Privacy Policy

LoreMark is committed to respecting and protecting your privacy. This Privacy Policy details how we collect, store, and safeguard your data when you visit our website, read webnovels in our reader, and synchronize reading state with our applications.

Who is responsible. Tran Manh Tien, an individual (trading as LoreMark Ebooks), 59/17/17 Nguyen Thi Can, Tan Thoi Hiep Ward, Ho Chi Minh City, Vietnam, is the data controller for the personal data described here. Privacy contact: loremark.dev@gmail.com. Payments are handled by PayPal, depending on the checkout you choose; each acts as an independent controller for payment data.

1. Data We Collect

We adhere to data minimization principles, collecting only what is strictly required to provide reading and account synchronization:

• Account Identity: Email address and profile display name (provided via username and password registration, Google OAuth, or Apple Sign-In). Purpose: create and secure your account. Legal basis: performance of a contract.
• Purchase Information: When you buy a VIP subscription or coins, the payment provider you choose (PayPal) collects your name, email, billing country/postcode and payment details to process the order, calculate tax and prevent fraud. We receive only order confirmation data (order ID, product, amount, country, subscription status); we never see or store your full card number. Purpose: fulfil orders, provide access, bookkeeping. Legal basis: contract and legal obligation.
• Reading State: Current chapter, scroll offset percentages, library bookmarks, and user-saved quotes for multi-device sync.
• Usage Events: To measure reading activity, we record pseudonymous usage events when you open a book page, read a chapter, sign in, bookmark a title, or sync reading progress. Each event contains an internal account ID (never your email address; signed-out visitors are recorded as "guest"), the book and chapter, your country, your device type (web or mobile app), and the host of the site that referred you. Usage events are kept for at most 90 days and are never sold or shared with third parties.
• Security & Telemetry: Anonymized edge metrics, IP rate-limiting counters, and security tokens to safeguard API endpoints. For abuse prevention and automated scraping defense, we maintain temporary chapter read counters keyed by a cryptographic HMAC hash of your IP address prefix (never stored as raw IP addresses); these rate counters are automatically purged after 48 hours.

2. Data Processors & Infrastructure

We partner with industry-standard third-party sub-processors to deliver low-latency reading and authentication:

• Cloudflare Inc.: Edge CDN caching, Workers runtime, D1 relational database, R2 book asset storage, Analytics Engine usage-event storage, and Turnstile bot protection.
• PayPal Pte. Ltd.: Secure payment processing, recurring VIP subscription billing, fraud prevention, and transaction verification for orders paid with PayPal. See PayPal's Privacy Statement.
• Google LLC: Identity authentication via Google OAuth, and transactional email delivery via Gmail for account verification and password reset codes.

We may also disclose data to professional advisers and to authorities where legally required. We do not sell your personal data.

3. Retention, Security & International Transfers

Account and reading data is kept while your account is active and deleted when you delete your account, except order records we must keep for tax and accounting (typically up to 7 years). Usage events are kept for at most 90 days. We protect data with encryption in transit, access controls and edge security. Your data may be processed outside your country; where required we rely on adequacy decisions or Standard Contractual Clauses with our providers.

4. Your Rights (GDPR, UK GDPR & CCPA)

Regardless of your geographic location, LoreMark affords all users full privacy agency:

• Access & Portability: View and export your saved bookmarks, reading history, and quotes directly from the Library hub.
• Rectification: Update your profile preferences at any time.
• Erasure (Account Deletion): Permanently delete your user account and all associated reading records directly through account settings.
• Restriction, Objection & Withdrawal of Consent: Contact us at loremark.dev@gmail.com to restrict or object to processing, or to withdraw consent where processing is based on consent.
• Complaint: You may lodge a complaint with your local data protection supervisory authority.

We respond to privacy requests within one month.

5. Cookies & Local Storage

We use secure, HTTP-only authentication cookies and browser local storage strictly for maintaining your active reading session, typography preferences, and offline fallback progress. We also issue a temporary cryptographic human proof cookie (valid for 24 hours) upon solving an interactive verification challenge to prevent automated scraping. We do not use third-party tracking or advertising cookies.