Privacy Policy

This Privacy Policy explains how MistyMatic ("we", "us") handles information in the Sanctle mobile application for Android (the "App") and on sanctle.com (the "Site"). It applies to every part of the App: reading, writing, commenting, letters, highlights, notifications and advertising.

By creating an account or using the App you agree to this Policy. If you do not agree, please do not use the App.

1. Information we collect

Information you give us

• Account details — your email address, your password (stored only as a cryptographic hash by our authentication provider; we never see it), your username, your display name, and the postal address you provide at sign-up.
• Profile details — your biography, profile picture or avatar, and any social links you add to your profile.
• Content you create — stories, chapters and volumes you publish as an author, comments and replies, letters you send to authors, highlights, bookmarks, reactions, and reports or support requests you submit to us.

Information created when you use the App

• Reading activity — the books, volumes and chapters you open, your reading progress and position, reading sessions and rhythm, your library and bookshelf categories, and your unlocked chapters. We use this to sync your progress across your devices and to show you your own activity.
• Device and technical information — a device identifier (Android ID, or the iOS vendor identifier), the operating system and platform type, a one-way SHA-256 hash of the device identifier that we use for abuse and rate-limit checks, and your push notification token. Your preferences (theme, reader font, text size) are stored locally on your device.
• Integrity and security signals — an app-attestation token from Google Play Integrity (Android) or App Attest (iOS), used to confirm that requests come from a genuine, unmodified copy of the App.
• Advertising information — the App may show ads through Google AdMob. When ads are shown, Google and its partners may collect your device's advertising identifier and other device-level information to serve and measure them. See section 5.
• Photos you choose — if you pick an image for your avatar, profile, or a story cover, we receive only the file you select and upload it to our storage.

We do not collect your precise location, your contacts, your calendar, your call logs, your SMS messages, or the contents of your photo library beyond the single image you choose to upload. The App does not run third-party analytics or crash-reporting SDKs.

2. How we use information

• Create and secure your account, sign you in, and let you reset your password.
• Deliver the core service: publish and read stories, sync reading progress and unlocks, and enable comments, letters, highlights and notifications.
• Send you service emails — account confirmation, password reset and security notices.
• Send push notifications you have opted into (new chapters, replies, mentions, follows). You can turn these off in the App or in your device settings.
• Keep the service safe: detect abuse, spam, fraud, bots and invalid ad traffic, and enforce our terms.
• Show advertising that funds the free reading experience, and measure how it performs.
• Respond to your questions and support requests, and comply with legal obligations.

3. Legal bases (EEA, UK, Switzerland)

Where the GDPR applies, we rely on: performance of a contract to provide the App and your account; legitimate interests to keep the service secure, prevent abuse and improve it; consent for push notifications and personalised advertising, which you can withdraw at any time in your device or Google Ads settings; and legal obligation where we must retain or disclose information by law.

4. Sharing information

We do not sell your personal information. We share it only with the service providers that run the App, and only as needed:

• Supabase — hosts our database, authentication and media storage. Your account, profile, content and reading data are stored there.
• Google — Firebase Cloud Messaging delivers push notifications; Firebase App Check and Google Play Integrity provide app attestation; Google AdMob serves the ads in the App; Google Fonts supplies some reading fonts, which means your device requests font files from Google's servers.
• Mailjet — delivers our account and password-reset emails, so it processes your email address on our behalf.

We may also disclose information if the law requires it, to protect our rights or the safety of users, or as part of a merger or acquisition, in which case we will notify you. Anything you post publicly in the App — your username, profile, comments and published stories — is visible to other users.

5. Advertising

The App is free, and reading may be supported by advertising served by Google AdMob: a banner ad, and a native ad shown when a chapter opens. To serve and measure ads, Google and its partners may use your device's advertising identifier, your IP address, and device and usage information.

You control this: open your device's Settings → Privacy → Ads to delete or reset your advertising ID and to opt out of personalised advertising, or use Google's My Ad Center. Google's handling of this data is described in the Google Privacy & Terms. Opting out does not remove ads; it makes them less relevant.

6. Retention

We keep your account and content while your account is open. When you delete your account we delete or anonymise your personal information and user content, with two kinds of exception: records we must keep for legal, tax or security reasons, and content other users have interacted with (for example a comment in a thread) which may be retained in anonymised form. Backups are overwritten on a rolling basis.

7. Deleting your account and data

You can delete your account at any time from inside the App: Settings → Delete Account. This permanently removes your account, your profile and your content, and revokes your access immediately.

You can also request deletion, or ask us to delete specific data, by emailing sanctle.app@gmail.com from the email address on your account. We respond within 30 days.

8. Security

Traffic between the App and our servers is encrypted in transit. Access to stored data is governed by row-level security rules, so an account can only reach its own rows and public content. Passwords are stored as hashes and never in readable form. No system is perfectly secure, so please use a unique password and tell us promptly if you suspect unauthorised access to your account.

9. International transfers

Our providers may store and process information in countries other than your own, including the United States. Where personal data leaves the EEA or the UK, we rely on the providers' standard contractual clauses and equivalent safeguards.

10. Children

Sanctle is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect personal information from them. If you believe a child has created an account, email us at sanctle.app@gmail.com and we will delete the account and its data.

11. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to our processing of your information, to receive it in a portable format, and to withdraw consent. You can exercise most of these in the App (edit your profile, delete your account), and the rest by emailing us. You may also complain to your local data protection authority.

12. Changes to this Policy

We may update this Policy as the App changes. When we do, we revise the effective date at the top of this page and, for material changes, notify you in the App. Continuing to use the App after an update means you accept the revised Policy.

13. Contact us

Questions, requests or complaints about privacy: sanctle.app@gmail.com.