Skip to content

Chapbook privacy policy

Last updated: October 30, 2026

This policy explains how personal information is handled when you visit chapbook.ink, use the Chapbook app at app.chapbook.ink, or contact us. Chapbook is a product of pdfs.build, and this policy is the Chapbook-specific counterpart of the pdfs.build Privacy Policy. Where the two differ, this policy controls for Chapbook.

Who we are

Chapbook is operated by Brilliminds FZC (License No. 4306832), Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates, postal code 519285. Contact us at support@chapbook.ink. We are the controller for the personal data described here. Chapbook accounts are personal; there are no organisations or shared workspaces.

Information we process

  • Account data: name, email address, password hash (if you set a password), Google account identifier (if you sign in with Google), email verification status, sessions, IP address and browser details.
  • Your content: the brief you write, sources you upload or link, conversation history with the writing assistant, outlines, chapters, cover instructions, generated covers and exported files (PDF, EPUB, JPEG).
  • Usage and technical data: features used, generation jobs and their status, credit usage, request and error logs, and diagnostic context when something fails.
  • Billing data: customer and subscription identifiers, plan, status, country, invoices and credit purchases. Our Merchant of Record collects payment-card details; we never receive full card numbers.
  • Communications: support and other messages you send us, and the transactional emails we send you (verification, sign-in links, password resets, and a note when a long-running book job finishes).
  • Website data: pages and referrers on chapbook.ink, measured with cookieless Cloudflare Web Analytics when enabled.
  • Sign-up source: when you create an account, where your visit came from: the campaign tags on the link you followed (source, medium and campaign), a referral code, the domain of the site that sent you, and the first chapbook.ink page you opened. We keep the referring site's domain only, never the full address, and we store this once, with your account. When the code is another author's referral link, that author sees how many accounts were made through it and how many paid, never whose; to refuse a referral to oneself, we compare the two accounts' email addresses. When that author is one of our affiliates, we add up the payments your account makes in the year from its first one to work out their commission; they are paid a total and never told whose payments it included.
  • Feedback: the rating from 1 to 5 and any quote you give when the app asks, once, how Chapbook is working for you. If you tick its separate permission box, also the name and role you type, the exact permission text and when you gave it. We publish the quote, with that name and role and never your email address, only under that permission, and you can withdraw it on your Author profile.

Purposes and legal bases

Where the GDPR or UK GDPR applies, we rely on:

  • Contract: creating and securing your account, generating and editing your book, producing exports, billing, and support.
  • Legitimate interests: operating, troubleshooting and improving Chapbook, understanding aggregate usage and which channels bring new authors, paying the affiliates who recommend Chapbook, preventing fraud and abuse, and protecting users and our systems.
  • Legal obligations: keeping tax and transaction records and responding to valid legal requests.
  • Consent: where the law requires it for an optional feature or communication. You can withdraw consent at any time.

We do not use personal data to make decisions that produce legal or similarly significant effects solely by automated means.

AI processing

Chapbook is built on third-party AI models. To write, edit and illustrate your book we send the information needed for each request to an AI gateway and the selected model provider: your brief, sources, the relevant conversation history, the manuscript, cover instructions and generated output. Cover and interior images are produced by an image-generation provider (Black Forest Labs) from your instructions. When the assistant researches a topic, the search query is sent to a web-search provider. We do not use your content to train AI models developed by us. Do not include sensitive personal data about yourself or others in your brief, sources or manuscript.

The free AI tools on chapbook.ink (the ebook title, ebook outline and lead magnet idea generators) need no account. What you type, or the address of the website you name, is sent to Chapbook's API, which passes it to the AI model to write the answer and, for a website, reads that one public page. We keep only a one-way hash of what you sent, with the tool and whether it answered, to spot repeated abuse; never the text, the page or the answer, and nothing is tied to an account. To tell people from bots the tools run Cloudflare Turnstile, which your browser contacts directly, and your IP address is used in the moment to rate-limit requests; it is not stored with the hash.

Who receives information

We disclose information only as needed to run the service:

  • the providers that run Chapbook for us, listed under "Our providers" below;
  • Polar, our Merchant of Record, which independently controls payment and buyer data under its own privacy policy;
  • Google, which independently processes the optional Google sign-in under its own terms. We receive only your name, email address and Google account identifier;
  • the email service or webhook an author connects to their book pages, which receives the sign-ups on that author's pages on the author's instructions, as described under "Reader sign-ups on book pages";
  • advisers, authorities or other parties when reasonably necessary to comply with the law, protect rights and safety, or complete a corporate transaction.

We do not sell personal information or share it for cross-context behavioural advertising.

