Privacy

Archerion Labs, in Pasco County, Florida, operates archerionlabs.com and Speed Reader. For anyone reading this under the GDPR, we are the data controller. Write to RJ@archerionlabs.com and a person answers.

Speed Reader needs your text on the server to render it back to you one word at a time. So we store it, along with the title you give it, its word count, and how far through it you are. That is the whole row.

If you are not on a paid plan, that row is built to disappear. It expires one hour after you create it, and it is marked finished the moment you reach the end. A cleanup job runs every five minutes and deletes anything more than ten minutes past either mark, so the practical ceiling is about an hour and a quarter, usually far less. We keep no copy of our own anywhere else, though see the note on backups in section 09.

On a paid plan the row has no expiry, because the point of paying is a reading history that survives. It stays until you delete it, and every row of your history has a delete control that removes it on the spot.

While a session is live it is locked to your browser by a random secret we set as a cookie. Nobody who guesses the URL can read your text without that secret.

Same path if you reach Speed Reader through the MCP tool from an AI assistant: whatever text your assistant sends becomes an ordinary session row under the same rules. We do not send your text to any AI model. There is no model in this product. The summary line above the reader is arithmetic on the word count, nothing more.

You can use Speed Reader without an account. If you make one, we store your email address. If you sign in with Google, we store the basic profile Google hands back with it. Authentication runs on Supabase, which holds that record for us.

We use it to know which saved sessions are yours and to email you a sign-in link. We do not send marketing.

Paid plans run through Stripe. Card numbers go to Stripe and never touch our servers. What lands in our database is the Stripe customer and subscription identifier, the status of the subscription, the tier, and when the current period ends. That is enough to know whether to unlock the paid features and nothing more.

We also log the identifier of each Stripe webhook we receive, for ninety days, so a message delivered twice is not processed twice. Those identifiers say nothing about you.

Before your first purchase we ask you to accept the terms of service, and we record which version you accepted and when. That record is part of your account and is deleted with it.

We never store it. To stop one machine from flooding the service we need to count requests per source, so we run your IP through a keyed one-way hash and count against the hash instead. The key rotates, which means hashes from one period cannot be lined up against another. Those counter rows are deleted after two hours.

Our hosting and database providers see IP addresses in their own transport logs, the way every host on the internet does. That is their retention, under their terms, not a store we keep or query.

Only the ones that make the thing work. No advertising cookies, no analytics cookies, nothing shared with a third party, and no consent banner, because strictly necessary cookies do not require one.

sr_session_<id> and sr_api_<id>

A random secret that proves a reading session belongs to your browser. Contains no identity. Set with HttpOnly and Secure, so page scripts cannot read it. Scoped to that one session.

sb-<project>-auth-token

Set by Supabase only after you sign in. It is what keeps you signed in between page loads. Signing out clears it.

Four companies, each doing one job, none of them given your data to use for their own purposes.

Vercel

Hosts the site and runs the server code.

Supabase

The database and the sign-in system. Your sessions and your account record live here.

Google

Only if you choose Google sign-in. Skip that button and Google is not involved.

Stripe

Only if you subscribe. Handles the payment and holds the card details we deliberately never see.

We will also hand over data if a valid legal order requires it. If that ever happens and we are permitted to tell you, we will.

Under the GDPR, storing your text and running your account is necessary to give you the service you asked for. Rate limiting is our legitimate interest in keeping the service standing. Billing records are contractual, and we keep the tax-relevant parts as long as the law requires. If you are in the United States, the plain version is that we do not sell or share your personal information and there is nothing to opt out of.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask for it in a portable format, or object to how we are using it. If you are in the EU or the UK you can also complain to your data protection authority, though we would rather you came to us first.

Deletion you do yourself, without asking us and without waiting. Every row of your reading history has a delete control. Your data lists everything we hold on you and will delete the whole account, the saved reads, and the billing record together. If you are on a paid plan it cancels the subscription first, so deleting cannot leave you paying for an account that no longer exists.

One caveat we would rather state than bury. Deleting removes your data from the live database immediately, but our database host takes a backup every day and keeps each one for seven days. So a copy of something you deleted can sit in a backup until it ages out. We never restore an account or a read from those backups, and after seven days it is gone from them too.

For the rest, a copy of your data or a portable export, email RJ@archerionlabs.com and we will answer within thirty days. Those two are not self-serve yet, and we would rather say so than describe a control that does not exist.

On servers in the United States. If you are in the EU or the UK, using Speed Reader means your data goes there. Our providers cover that transfer under the European Commission’s standard contractual clauses.

Speed Reader is not built for children and we do not knowingly collect anything from anyone under sixteen. If you believe a child has given us data, email us and it comes out.

When this policy changes in substance we change the date at the top and the version identifier below. We do not quietly rewrite history.

privacy-2026-08-04

RJ@archerionlabs.com
Archerion Labs, Pasco County, Florida, United States