Your reading stays with you.

Files you open are read inside your browser, never on our servers, and they stay on this device. Nothing is uploaded until you say so. The first time there is a book to ask about, NeuroLens asks — and tells you exactly how many books and highlights it would send. “Upload” saves them to your account so they are waiting on your other devices; “Keep them here” keeps them, and the books you open later, on this device.

You can change your mind either way on your account page, under “Save my books to my account”.

A book in your account is stored along with everything you have done to it — highlights, notes, drawings, bookmarks, reading position, and the reading summary described below. Your reading settings follow your account either way, because they are how the page is laid out rather than anything you read. A copy of everything stays on the device, which is what lets you keep reading with no connection.

• Stored in NeuroLens's database, hosted by Supabase in Ireland, inside the EU.
• Encrypted on the way there, and encrypted where it rests.
• Readable by your account alone. The database refuses to return one reader's rows to another — a rule enforced by the database itself, not by application code that could forget.
• Never read by us for any purpose, never sold, and never used to train anything.

You can download all of it, or erase all of it, from your account at any time. Erasing removes it from your account and from this device.

NeuroLens adjusts the page to how you read, so it keeps track of how you move through the text. It does this without a camera. It never asks for one, and nothing in it could use one.

What it watches is the page. The line in a band across the upper part of the screen — or the line under your pointer, on a computer — is taken to be the one you are reading, and a clock notes how long it stays there. That is all the raw material there is:

• A line held for 0.4 seconds or more is a pause on that line. Insights calls this a fixation; one that lasts a second and a half is a long one.
• Moving on to the next line is a step forward — a saccade, in Insights.
• Going back to an earlier line is a reread — a regression.
• Jumping three or more lines ahead is a skip.
• Leaving the text altogether, so no line is in the band, is a break.

From those it works out your pace in words per minute, how often you pause and reread, and a rough pattern — steady, scanning, or going back over things. The words fixation, saccade and regression are borrowed from eye-movement research because they describe the same shape of reading. Here they describe the page, not your eyes.

When you read in pages rather than scrolling, turning a page stands in for moving down it: a page counts as being read for about as long as it should take at your pace, and only after that does a still page count as a pause.

Where it is kept. The moment-to-moment detail stays on this device, where it adjusts the page and draws Insights. For a book saved to your account, a short summary goes with it: your pace, how many pauses and rereads, time spent, the pattern, and how many recall questions you got right. What the adaptive reader has learned about which changes help you is saved with your settings. None of it is part of usage analytics, and none of it is used for anything except your own reading.

Your reading garden — the plants that grow as you finish chapters — follows you to your other devices only for books already saved to your account. What is sent is the account's own number for the book, which chapters grew and which flowered, and when — never a title. A book you keep on this device keeps its plant here too. The record of which highlights have come back to you on the Explore page, and when, stays on this device: dates only.

Sensors, only when you switch them on. Two features use more than the page, and both are off until you turn them on:

• Motion cues read your phone’s motion sensor, to steady reading in a moving car or train. The readings are used on the device and never stored or sent.
• Talking to Neuro uses the microphone to hear its name. Your browser does the listening, and some browsers — Chrome among them — send the audio to their own speech service to turn it into words. NeuroLens never receives or keeps the audio, and it stops listening the moment you switch it off.

With your permission, NeuroLens records anonymous events about how the app is used: which tab was opened, which file type was read, that a highlight or pen stroke was made, which setting changed, how far through the tour you got, that you signed in or out, and which avatar style you picked. That is the whole list, apart from the two measurements below. It is off until you switch it on.

This is enforced by the code, not just promised. Every event is checked against a fixed list, and each field only accepts a handful of fixed values — a file type, a colour, a tool — so there is nowhere in an event for a book's text, a file name, a name or an email to go. Sizes and counts are rounded into ranges, and times to the hour. The same check runs again on arrival, so an event that is not on the list is refused rather than stored.

The first measurement: when you finish a quick recall or a check of understanding, it records how many questions there were, how many you got right, and the reading mode and layout you were using — so we can see whether a mode helps people remember what they read. Never the questions, your answers, the book or the chapter.

The second: how quickly a page drew, how soon it answered a tap, and whether the text moved under you while you read. Those are kept only as good, needs work or poor — never the actual timings, which vary enough by device and moment to identify one.

