Privacy Policy

The short version

• Reading RedLectern never needs an account, and we don’t show display ads.
• We don’t sell or rent your information. We use Google Analytics to count visits and a few actions, such as reading or listening for a minute or two, so we can tell whether the site is useful.
• Visitors in the European Economic Area, the United Kingdom and Switzerland get no analytics or advertising cookies from us. Elsewhere, Google Analytics sets cookies; Analytics and cookies explains them and how to stop Google Analytics.
• If you post a question or comment, it is public on RedLectern right away, under the display name you chose. An automatic check, which uses OpenAI, looks for clear rule-breaking. We never show your email address.
• If you make an account, we store your email address and the reading progress you choose to sync, so it can follow you across devices.
• The Reading companion is an optional AI for signed-in adults. It uses OpenAI for replies and ElevenLabs for voice. We save your chats and memory notes; you can delete them in the companion.
• You can download your data at any time, and delete your account yourself on your Account page.

Without an account

If you don’t sign in, your progress, bookmarks and settings are saved only in your own browser (its local storage). We don’t receive them. Clearing your browser’s site data removes them.

Pages that use Google Analytics also look in your browser’s local storage for a test setting of ours, rl_test, and send nothing from it; Analytics and cookies explains it under Automated browsers.

Like any website, our hosting providers receive technical information needed to deliver pages, such as your IP address, browser type and the page requested, and may keep it briefly in server logs for security and reliability.

Topic pages load a list of recent research updates from our own server; nothing about you is sent with that request beyond what any page request includes.

Analytics and cookies

We use Google Analytics, a service from Google, to understand how RedLectern is used. It records the pages you visit and a few actions that show whether the site is useful: reading a book for about two minutes, and again at about ten minutes; studying a course page for about two minutes; a book’s audio starting to play, listening to it for a minute, and again at about ten minutes; playing a course video, starting a course, opening a problem set or a solution, going to a quote’s passage or copying it, searching, asking for an audiobook or cancelling the request (not which book), exporting your progress, creating an account, following a link to a free copy of a book on another site, opening a book’s Other options, and following a store link (the store, the format and the book), choosing a starting route on a topic page, following a recommended resource from a topic page (the kind of resource, not its address), reaching a section of a topic page, opening a practice answer, following a "New to this? Read…" link, opening a concept page from a topic page, choosing a subtopic, opening the AI glossary, opening a latest-update source (the source kind, not its address), opening the question or comment form, sending a question or comment (whether it is a question or comment and which kind of section, never its text), and sending a report (never its reason or note).

Moving between pages without reloading. On Home, Books, Listen, My progress and the book reader, the site can open the next page without reloading, so the audio player keeps playing. Each page opened this way is recorded as a page view, the same as a page you load: its cleaned address, its title and its type. The page you came from is the previous screen, cleaned the same way. Opening a book’s details on the Books page is not a page view.

course_exposure records the course ID, whether the visit began on the landing page or a deep link, and the new variant.

lesson_open records the course and lesson IDs when a lesson opens.

lesson_engaged records the course and lesson IDs after two minutes of activity in that lesson, at most once per lesson per day.

practice_open records the course and lesson IDs when an assignment or exam resource is opened.

check_attempt records the course and lesson IDs when you open MIT’s solution to compare after attempting the work.

lesson_complete records the course and lesson IDs when you mark a lesson complete.

resume_use records the course and lesson IDs when you use a saved lesson.

video_error records the course and lesson IDs when the video player reports an error. These events send no answer text, notes or email address.

Reading and studying time counts only while the page is showing in your browser (not in a background tab or a minimized window) with the book’s text or the course activity on screen, and only once you have pressed a key, clicked, tapped, touched the screen, scrolled with a mouse wheel or touchpad, or turned a page there; it stops counting after 90 seconds without one of these, and starts again with the next, except that studying time keeps counting while the lecture video of the course activity on screen is playing. Listening time is clock time while the audio is playing and isn’t muted or set to zero volume in the page’s own player, whatever the playback speed, including while the page isn’t showing. A web page can’t see your device’s volume or whether your browser tab is muted, so audio playing on a muted device or in a muted tab still counts. The first time on a page that you read or study for two minutes or listen for a minute, Google Analytics also records that the page was used, and which of the three it was. When the player keeps playing while you move to other pages, its listening is counted once, not once per page: the minute, the ten minutes and the “used” record each go once for that recording. They are recorded for the page where you started listening, with that page’s address, title, type and the page you came from. No new identifier is sent for this.

