Your reading stays with you.

Files you open are read inside your browser and kept on this device. They stay there, and only there, until you choose to upload them — the first time you sign in with books already saved, NeuroLens asks, tells you exactly how many, and does nothing unless you agree. Declining leaves everything where it is.

Once you do upload, a book and everything you have done to it — highlights, notes, drawings, bookmarks, reading position and settings — are stored in your account so they reach whatever you next read on. A copy stays on the device, which is what lets you keep reading with no connection.

• Stored in NeuroLens's database, hosted by Supabase in Ireland, inside the EU.
• Encrypted on the way there, and encrypted where it rests.
• Readable by your account alone. The database refuses to return one reader's rows to another — a rule enforced by the database itself, not by application code that could forget.
• Never read by us for any purpose, never sold, and never used to train anything.

You can download all of it, or erase all of it, from your account at any time. Erasing removes it from your account and from this device.

With your permission, NeuroLens records anonymous events about how the app is used: which tab was opened, which file type was read, that a highlight or pen stroke was made, which setting changed. That is the whole list. It is off until you switch it on.

This is enforced by the code, not just promised. Every event is checked against a fixed list, and each field only accepts a handful of fixed values — a file type, a colour, a tool — so there is nowhere in an event for a book's text, a file name, a name or an email to go. Sizes and counts are rounded into ranges, and times to the hour. The same check runs again on arrival, so an event that is not on the list is refused rather than stored.

One more thing is measured: how quickly a page drew, how soon it answered a tap, and whether the text moved under you while you read. Those are kept only as good, needs work or poor — never the actual timings, which vary enough by device and moment to identify one.

• Events go to NeuroLens and nowhere else. There is no analytics company involved.
• The random number your device makes stays on it and is never sent or stored with an event.
• Nothing is attached to your account; there is no column for a person to go in.
• Switching analytics off deletes that number and everything recorded.
• If your browser sends Global Privacy Control or Do Not Track, you are never asked.
• The account page shows every recorded event, word for word, before it is sent.

Reading needs an account. Sign in with Google and they confirm who you are; NeuroLens never sees your password, and stores nothing from them but your name and email address. Your avatar is drawn on your device from a random seed — no photo is fetched or stored.

A few features reach other services, and only when you use them:

• Bible passages — bible-api.com and bible.helloao.org
• Library records — the British Library and Open Library
• Poems — poetrydb.org
• Word definitions — dictionaryapi.dev and datamuse.com

Those requests contain the passage, title or word you asked for, and nothing else.

• Uploaded text cannot run as code. Everything a file contains is escaped before it is shown, so a document built to smuggle in a script is displayed as plain text.
• Only the app's own code runs. A security policy tells your browser to refuse scripts from anywhere else and to connect only to the services named above.
• No third-party trackers or ad scripts, and HTTPS only.

Because a copy of your books stays on this device, its passcode and the browser extensions you trust protect them too — an extension allowed to read every site can read what a site stores. Your account password protects the other copy, which is why signing in uses Google rather than a password we would have to hold.

Get in touch, or read the terms.