Our providers

  • Contabo GmbH (Germany): the application server and its PostgreSQL and Redis databases.
  • Cloudflare, Inc. (global network): website and app hosting, CDN, DNS, edge security, the Turnstile bot check, cookieless web analytics and R2 file storage for sources, covers and exports.
  • Resend (United States): transactional email.
  • Sentry (United States or Germany): error and performance monitoring, with no session replay.
  • Vercel Inc. (United States, global): the AI gateway that routes each request to the model provider selected for it, currently one of OpenAI, Anthropic, Moonshot AI or Z.ai for text and Black Forest Labs for images.
  • Tavily (United States): web search, which receives the search query only.
  • Google LLC (United States, global): optional Google sign-in, and the fonts a public book page loads.
  • Polar Software, Inc. (United States): Merchant of Record for plans and top-ups.

We update this list before a new provider starts receiving personal data.

International transfers

Brilliminds FZC is established in the United Arab Emirates and our providers operate in the locations listed above, so your information may be processed outside your country, including outside the EEA, United Kingdom or Switzerland. Where required we rely on an adequacy decision or contractual safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Contact us for details of the safeguard relevant to a transfer.

Retention

We keep your account and content while your account is active and until you delete a book or close your account. A deleted book stays in the trash for 30 days, so you can restore it, and is then purged with its sources, covers and exports. Operational and security logs are kept only as long as needed to troubleshoot, secure and operate the service. Billing, tax and dispute records are kept for the period required by law. Residual copies may remain in backups until they rotate out. Provider retention can vary by feature.

Reader sign-ups on book pages

If you sign up on an author's public book page (an address like go.chapbook.ink/@handle/slug, or a similar page we host for them), the author is the controller of your information and Chapbook processes it on their behalf, as their processor, to run the page and let the author manage their list of readers.

We store the email address and, if you give it, first name you type into the form; which book and which page you signed up on and, if you followed a named link, which one; the exact consent wording, its version and the time you agreed to it; and a timeline tied to your sign-up — when you returned, read the book online or downloaded it, each with its time, and when you were last seen. The author can also attach their own tags and notes to your entry. Your IP address and browser are never part of your entry or the author's reader list: they are used only in the moment — to rate-limit abuse, to tell people from bots, and, for the bot check, passed to Cloudflare as described below — and appear in the short-lived security logs our hosting keeps. The sign-up, read and download counts a page shows its author are derived from visits, not tied to any individual.

A single strictly necessary cookie, cb_reader, keeps you signed in to a page you have already unlocked so you do not have to sign up again; it carries no information beyond a reference to your sign-up and is scoped to that author's pages only. You can also return using the personal link the page gives you after you sign up, which works without the cookie.

A book page also loads its fonts from Google Fonts and, to check that a visitor is not a bot, runs Cloudflare Turnstile on its sign-up and report forms. Your browser contacts both directly, so Google and Cloudflare each see your IP address for that request.

If the author connects an email service (such as Kit, Mailchimp, Beehiiv or MailerLite) or an automation webhook (such as Zapier or Make) to their pages, we send it your email address, your first name, the book and the page you signed up on, the named link if you followed one, and the consent wording, version and time — on the author's instructions and as their processor, once, shortly after you sign up. That service is the author's choice and handles your information under the author's agreement with it, not ours. An email service usually emails you first to ask you to confirm, and lets you unsubscribe from anything it sends. Removing you from Chapbook does not remove you from that service, so ask the author for that too. We keep the author's key, access token or webhook secret for it encrypted, and use it only to send their readers.

Chapbook never sends you an email of any kind from a book page. To be removed, ask the author directly, or email support@chapbook.ink and we will pass your request to them.

Cookies and device storage

We use necessary authentication and security cookies, including a session cookie that normally lasts up to seven days. The app uses browser storage for preferences such as theme, editor layout and onboarding state until you clear it. The website and the app keep your sign-up source in the browser's session storage, which empties when you close the tab, so that it reaches the sign-up form. We do not use advertising or cross-site tracking cookies. Cloudflare Web Analytics, where enabled, is cookieless. If we introduce anything that requires consent, we will ask first.

Security

We use technical and organisational measures designed to protect personal data, including encryption in transit, hashed passwords, and access controls, described on the pdfs.build Security page. No service can guarantee absolute security. You are responsible for protecting your credentials and for not placing unnecessary personal data in your books.

Your rights and choices

Depending on where you live you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, and withdraw consent, and to complain to your data-protection authority. UAE law may provide similar rights subject to its conditions. Email support@chapbook.ink to make a request; we may verify your identity, and we respond within the period the law requires. You can also delete individual books from inside the app at any time.

Children

Chapbook is for people aged 18 or older. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information to us.

Changes

We may update this policy as Chapbook or the law changes. We will post the new version and date here and give additional notice when required. Material changes apply prospectively.

Contact

Privacy requests and questions: support@chapbook.ink. Brilliminds FZC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates, postal code 519285.