Google Analytics also records some actions on its own, on every page that uses it: reaching the bottom of a page (when 90% of its length has been on screen); clicking a link to another website, with that link’s address; watching an embedded YouTube video, with the video’s title and address and when it starts, how far it gets and whether it finishes; and clicking a link to download a file, such as a PDF, with the file’s name, the link’s address and its text.

With each of these, Google Analytics receives the page’s address (without anything typed into it, such as search words, and without the part after “#”; campaign tags are kept, as described under Ads below); the page’s title; the page you came from, which for a page on another website is only that website’s address, such as https://www.google.com, never which page it was or anything after it, and for a page on RedLectern is its address cleaned up the same way as the page’s; the type of page and which book, course or quote it is; a version number for how we define these actions; and what your browser sends with every request: the time, your browser and device type, screen size and language, and your IP address, which Google uses to estimate your approximate location. Google says Google Analytics doesn’t store or log IP addresses.

Before anything is sent, every value that could come from you or from a link is checked the same way: ignoring spaces, dashes and all other punctuation, and also after undoing any web-address encoding (such as “%40” for “@”), a value that contains an “@” or 7 or more digits in a row (the shape of an email address, a phone number or a card number) is never sent. Not checked, because we set them when we build the site: the address of the page you are on, when it is one of the pages we publish; the address of the previous page, when you moved from it inside the site without reloading and it is one of the pages we publish; and the IDs of our own quotes, practice problems and course activities. Any other RedLectern address that fails the check (the page you came from after a reload or from a link, or an address that isn’t one of our pages) is sent with “/(redacted)” in place of everything after the site’s name; another website’s address that fails it is sent as “(redacted)”; any other value that fails it is left out. For a search, Google Analytics receives the words you searched for, cut to 100 characters, or “(redacted)” if anything anywhere in what you typed fails the check (so a search for an ISBN is sent as “(redacted)” too), and, when the results are listed on the same page, how many results the search found. We never send Google your email address, your account ID, or your notes, bookmarks or reading progress.

In the European Economic Area, the United Kingdom and Switzerland, the site tells Google not to use analytics or advertising cookies or similar storage on your device (Google’s “consent mode”, set to “denied”). There is no cookie banner because we don’t ask to set any. Google Analytics still receives the information above for each page and action, but without a cookie or any identifier that could recognize your browser on a later visit, and Google uses it to estimate totals (it calls this “modeling”).

Everywhere else, Google Analytics stores two cookies in your browser, _ga and _ga_<ID>. They hold a random identifier and the state of your current visit, so that a later visit from the same browser can be counted as a return. They last up to 2 years unless you delete them.

Global Privacy Control. If your browser sends a Global Privacy Control signal, the site tells Google, wherever you are, not to use advertising cookies and not to use your visit for advertising (Google’s ad_storage, ad_user_data and ad_personalization signals, set to “denied”). Google Analytics still measures the visit as described above.

Do Not Track. Browsers can also send a “Do Not Track” signal. There is no agreed standard for what it asks, so RedLectern does not change what it does in response to it; the Global Privacy Control signal is honoured as described above.

Ads. We may advertise RedLectern with Google Ads. Those ads appear on Google, never on RedLectern. A link from one of our ads carries campaign tags (for example utm_source=google), Google’s ad-click ID (gclid, or on some devices gbraid or wbraid) and Google’s ad source number (gad_source), and Google Analytics records that the visit came from that ad, so we can see which ads bring people who read, listen or study. A campaign tag or click ID that fails the check above, or is unusually long, or (for a click ID) isn’t a plain code of letters, digits and a few symbols, is removed from the address before it is sent, whoever made the link. The ad source number is kept only when it is one or two digits.

Automated browsers. If your browser says it is automated (a testing tool or a headless browser), or its user agent (the name it gives itself) contains HeadlessChrome, Lighthouse, Googlebot, AdsBot, Google-InspectionTool or bingbot, the site loads no Google Analytics and sends it nothing. The same goes for a browser that carries our test mark: wherever you are, every page that uses Google Analytics first looks in your browser’s local storage for a setting named rl_test, which is saved there only when a RedLectern address that includes rl_test=1 is opened. We open such an address in our own test browsers, so our own testing isn’t counted as visits. Nothing from that setting is ever sent anywhere. The one exception is a page whose address includes rl_measure=1, which we use to test the measurement itself: that page is measured as described above, even in an automated browser or one that carries the test mark.

How long it’s kept. Google Analytics keeps the detailed data about visits and actions, and the data tied to a browser’s identifier, for 14 months. A later visit doesn’t restart that period. Summary reports, which count visits rather than describe any one visitor, are kept longer.

