The short version
- Read without an account. If you never sign in, we store nothing about you on our servers.
- No advertising, no ad networks, no analytics, no crash reporting.
- No tracking across other apps or websites, so the app never shows the App Tracking Transparency prompt.
- We do not sell or rent your data, and we do not share it for advertising.
- Account data is stored in Singapore, at Supabase. Delete your account whenever you want.
Who is responsible
Capitula is made and operated by Shangting Huang, an individual developer in Hong Kong. "We" and "us" mean that person. The App Store seller name is the developer's legal name: Shangting Huang. Contact: [email protected]
What we collect, and why
Signing in (optional)
You can browse the library and play the free chapters without an account. An account keeps your progress and notes across devices, and is what a Capitula Premium subscription is attached to. The iOS app offers Sign in with Apple; the website offers Sign in with Apple, Google sign-in and email with a password.
- Sign in with Apple — an Apple account identifier, plus your name and email, but only the first time you authorize. If you chose Hide My Email, we get Apple's private relay address and use that to reach you.
- Google — your email, your name, and your Google picture URL (only addresses on googleusercontent.com).
- Email and password — your email. The password is handled by Supabase Auth; we never see it in plain text. Supabase may send you an email to confirm the address.
Your email, display name and account ID live in a table called reader_profiles. That is what identifies your account.
Your reading
When you are signed in, we save:
- Reading progress — the chapter, where you stopped, whether you finished it, and the markers that draw the progress bar.
- Notes — the chapter, the passage, its timestamps, the note text, and a separate private field for your own remarks. That private field is never included in anything you share.
- Shares — the chapter, the passages you picked, whether your name is shown, and how often the link was opened.
- Avatar — a small inline image (128 pixels at most) on your profile row. Web readers may keep using their Google picture.
Your device
The app caches chapter packages on your device for offline reading and keeps your sign-in session in the app's own storage. On the web, your browser keeps your settings, recent audio, and — until you sign in — your progress and notes in its local storage; the sign-in session is a cookie set by capitula.io. A guest who never signs in leaves no account data on our servers.
Purchases and subscriptions
On the web: Paddle
Web purchases are sold and processed by Paddle (Paddle.com Market Ltd and Paddle.com Inc), our merchant of record. When you check out, we create a Paddle customer with your account email and pass your Capitula account ID to Paddle so the purchase can be linked to you. Paddle collects your payment details and billing address under its own privacy notice and keeps the purchase records it needs for tax and accounting. The checkout loads Paddle's script (Paddle.js) only when you start a purchase.
Paddle tells us the subscription status, plan, billing period and any refund or chargeback. We store that, with Paddle's subscription and customer identifiers, against your Capitula account.
In the app: Apple or Google
Apple or Google tells us whether a subscription is active, which plan it is and when it renews. We store that status and the App Store transaction identifier or Google Play purchase token against your Capitula account.
Why and how long
We use purchase information to know which chapters you can open, to give the free trial once per account, and so support can answer questions. We keep it while your account exists and delete it with your account; the payment providers keep their own records.
Deleting your Capitula account or the app does not cancel a subscription. Cancel a web subscription in Paddle's customer portal (You → Manage subscription), an iOS one in Settings → [your name] → Subscriptions, and an Android one in Google Play.
Where your data is stored
Account and reading data lives in Supabase, project reference mfrckjkgewhzrdwjionw, region ap-southeast-1 (Singapore).
Chapter packages, audio and cover art are static files served from Cloudflare R2 at media.capitula.io. They are the same for every reader and hold no personal data. Our site and that media domain sit behind Cloudflare, which handles TLS and caching.
Reader tables have row-level security enabled and direct client access revoked — including for our own app. Reads and writes go through our server, the only thing holding a database key.
What we do not do
- No advertising or advertising SDK.
- No analytics, no product analytics, no session recording.
- No crash-reporting or performance SDK.
- No social-network or install-attribution SDK.
- No advertising identifier and no cross-app or cross-site tracking.
- No selling, renting or trading of personal information, and no sharing for behavioural advertising.
We searched the source of both the app and the web reader for the usual vendor SDKs — Firebase, Google Analytics, Sentry, Amplitude, Mixpanel, PostHog, Meta, AdMob and others — and found none. Apart from our own hosts, the web reader contacts only Paddle, and only when you start a purchase.