• Events go to NeuroLens and nowhere else. There is no analytics company involved.
• The random number your device makes stays on it and is never sent or stored with an event.
• Nothing is attached to your account; there is no column for a person to go in.
• Switching analytics off deletes that number and everything recorded.
• If your browser sends Global Privacy Control or Do Not Track, you are never asked.
• The account page shows every recorded event, word for word, before it is sent.
• Events are deleted after 90 days, automatically. Nothing older than that answers the question "how is the app used", so there is no reason to keep it.

Two ways of connecting what you already have, and they behave very differently, so both are described rather than bundled together as "integrations".

A catalogue you connect. If you point NeuroLens at an OPDS catalogue — your own Calibre or Kavita server, or a public one like Standard Ebooks — the request is made by NeuroLens rather than by your browser, because your browser is not permitted to call arbitrary servers from this page. That means the catalogue sees a request from us, not from you: not your address, not your browser, nothing about you at all. We do not keep the address you entered, and we do not keep what came back.

A Kindle file you open. My Clippings.txt is read entirely inside your browser. Nothing about it is sent anywhere — not to us, and certainly not to Amazon, who have no part in this. The highlights become highlights in your library, and follow the same rules as any other: on this device until you choose to upload them.

The NeuroLens extension for Chrome, Edge and Firefox is optional. It does two things, and each happens only when you ask for it.

Your settings, on sites you choose. When you open NeuroLens with the extension installed, the app gives it your typeface, text size, spacing, alignment, bold word starts, palette and reading mask — nothing else. Not your books, highlights, account or email. They pass between two scripts on the same page, so no server is involved and the extension has no sign-in of its own. It keeps them in its own storage, in that browser only.

It changes a site only after you switch it on for that site, and the browser asks you to allow that one site first. Switching it off gives the access back. The extension never asks for every site at once. Its changes are made on your device, and nothing about the pages you visit — their address, their words, what you do there — is sent anywhere or kept.

Reading a page here. When you choose Read this page in NeuroLens, it takes the article from the tab you are on, or just the part you selected, and passes it to the app in a new tab. It waits in the extension's storage for at most ten minutes and is removed as soon as the app takes it. From then on it is a book like any other, and the rules above apply.

The extension has no analytics and sends no crash reports, and every font and line of code it runs is inside it; it loads nothing from the web.

If part of NeuroLens fails while you are using it, it sends a short report so the fault can be found and fixed. This is separate from analytics above, and it is the one thing that is not switched off by default — a reading app that only hears about crashes from people who went looking for a settings page does not hear about them at all.

The awkward part is that an error message is written by whatever broke, and a file reader that chokes on a page will quote that page back in its complaint. So the message is rewritten on your device before it is sent: anything in quotation marks is replaced, along with every web address, every email address and every number. What is left is the shape of the fault — Unexpected token <q> in JSON at position <n> — which tells a developer what to fix and tells them nothing about what you were reading.

• What is sent: that rewritten message, which part of the app it came from, the list of components involved, and the app version.
• What is not: your account, your address, your name, your IP address, your browser, the page you were on, and any part of your text. The table it is stored in has no column for any of them.
• The same crash is sent once, not once per attempt, and at most ten per visit.
• Reports are deleted after 30 days — a crash report is useless once the version it came from is gone.
• Switching analytics off also stops these. If you have told NeuroLens not to send things, that covers this too, and a browser sending Global Privacy Control or Do Not Track is never asked and never reports.

Reading needs an account. Sign in with Google and they confirm who you are; NeuroLens never sees your password, and stores nothing from them but your name and email address. Your avatar is drawn on your device from a random seed — no photo is fetched or stored.

A few features reach other services, and only when you use them:

• Bible passages — bible-api.com and bible.helloao.org
• Library records — the British Library and Open Library
• Poems — poetrydb.org
• Word definitions — dictionaryapi.dev and datamuse.com

Those requests contain the passage, title or word you asked for, and nothing else.

• Uploaded text cannot run as code. Everything a file contains is escaped before it is shown, so a document built to smuggle in a script is displayed as plain text.
• Only the app's own code runs. A security policy tells your browser to refuse scripts from anywhere else and to connect only to the services named above.
• No third-party trackers or ad scripts, and HTTPS only.

Because a copy of your books stays on this device, its passcode and the browser extensions you trust protect them too — an extension allowed to read every site can read what a site stores. Your account password protects the other copy, which is why signing in uses Google rather than a password we would have to hold.

Get in touch, or read the terms.