Chapbook privacy policy

This policy explains how personal information is handled when you visit chapbook.ink, use the Chapbook app at app.chapbook.ink, or contact us. Chapbook is a product of pdfs.build, and this policy is the Chapbook-specific counterpart of thepdfs.build Privacy Policy. Where the two differ, this policy controls for Chapbook.

Who we are

Chapbook is operated by Brilliminds FZC (License No. 4306832), Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates, postal code 519285. Contact us at hello@chapbook.ink. We are the controller for the personal data described here. Chapbook accounts are personal; there are no organisations or shared workspaces.

Information we process

• Account data: name, email address, password hash (if you set a password), Google account identifier (if you sign in with Google), email verification status, sessions, IP address and browser details.
• Your content: the brief you write, sources you upload or link, conversation history with the writing assistant, outlines, chapters, cover instructions, generated covers and exported files (PDF, EPUB, JPEG).
• Usage and technical data: features used, generation jobs and their status, credit usage, request and error logs, and diagnostic context when something fails.
• Billing data: customer and subscription identifiers, plan, status, country, invoices and credit purchases. Our Merchant of Record collects payment-card details; we never receive full card numbers.
• Communications: support and other messages you send us, and the transactional emails we send you (verification, sign-in links, password resets, and a note when a long-running book job finishes).
• Website data: pages and referrers on chapbook.ink, measured with cookieless Cloudflare Web Analytics when enabled.

Purposes and legal bases

Where the GDPR or UK GDPR applies, we rely on:

• Contract: creating and securing your account, generating and editing your book, producing exports, billing, and support.
• Legitimate interests: operating, troubleshooting and improving Chapbook, understanding aggregate usage, preventing fraud and abuse, and protecting users and our systems.
• Legal obligations: keeping tax and transaction records and responding to valid legal requests.
• Consent: where the law requires it for an optional feature or communication. You can withdraw consent at any time.

We do not use personal data to make decisions that produce legal or similarly significant effects solely by automated means.

AI processing

Chapbook is built on third-party AI models. To write, edit and illustrate your book we send the information needed for each request to an AI gateway and the selected model provider: your brief, sources, the relevant conversation history, the manuscript, cover instructions and generated output. Cover images are produced by an image-generation provider from your cover instructions. When the assistant researches a topic, the search query is sent to a web-search provider. We do not use your content to train AI models developed by us. Do not include sensitive personal data about yourself or others in your brief, sources or manuscript.

Who receives information

We disclose information only as needed to run the service:

• hosting, database, file-storage, email, error-monitoring, AI, web-search and billing providers, listed on thepdfs.build Subprocessor List;
• Polar, our Merchant of Record, which independently controls payment and buyer data under its own privacy policy;
• Google, which independently processes the optional Google sign-in under its own terms. We receive only your name, email address and Google account identifier;
• advisers, authorities or other parties when reasonably necessary to comply with the law, protect rights and safety, or complete a corporate transaction.

We do not sell personal information or share it for cross-context behavioural advertising.

International transfers

Brilliminds FZC is established in the United Arab Emirates and our providers operate in the locations listed on the Subprocessor List, so your information may be processed outside your country, including outside the EEA, United Kingdom or Switzerland. Where required we rely on an adequacy decision or contractual safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Contact us for details of the safeguard relevant to a transfer.

Retention

We keep your account and content while your account is active and until you delete a book or close your account. Operational and security logs are kept only as long as needed to troubleshoot, secure and operate the service. Billing, tax and dispute records are kept for the period required by law. Residual copies may remain in backups until they rotate out. Provider retention can vary by feature.

Reader sign-ups on book pages

If you sign up on an author's public book page (an address like go.chapbook.ink/@handle/slug, or a similar page we host for them), the author is the controller of your information and Chapbook processes it on their behalf, as their processor, to run the page and let the author manage their list of readers.

We store the email address and, if you give it, first name you type into the form; which book and which page you signed up on and, if you followed a named link, which one; the exact consent wording, its version and the time you agreed to it; and a timeline tied to your sign-up — when you returned, read the book online or downloaded it, each with its time, and when you were last seen. The author can also attach their own tags and notes to your entry. Your IP address and browser are never part of your entry or the author's reader list: they are used only in the moment — to rate-limit abuse, to tell people from bots, and, for the bot check, passed to Cloudflare as described below — and appear in the short-lived security logs our hosting keeps. The sign-up, read and download counts a page shows its author are derived from visits, not tied to any individual.

A single strictly necessary cookie, cb_reader, keeps you signed in to a page you have already unlocked so you do not have to sign up again; it carries no information beyond a reference to your sign-up and is scoped to that author's pages only. You can also return using the personal link the page gives you after you sign up, which works without the cookie.

A book page also loads its fonts from Google Fonts and, to check that a visitor is not a bot, runs Cloudflare Turnstile on its sign-up and report forms. Your browser contacts both directly, so Google and Cloudflare each see your IP address for that request.

Chapbook never sends you an email of any kind from a book page. To be removed, ask the author directly, or email hello@chapbook.inkand we will pass your request to them.

Cookies and device storage

We use necessary authentication and security cookies, including a session cookie that normally lasts up to seven days. The app uses browser storage for preferences such as theme, editor layout and onboarding state until you clear it. We do not use advertising or cross-site tracking cookies. Cloudflare Web Analytics, where enabled, is cookieless. If we introduce anything that requires consent, we will ask first.

Security

We use technical and organisational measures designed to protect personal data, including encryption in transit, hashed passwords, and access controls, described on thepdfs.build Security page. No service can guarantee absolute security. You are responsible for protecting your credentials and for not placing unnecessary personal data in your books.

Your rights and choices

Depending on where you live you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, and withdraw consent, and to complain to your data-protection authority. UAE law may provide similar rights subject to its conditions. Email hello@chapbook.ink to make a request; we may verify your identity, and we respond within the period the law requires. You can also delete individual books from inside the app at any time.

Children

Chapbook is for people aged 18 or older. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information to us.

Changes

We may update this policy as Chapbook or the law changes. We will post the new version and date here and give additional notice when required. Material changes apply prospectively.

Contact

Privacy requests and questions: hello@chapbook.ink. Brilliminds FZC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates, postal code 519285.