Who else touches your data
| Provider | What it does | What it involves |
|---|---|---|
| Supabase | Database and sign-in | Account, progress, notes, shares, subscription status |
| Cloudflare | CDN, DNS, R2 storage | Serves static files; sees request metadata |
| Paddle | Web purchases (merchant of record) | Account email and ID, payment details, billing address, purchase records |
| Apple | Sign in with Apple; in-app purchases | Apple identifier, name, email; subscription status and transaction identifier |
| Google sign-in; Google Play purchases | Email, name, picture URL; subscription status and purchase token |
Our servers also keep standard request logs — IP address, user agent, timestamp, requested URL — to run the service, diagnose faults and stop abuse. We do not use them to profile you or to advertise.
AI and where our content comes from
Every book is in the public domain; texts come from Project Gutenberg and Standard Ebooks.
The animated explanations are original to Capitula and made with AI in the loop: AI-assisted scripts, generated visuals and text-to-speech narration. A person reviews every chapter before release.
Your notes, reading progress and account details are not sent to any AI service.
Children
Capitula is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, write to [email protected] and we will delete it.
Your choices and rights
- See your data. Everything you created is visible under You and Notes. For a machine-readable copy, email us.
- Correct it. Change your display name and avatar in the app or on the web; email us for anything else.
- Delete it. See the next section.
- Object or restrict. Email us and we will stop whatever processing we can stop.
- Complain. In the EU or UK you may complain to your local data protection authority. Our contact point is in Hong Kong.
In the EEA and the UK our legal bases are performance of a contract for the features you asked for (including subscriptions), legitimate interests for security and abuse prevention, and consent where we ask for it.
California residents: we do not sell or share personal information as the CCPA and CPRA define those terms, and we do not use it for cross-context behavioural advertising. You have the right to know, delete, correct and opt out — we honour those requests for everyone, not only for California.
Deleting your account
In the app: open Me → Account → Delete account and confirm. By email: write to [email protected] from the address on your account. Step-by-step instructions: Delete your account.
Deleting your account removes your profile, progress, notes and share links, and signs you out everywhere. It is permanent. We complete requests within 30 days and keep no copy afterwards, except where the law requires it.
Deleting your account does not cancel a subscription. Cancel it first, wherever you bought it.
How long we keep things
- Account, progress and notes: until you delete them, or delete your account.
- A note you delete: removed from the server on the next sync, and from any share link containing it.
- Share links: until you revoke them or delete your account.
- Subscription records: while your account exists.
- Server request logs: rotated daily and kept for up to 14 days, then discarded.
Security
Traffic uses TLS. Account data sits in Supabase with row-level security on and direct client access revoked, and database and payment credentials stay on the server. On the web your session is an HttpOnly cookie that scripts cannot read; in the app it lives in the app's own storage, protected by the operating system's sandbox. No system is perfect, but we collect very little.
Changes to this policy
If we change how Capitula handles data, we update this page and the effective date above. For a change that materially affects you, we show a notice on the website or in the app before it takes effect. Continuing to use Capitula means you accept the updated policy.
中文摘要
Capitula 由个人开发者 Shangting Huang（香港）运营。
- 可免登录使用：不登录就能看每本书的第 1 章，不会在我们的服务器上留下任何账号数据。
- 收集什么：登录后才有邮箱、显示名、账户 ID；登录状态下产生的阅读进度、笔记、分享记录，以及你自愿设置的头像。
- 订阅：Capitula Premium（年付 $49.99 / 月付 $7.99）。网页上由 Paddle（merchant of record）收款，App 里由 Apple 或 Google 收款；我们拿不到卡号，只保存订阅状态、套餐、账期与各平台的订阅编号，用于判断你能看哪些章节。
- 订阅取消：删号或删 App 不会取消订阅。网页订阅在「You → Manage subscription」（Paddle 客户门户）取消；App 订阅在 App Store 或 Google Play 的订阅设置里取消。
- 存在哪：账号与阅读数据存在 Supabase（新加坡，ap-southeast-1）；章节包、音频与封面是所有人相同的静态文件，放在 Cloudflare R2（media.capitula.io），不含个人数据。
- 不做什么：没有广告、没有统计/分析、没有崩溃上报、没有追踪 SDK；不出售或出租你的数据。网页只在你开始购买时加载 Paddle 的结账脚本。
- 内容来源：全部为公版书（Project Gutenberg / Standard Ebooks）；章节解说动画由 AI 参与制作（脚本、画面、TTS 配音），发布前有人工复核。你的笔记、进度与账号信息不会发送给任何 AI 服务。
- 儿童：不面向 13 岁以下用户。
- 你的权利：访问、更正、删除。删除账号可在 App 内 Me → Account → Delete account，或用账号邮箱写信到 [email protected]。30 天内完成，不可恢复。
Contact
[email protected] — Shangting Huang, Hong Kong.