Privacy

Browsing, without an account

Every chart, shelf and book page is a static file. Reading them sets no cookie of ours and creates no record of you — only a mark in a count that is never traced back. Search runs in two passes: the charts are searched inside your browser against a file downloaded with the page, and anything beyond them is looked up in the catalogue, which means the words you typed are sent to be answered. They are sent with nothing attached that says who typed them.

Book cover images are served by Audible's image host, so loading a page tells them an image was requested. We ask your browser not to send a referrer with those requests.

What we count

We measure how the site is used, because there is no other way to know that a shelf nobody reaches is broken rather than unpopular. No cookie is set, no identifier is stored in your browser, and nothing is kept that could be linked back to you on your next visit. There is no consent banner on this site because there is nothing here that needs consenting to.

It does not go to an analytics company. The software is Umami, which is open source, and we run it ourselves on our own machine. There is no third party in this at all: no account with a measurement firm, no data shared with one, nothing sold, and no second use of any of it. It exists to answer our own questions about our own site.

What is recorded is the page, the kind of page it was, roughly where in the world the request came from, which site sent you and what kind of browser and device asked — and, on top of that, a short list of things people do here: opening a book from a shelf, following a buy link and to which shop, saving a title, using the navigation, asking for a sign-in link, asking for the weekly email and which page it was asked from, and clicking something in the shop. Not the address typed into any of those forms — only that a form was sent.

What your searches send. The words you type into the search box are recorded, lowercased and cut to eighty characters, along with whether the search found anything. That is how we learn what people wanted that the charts did not hold. It is stored as a count of queries, not as a record of you: nothing is attached that ties a query to a person, a device or an earlier visit. The words are also sent, through this site, to Audible’s catalogue and to Open Library’s, which is how the search answers for books that are not on a chart today; neither is told who asked.

The script is served from this domain rather than from the machine that counts, so blockers do not quietly remove a third of the readers from our own picture of the site. That is a change of address, not of behaviour: it is the same script, doing the same thing, and blocking it still works if you would rather it did not run.

If you make an account

An account exists for one reason: to keep a list of books you want to come back to. Nothing on this site is behind it, and you can read, search and buy from every page without one.

When you make one we store:

• Your email address — as the name of the account, and to send you a sign-in link if you use that route.
• The books you saved, with the title, author, narrator, cover and runtime as they stood when you saved them, plus whether you marked a title finished, whether you asked to be told when it is released, and any private note you wrote against it.
• A session token, stored hashed, so the browser you signed in on stays signed in for 90 days.

We do not store a password, because there is never one to store. Signing in happens either through Google — which tells us your email address and a stable identifier, and nothing else — or through a one-time link we email you, which works once and expires in fifteen minutes.

Notes you write are private to your account. Nothing you save is public, shared, sold, or used to build a profile, and none of it is passed to the shops we link to.

A linked device, if you have one

A device linked to this account never asks you to sign in. If you choose to link it, it shows you a short code, you type it here once, and from then on the two keep the same list: titles you save on your phone appear here, and titles you save here appear on your phone. Deleting a book in either place deletes it in both.

What crosses that link is your saved list — the titles, the notes you wrote against them, and whether you marked one finished.

Bookmarks are a separate choice. If you also switch on bookmark syncing on that device, then the marks you have made inside books you own come here too: the name of the book, how far into it each mark sits, what you called it, the note you wrote, and the tag you gave it. That means this site holds part of your library and your position in those books, which it does not otherwise know. It is off unless you turn it on, it is separate from the wishlist, and turning it off stops it.

Beyond those two things a linked device sends nothing. This site never learns what you are listening to now, your progress through books you have not bookmarked, where the files you own are kept or how that is set up, or any credential for any of it — and it never asks. You can unlink the device at any time from your account page, which cuts the connection immediately and leaves everything on your phone untouched.

If you ask for the weekly email

We keep your email address, the date you confirmed it, and the date the last issue was sent to it. That is the whole of it: no name, no account required, and no record of what you opened or clicked — the mail carries no tracking pixel and no per-reader links, so we do not know who reads it.

Nothing is sent to an address until the address answers. Asking creates a row with an unconfirmed flag, and until you follow the link in the confirmation the only mail that can ever be sent to it is that confirmation. An address that never confirms is deleted within a week.

Every issue carries a one-click way out, and using it deletes the row rather than marking it. There is no suppression list here — nothing is kept in order to remember not to contact you. If you also have an account with the same address, deleting the account deletes the subscription with it.

Cookies

Signed out, this site sets no cookies of its own. Signed in, there is exactly one: a session cookie that identifies your account to the server. It is marked HttpOnly so page scripts cannot read it, Secure so it never travels unencrypted, and SameSite=Lax so other sites cannot use it. There are no advertising or analytics cookies — there is no advertising at all, and the measurement described above works without one. One cookie is set by somebody else, and only if you ask for it: following the Libro.fm button puts you on Awin’s domain, where Awin sets one — see The Libro.fm link goes through Awin below.