Turning it off. Global Privacy Control limits only the advertising use described above: Google Analytics still measures your visits, and outside the European Economic Area, the United Kingdom and Switzerland it still uses its cookies. Deleting or blocking Google’s cookies in your browser’s settings resets or removes the identifier, so a later visit isn’t linked to earlier ones, but it doesn’t stop the measurement. To stop Google Analytics measuring your visits, install Google’s Google Analytics opt-out browser add-on or use a content blocker that blocks Google Analytics. Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.

With an account

When you create an account, we store:

• Your email address and an account ID, so you can sign in with Google or a code we email you. If you use Google, we also store the name and profile picture link Google sends.
• What you sync: your place in books, bookmarks (with any labels you add), course progress, saved courses, and reader settings, each with the time it changed.
• When you agreed to these policies, and short-lived technical records that keep syncing reliable.

We use this only to run the service for you: signing you in, syncing your progress between your devices, keeping the service secure, and answering you if you contact us. We don’t use it for advertising or profiling.

Notes you write on course activities currently stay on your device and are not uploaded.

Feedback form. If you send us a message with the feedback form, we receive what you put in it: the kind of message, your message, the address of the page you sent it from, and your email address if you choose to give one so we can reply. RedLectern doesn’t store it in its database or on the website: it is emailed straight to us through Resend, and we use it only to read and answer your message. The form runs on Supabase, which processes the submission but does not store it. Before it is sent, the form runs Cloudflare’s Turnstile check, which looks at technical signals from your browser, including your IP address, to tell people from bots. Your IP address isn’t included in the email. For rate limiting, the function briefly keeps a hashed key made from your IP address in memory; it expires within 10 minutes.

Audiobook requests. If you are signed in you can ask for an audiobook of a book on RedLectern that does not have one yet. We store which books you asked for and when, and we use your account email address to tell you when a requested audiobook is ready. You can cancel a request at any time, and deleting your account deletes your requests. We count requests per book to decide which audiobooks to make; we do not share your requests.

Questions and comments

When you post, we store: your display name; what you wrote and whether it contains spoilers; which page and section it's on; when you posted or edited it; and its moderation status. Posts are public as soon as you post them, under your display name (at busy times we may review them first). We also store reports you send about posts (the reason and any note you add), and the decisions a moderator makes, with a private note, so we can handle appeals and abuse.

Automatic check. When a post goes up or is edited, we send it to OpenAI to check it against the community rules. We send the text, your display name, the first 300 characters of the post it replies to, which page it is on, whether it is a question or a comment, your account's age and number of published posts, and the scores from OpenAI's own moderation filter. We never send your email address or account ID. OpenAI processes this for us and doesn't use it to train its models. Its moderation filter keeps nothing; for the main check, OpenAI may keep the data for up to 30 days to detect abuse of its service (longer only if the law requires it). We keep the result of each check (keep, remove or flag, which rule, and confidence scores, with no text) for 90 days, or until the post is deleted. When the check removes or flags a post, the moderation history records the rule, and a flag also creates a report for our moderator with a one-line reason. These follow the same rules as a moderator's decisions and reports.

Only RedLectern's moderator sees posts waiting for review, reports, automatic-check results and private notes. Your account's age and number of published posts are seen by our moderator and sent to OpenAI for the automatic check. We don't use posts for advertising and we don't sell them.

Deleting. You can delete any of your posts; the text is removed at once. Deleting your account deletes your display name and the text of all your posts; replies other people wrote stay, without your name. Moderator notes and report notes about your posts are deleted too. Our database provider may keep daily backups for up to 7 days, after which deleted data is gone from them as well.

Reading companion (beta)

The Reading companion is an AI, not a person. It is for signed-in adults aged 18 or older. Before you create your companion, you confirm once that you are 18 or older; we store only that you confirmed it.

It reminds you that it is an AI at the start of a conversation and at least every 3 hours while you keep talking.

What goes to OpenAI. To answer you, we send the parts it needs:

• Your message, any passage you selected, and recent messages and replies from the conversation.
• The book’s title, author and your reading position, or which part of the site you are using. Passages from the book up to where you have read; later passages only if you allow spoilers.
• The name you give yourself and your companion, its personality, tone, answer style and costume (cosplay), and your personality note.
• Relevant memory notes, when memory is on, and results from searches of our book list. When it offers a way back to a book, whether you have a saved place there and the position used by that link.

If you use Customize, we may also send the description you type to OpenAI to suggest a costume and manner. Opening the companion can also send the current page, reading position, companion settings and relevant memory notes to OpenAI for a short greeting.

