Privacy policy

Who we are

Cantiras is operated by Lucas Rodrigues, based in Bergen, Norway. For anything related to your data, email hello@cantiras.com.

What we collect

• Account: your email address, and (if you sign in with Google) your name and profile picture.
• Reading state:which sentence you're on in each book, your playback preferences (speed, language mode, order, granularity).
• Subscription state: whether your account has an active subscription, when it expires, and whether it came from a paid plan, a code redemption, or a manual grant.
• Discount code history:which codes you've redeemed, so we don't let the same code be redeemed twice by the same person.
• Aggregate analytics: page views and route performance, via Vercel Analytics. Vercel reports only anonymized aggregates — no cookies, no cross-site tracking.

We do not collect payment card details directly. When paid plans launch, payments are processed by Lemon Squeezy (merchant of record). Their servers see your card; ours never do.

Why we collect it

• To provide the reader (you need an account to sync your place and to redeem a code).
• To run the subscription (we need to know who paid and when it expires).
• To understand how the product is used in aggregate, so we can improve it.

Legal basis under the GDPR: performance of our contract with you (your account and subscription), and our legitimate interest in measuring how the product is used in aggregate.

Who we share it with

We use a small set of infrastructure providers:

• Supabase — authentication and database (EU/US).
• Railway — our API backend (US).
• Vercel — the website and analytics (US).
• Google Cloud — text-to-speech and translation generation for our book library (no personal data flows through here).
• Lemon Squeezy — payments, when paid plans are active (US, merchant of record for your purchase).

We don't sell your data. We don't share it with advertisers.

How long we keep it

Account data is kept while your account exists. When you delete your account, we delete your account record, reading progress, and redemption history. Anonymized analytics stays in Vercel's aggregated reports.

Your rights

If you're in the EEA, you have the right to access, correct, export, or delete your data, and to object to or restrict our processing of it. Email hello@cantiras.com and we'll handle it within 30 days. You can also complain to your local data protection authority — in Norway that's Datatilsynet.

International transfers

Some of the providers above host data in the United States. Where we transfer data outside the EEA, we rely on the providers' Standard Contractual Clauses or equivalent mechanisms.

Cookies

We use one functional cookie: the Supabase authentication session. No advertising cookies, no cross-site trackers.

Changes

We'll update this page when our data handling changes, and note the new effective date at the top.