Affiliate links

Buying links to Libro.fm and Audible carry a tracking id, so those shops know the visit came from here and pay us a commission. The same is true of the print and Kindle links below the buy row, which are the same book in a format you read rather than listen to. Some buy links go through /go/ on this domain first: that is one hop that reads which country the request came from so it can send you to your own storefront rather than the American one. It stores nothing, sets nothing, and passes no referrer on. Following any of them hands you over to that shop under its own privacy policy, not ours. We are told that a sale happened; we are not told who you are, and we cannot connect a purchase to an account here. Nothing in the charts is placed, reordered or removed for commercial reasons — see the affiliate disclosure.

The Libro.fm link goes through Awin

Libro.fm pays its commission through an affiliate network called Awin, and that changes the shape of one link on this site. The Libro.fm button does not go to Libro.fm. It goes to awin1.com, a domain belonging to Awin, which records the click, sets its own cookie in your browser, and forwards you to Libro.fm — usually faster than you can read this sentence. The cookie lasts 30 days, and if you buy from Libro.fm within it, Awin tells them the sale started here and we are paid for it.

This is a third party in the path, and it is worth being exact about how it differs from the /go/ hop described above. That one is ours, on this domain, and stores nothing. This one is not ours: the cookie is Awin's, set on Awin's domain under Awin's privacy policy, and we can neither read it nor stop it. What comes back to us is a count of sales and what they earned — never who bought, never what they bought.

Nothing here is loaded until you click. Reading a book page contacts Awin not at all: the link is an ordinary link, and it is only following it that puts you on their domain. If you would rather not be counted, going to libro.fm yourself buys the same audiobook at the same price.

Your rights over this data

If you are in the UK or the EU these are rights under the UK GDPR and the GDPR. We apply them to everyone, because operating two standards would only mean running the worse one.

• See it. Your account page has a Download my data button that gives you a JSON file containing everything we hold about you, immediately. It is complete: the account, how you sign in, every saved book, every bookmark, every linked device, and your sessions. The only things left out are the hashes of your session and device tokens, which are credential material and say nothing about you.
• Take it elsewhere. That same file is the portable copy — structured, machine-readable, and yours.
• Correct it. Notes are editable in place. Anything else, write to us and we will change it.
• Delete it. The Delete account button removes the account and everything attached to it, immediately and permanently, with no confirmation email, no waiting period, and no copy kept.
• Withdraw consent. Unlinking a device stops it sending anything. Deleting the account ends all of it.
• Object, or ask us to restrict what we do. Write to us.

If you cannot reach your account — you have lost access to the email address, say — write to support@illiterati.co and ask. We will do it by hand. We will answer within 30 days, and it will usually be the same week. We may have to ask something to confirm the account is yours; we will ask for the least that will do, and we will not use it for anything else.

If you think we have handled your data badly, you can complain to us and you can also complain to a supervisory authority — in the UK the Information Commissioner's Office, in the EU the authority in the country where you live.

How long we keep things

• Saved books and bookmarks: until you delete them, or delete the account.
• Deleted items: kept for 90 days as a "this was removed" marker, so your phone learns about the deletion instead of putting the item back. Then gone.
• Sign-in sessions: 90 days, then expired and deleted.
• Sign-in links and pairing codes: valid for 15 and 20 minutes; the spent rows are deleted within a day.
• Dormant accounts: if you do not sign in for two years, the account and everything in it is deleted automatically. You do not have to do anything.
• The weekly email: your address is kept until you leave, and deleted the moment you do. An address that was asked for and never confirmed is deleted after seven days.

Who we are, and who else is involved

The data controller is Noir Egrets LLC, contactable at support@illiterati.co.

Three other companies process some of it on our behalf, and none of them are given it for their own purposes:

• Cloudflare hosts the site and the database, in their North American region. If you are in the UK or the EU, that means your data is transferred outside it; the transfer is covered by Cloudflare's own data processing terms and the standard contractual clauses within them.
• Google, only if you choose to sign in with Google. They tell us your email address and a stable identifier for your Google account, and nothing else. We tell them nothing about you.
• An email provider, only to deliver a sign-in link you asked for.

Cover images come from Audible's image host, so loading a page tells them an image was requested from your address. We ask your browser not to send a referrer with those requests, so they are not told which page you were reading. Nothing else about you is passed to them, and nothing at all is passed to the shops we link to until you follow a link.

Why we are allowed to hold it

For an account: because you asked for one, and we cannot keep a list for you without keeping the list. In GDPR terms that is performance of a contract with you. For the affiliate links: our legitimate interest in being paid for the site, which is why the disclosure is on every page rather than buried. There is no advertising, no profiling, and no automated decisions being made about you. We do not sell anything about you, to anyone, ever.

For the weekly email: your consent, given by confirming the address and withdrawable from any issue in one click. It is the only thing on this site that runs on consent, which is why it is the only thing that asks for it twice.

An account is entirely optional and nothing on this site is behind one, so nothing is conditional on giving us anything.

Deleting everything

Your account page has a delete control that removes the account, every saved book, every bookmark, every note and every device link, immediately and permanently. You do not need to ask us, and we do not keep a copy. Removing a single item deletes that row rather than hiding it, apart from the 90-day marker described above.

One thing deleting here does not do: it does not touch your phone. Your library, your bookmarks and your want-list stay on the device, because they are yours and that is where they live. Unlink the device, or remove them there.

Changes

This page was last changed on October 24, 2026. If it changes in a way that affects what we store or why, the change will be described here rather than quietly made.