical details, and, if you arrived from an advertisement, that advertisement's identifier. Meta may match this information against its own accounts under its own policy. If you are in the European Economic Area, the United Kingdom, or Switzerland, these tools load only after you accept them in the small strip at the foot of the page; declining changes nothing about the page. Everywhere else they load when the page opens. You can change your choice at any time from the "Cookie choices" link at the foot of any advertising page, and the strip also asks again after a year. Our store at stantaylor.com runs its own measurement tools under its own privacy policy.
Some readers reach my.stantaylor.com through a link from one of our partners: an affiliate who recommends our books and is paid a share of the sales they bring. Such a link carries a short partner code in the address. When you arrive with one, a small script from Refersion, Inc., the service that pays our partners, registers the visit and keeps the partner's code in your browser's local storage, and we keep the same code in a cookie named rfsn for 90 days. If you then buy through the checkout on this site, the script passes the order's cart reference to Refersion, which matches it to the order our store reports, so the partner is credited. Refersion receives the address of the page you arrived on, your browser's technical details, a random identifier, and that cart reference: never your name, your email, or what you read. The script runs only on an arrival with a partner code and at the moment of checkout, never on an ordinary visit. If you are in the European Economic Area, the United Kingdom, or Switzerland, the script and the cookie wait for your Accept in the small strip at the foot of the page; declining changes nothing about the site. Everywhere else they run when you arrive through such a link. Our store at stantaylor.com runs Refersion under its own privacy policy.
The web reader at my.stantaylor.com uses your browser's local storage for things the site needs to work: your sign-in session, your theme and reading preferences, and a cache of the books you own. It sets no advertising or analytics cookies except on the advertising pages described above, where the Meta Pixel and Google Analytics set their own cookies (such as _fbp, _fbc, and _ga) once they are allowed to load, and where a small cookie of ours (st-consent) remembers your choice for a year, and except the partner cookie (rfsn, 90 days) described under "Partner links". The small strip that asks about these cookies appears only on the advertising pages and on an arrival through a partner's link, where the law requires it; there is no cookie banner anywhere else on the site.
We disclose personal information to authorities only in response to valid legal process, or when we believe in good faith that disclosure is necessary to prevent imminent harm. Where the law allows, we tell you about a request for your data. United States law requires us to report apparent child sexual abuse material to the National Center for Missing & Exploited Children, and we do.
If a security incident affects your personal information, we will notify you and the relevant authorities as the law requires, without undue delay, and tell you what happened and what we are doing about it.
When this policy changes, we will update the version number and effective date shown above, and for material changes we will provide notice in the App. Continued use after the effective date means the updated policy applies. Version 2.0 added the Readers' Room, the device records, and the providers that come with them. Version 2.3 added sign-in codes by text to the phone number on your order. Version 2.4 added the advertising pages and the Meta and Google tags they use. Version 2.5 added the partner links and Refersion.
Hashtag Publishing LLC, 1021 E Lincolnway Suite #7583, Cheyenne, Wyoming 82001, United States. Email: hello@stantaylor.com. For purposes of applicable data-protection law, Hashtag Publishing LLC is the controller of your personal information. The same address is our single point of contact for authorities and users under the EU Digital Services Act.