OpenAI processes this for us and doesn’t use it to train its models. We turn off response storage on our requests. OpenAI may keep messages, replies and the context sent with them for up to 30 days to detect abuse, or longer if required by law or needed to protect its service or others from harm. Your own messages are also checked by OpenAI’s moderation filter, which keeps nothing. See OpenAI’s data controls.

What we store. We keep:

• Your conversations: your messages, replies, selected and cited passages, and which reaction images were shown.
• Your companion profile and settings, memory notes, books in progress and their reading positions, the companion bubble’s position and your voice choice.
• Your thumbs-up or thumbs-down ratings of replies, stored with the related conversation.
• Daily message and voice usage, costs and technical records used to enforce limits and keep requests reliable.

Memory. Memory is on by default. The companion can save notes about reading preferences, goals and thoughts you share. You can view, edit, delete or clear its notes, or turn memory off, in the companion’s Memory screen. Turning memory off stops it being used or added to; it does not delete existing notes or conversations.

Improving answers. We review reading companion conversations to improve answers.

Deleting. Delete this chat removes its messages, replies, selected and cited passages, reaction records, reply ratings and memory notes created from that chat from our database. Your profile and books in progress stay until you delete your account. Other memory notes stay until you edit or delete them, clear memory, or delete your account. Deleting your account deletes your conversations, reply ratings, profile, memory notes, books in progress and daily usage records tied to your account. Usage and billing records can remain as described in How long we keep it below.

Voice. Voice starts only when you press Talk and allow microphone access. It stops when you close or leave the page, or the page is hidden. ElevenLabs (United States) receives your microphone audio to turn speech into text, and the reply text to turn it into speech. Our server receives your spoken message as text and answers through the same OpenAI path described above. Voice transcripts and replies follow the same storage and deletion rules as chat.

We set ElevenLabs not to keep audio recordings or transcripts of voice conversations.

If you preview a voice, your browser requests the sample from ElevenLabs, which receives your IP address and which sample you chose.

Safety and crisis response. If the moderation filter flags a message for self-harm, the companion replaces its usual reply with this fixed response:

“I’m glad you told me. Please reach someone who can support you right now. In the US, call or text 988; elsewhere, contact your local crisis helpline. If you’re in immediate danger, call local emergency services. Can someone you trust stay with you?”

That message does not go to the reply model and is not saved as a conversation or memory note. In chat, the companion shows crisis links, including the 988 Suicide & Crisis Lifeline in the US, or a local helpline directory elsewhere. The check can make mistakes. The companion is not a crisis service.

Services we use

We rely on a few providers that process data for us, only to deliver the parts listed:

• Supabase (United States): handles sign-in and synced progress, and processes feedback form submissions. The feedback function runs on Supabase but does not store those submissions. It also stores companion conversations, profiles, memory and usage records.
• Google (United States): if you choose Continue with Google, Google confirms your identity and sends us your name, email address and profile picture link, which Supabase stores with your account. We use only your email address. The sign-in page loads Google’s sign-in script, so Google receives your IP address and browser details when you open that page, even if you use email instead.
• Resend: sends the sign-in code emails, delivers messages from the feedback form to us, and sends us moderation alerts (which never include post text).
• OpenAI (United States): automatically checks questions, comments and display names against our community rules. It also produces the companion’s replies and greetings, helps with Customize, and moderates companion messages. It doesn’t use this data to train its models; see Questions and comments and Reading companion (beta) for what it keeps.
• ElevenLabs (United States): speech-to-text, spoken replies and voice samples for the companion. See Reading companion (beta) for what it receives and keeps.
• Cloudflare: domain and security services, the Turnstile check on the sign-in and feedback forms (which looks at technical signals from your browser to tell people from bots), storage for hosted books and read-along audio, and forwarding of emails sent to us.
• Vercel: hosts the website.
• Google (Google Analytics): measures visits and the actions described under Analytics and cookies. Google’s own privacy policy applies to its processing.
• YouTube: RedLectern uses YouTube API Services (the embedded player) to play course videos. Course pages show a local placeholder for each lecture video, with its title and a Play button — nothing is requested from YouTube before you press Play. Pressing Play loads YouTube’s player script once and embeds the video from youtube-nocookie.com, YouTube’s privacy-enhanced mode; YouTube’s own policies apply from then on. The exception is the older 14.01 and 6.830 lecture pages: they load YouTube’s player (from youtube.com) as soon as the page opens.
• Open Library (covers.openlibrary.org) and book publishers’ sites: cover images on the Home page, the Books and Audiobooks pages, book pages, topic pages and Listen pages are requested directly by your browser, most from Open Library and some from the site that offers the free copy or from the book’s publisher (for example Project Gutenberg, Wikimedia Commons, a museum, a university press or a publisher’s site), so that site receives your IP address and which cover (by ISBN or file name) you asked for. We may host covers ourselves in the future to avoid this; that isn’t built yet, and depends on confirming we can redistribute those cover images under their licences.
• Internet Archive (archive.org): on a Listen page, the audiobook streams directly from the Internet Archive, where LibriVox keeps its recordings, once you press Play; and many Listen pages, some book pages, the Home page and the Audiobooks page show a recording’s or book’s cover image from the Internet Archive as soon as the page opens — so the Internet Archive receives your IP address, which cover you saw and which recording you play. The exception is the books whose text follows the narration (read-along): their audio streams from our own copy of the LibriVox recording, stored with Cloudflare, so the Internet Archive does not receive that request.

