Privacy Policy

Last updated July 6, 2026

Covenant Reader is a subscription reading service for families. We built it to be a safe, quiet place to read with your children — so we collect as little as possible, we never sell data, we show no advertising, and we use no third-party trackers or advertising identifiers.

What we collect

• From you (the parent or guardian): your email address, a password (stored as a secure hash), and your payment details — which go directly to Stripe, our payment processor. We never see or store your card number.
• Associated with a child: only what you provide or your child’s use generates — a first name or nickname, a reading level, a chosen avatar, and reading activity (which stories a profile opens, the last page read, completions, and favorites, so shelves can show “continue reading”). We never collect a child’s real name, birth date, photo, email, address, phone number, or precise location. Children do not create accounts or enter information themselves.

Children’s privacy (COPPA)

Covenant Reader is directed to families and children, and we comply with the U.S. Children’s Online Privacy Protection Act (COPPA). A parent or guardian creates and controls the account and sets up every reader profile; children do not sign in or provide information on their own.

Parental consent. Only an adult can create an account. Because account setup is adult-gated — and paid subscriptions are verified through a credit-card transaction with our payment processor — a parent gives consent before any child profile or reading data is created. Parents choose each child’s nickname, reading level, and avatar themselves.

Your rights as a parent. At any time you may:

• Review the information associated with your child’s profile from your account page;
• Delete it — remove a single reader profile (which deletes that child’s nickname, reading history, and favorites), or delete your entire account and all data at covenantreader.com/delete-account;
• Refuse further collection — remove the profile or close the account, and we stop collecting and delete the associated data.

We show no advertising of any kind, run no behavioral or interest-based advertising, and use no third-party trackers or advertising identifiers anywhere in the app. If you believe a child provided us personal information without your consent, email hello@covenantreader.com and we will delete it promptly.

How long we keep data, and how we protect it

We keep your family’s information only as long as needed to provide the service, on this schedule:

• Reader profiles & reading activity (child data): kept while your account is active or paused; deleted right away when you remove a profile or delete your account.
• Paused accounts (your choice): if you pause instead of cancelling, we keep your library and reading progress so they come back when you resubscribe — for up to 24 months of inactivity, after which we email you and then delete the data.
• Account & parent email: kept while active or paused; removed on deletion.
• Server logs: up to 90 days. Backups: rolling, purged within 30 days.
• Email sign-ups without an account: purged after 18 months of inactivity.
• Payment & billing records: held by our payment processor (Stripe) and by us only as long as tax and accounting law require.

We protect your data with encryption in transit and at rest, access controls, and a written information-security program, and we require our service providers to protect children’s information under contract. We never sell or rent data to anyone.

Who processes data for us

These are contracted service providers that process data only to provide their service to us — never for their own purposes:

• Supabase — database and authentication hosting
• Google— optional “Sign in with Google” for the parent’s account, only if a parent chooses it
• Stripe — subscription payments
• Vercel — website hosting and server logs
• Resend — transactional email (confirmations, receipts)
• Loops— marketing email to parents; receives a parent’s email and a coarse account status (free or subscriber) only — never a child’s nickname or reading activity
• Expo, Apple, and Google — push-notification delivery for the mobile app (a device push token only; no advertising identifier)

Each receives only what it needs to do its job.

We also use a few first-party items we control ourselves: an essential login cookie; a first-party cookie (cr_src) that records how a visitor first reached us; server logs; and our own record of which stories a reader profile has opened, to power “continue reading.” We use no third-party trackers or advertising identifiers.

Deleting your data

You can permanently delete your account and all associated data at any time — see covenantreader.com/delete-account. It cancels any subscription immediately and removes every reader profile and all reading history. You can also email us and we will do it for you.

Changes to this policy

If we make material changes, we will update the date above and, where appropriate, notify account holders by email.

Contact & operator

Covenant Reader is operated by Brian Reinke, 24 Porcupine Dr., Palm Coast, FL 32164, USA, 989-948-6543. Questions about this policy or your family’s data, including any COPPA request: hello@covenantreader.com.