On a book page, the Immersion button checks in the background whether the book has a read-along recording. It does this by loading the book’s Listen page from RedLectern itself (/listen/…), not from another site. That request is not recorded as a page view.

Links to outside sites (for example a free copy of a book on another website) take you to sites with their own policies.

Store links. Some book listings link to stores such as Amazon and Bookshop.org. Links marked “paid link” carry RedLectern’s affiliate code: the store knows the visit came from RedLectern and may set a cookie on its own site to credit a later purchase, and RedLectern earns a commission on qualifying purchases. The store reports to RedLectern which items were bought through its links and the commission, not who bought them; RedLectern receives no name, address or payment details. Other links in the same panel (free copies, library and store searches) pay RedLectern nothing. Stores’ own privacy and cookie policies apply on their sites. As an Amazon Associate I earn from qualifying purchases.

How long we keep it

• Your account data stays until you delete your account (or ask us to). Deleting it removes the account and everything synced to it from our database right away.
• Two short-lived exceptions. Supabase keeps its service and security logs, which include a record that an account was deleted with its email address, for about 1 day on our plan. Resend keeps the emails it sent for 30 days: sign-in code emails with the address they went to, and feedback messages with their content and any reply address you gave.
• OpenAI may keep the text of posts it checks for up to 30 days to detect abuse. We keep the result of each automatic check for 90 days, or until the post is deleted.
• Companion conversations stay until you delete the chat or your account. Companion settings and books in progress stay until you delete your account. Memory notes stay until you delete or clear them, delete their source chat, or delete your account. Conversation deletion leaves usage and cost records linked to your account, without the conversation’s content. After account deletion, site spending totals and voice billing records without your account ID or conversation content may remain. We also keep shared costume and personality suggestions and a code made from each Customize description, without your account ID or the description itself, so we can reuse a suggestion. We set no automatic expiry for these records.
• OpenAI’s retention for companion data and the ElevenLabs retention setting are described in Reading companion (beta).
• Our database plan has no automatic backups, so there is no backup copy of your account waiting to expire.
• When you remove a synced item, a small marker that it was removed is kept for up to 180 days so your other devices learn about it; the item’s content is removed right away.
• Technical sync records are deleted after about 30 days.

Your choices and rights

• Download: on your Account page you can download everything synced to your account.
• Delete: on your Account page, “Delete my account” removes the account and everything synced to it. To confirm it’s you, we email you a new 6-digit code first. It can’t be undone. Your progress in that browser stays there as that device’s own (it stops syncing) unless you choose to clear it, and each of your other devices asks what to do with its copy the next time it’s used. You can also email privacy@redlectern.com from the account’s address and we’ll delete it for you.
• Correct or ask: you can change what you sync at any time, and you can ask us what we hold about you.
• Sign out on a shared device and choose to remove your data from it.

Depending on where you live, you may have further rights under local privacy laws; contact us and we’ll help.

Children

Accounts are for people 13 and older. We don’t knowingly collect personal information from children under 13. If we learn that an account belongs to a child under 13, we delete it. If you believe that has happened, contact privacy@redlectern.com.

Security

Sign-in uses Google or one-time emailed codes instead of passwords. Your synced data can only be read by your own signed-in account, and connections are encrypted. No system is perfectly secure, but we work to protect your information and will act quickly on any problem.

Changes

If we change this policy, we’ll update the date above, and for significant changes we’ll let account holders know.

Who runs RedLectern

RedLectern is a small, independent project, run under the name RedLectern.

Email: privacy@redlectern.com

Contact

Questions or requests: privacy@redlectern.com.

Report a problem with a course, a book or a source (a broken link, an incomplete copy, a wrong source or a content error): email corrections@redlectern.com with the page’s address and what you found.