Privacy & cookies

Covers the ireadingroom.com website, the iReading Room app and its browser extension. Last updated 8 November 2026.

Who is responsible

The controller under the GDPR is Majid Golshadi, trading as Reading Room (iReading Room), a sole proprietorship, Chausseestraße 122, 10115 Berlin, Germany. Email: support@ireadingroom.com. The same details are in our legal notice.

What we use data for, and the legal basis

• Running the app for you: your account, library, notes, feeds, rankings and Summary, and the emails the app sends you. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
• Paid plans: giving you the plan you bought, answering billing questions, and counting our subscriptions and revenue. Legal basis: our contract with you (Art. 6(1)(b)), our legitimate interest in knowing how our business is doing (Art. 6(1)(f)), and the records tax law requires us to keep (Art. 6(1)(c)).
• Website analytics, only if you accept: to see which parts of this site lead people to create an account or ask for a sample briefing. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time, as easily as you gave it.
• Answering you: contact-form messages, emails and sample requests. Legal basis: our legitimate interest in replying (Art. 6(1)(f)), or steps you ask for before a possible contract (Art. 6(1)(b)).
• Security and improvement: hosting, technical logs, spam protection, and counting how the app’s features are used. Legal basis: our legitimate interest in a secure, working and useful service (Art. 6(1)(f)).

Rankings in the app are automated, but they only order papers for you. We make no automated decisions that have legal or similarly significant effects on you.

Visiting this website

Cloudflare delivers this website and the app and protects them from attacks. To do that it processes your IP address and the technical details every browser sends, such as the page requested and the browser type. We don’t use them to identify visitors, and the website request logs we can see are deleted after at most 7 days. Fonts, images and videos come from our own site, so loading a page contacts no other company. The one exception is our checkout page, ireadingroom.com/pay, which you only reach when you pay for a plan: it loads Paddle’s checkout, so Paddle and the service providers its checkout uses receive your IP address and browser details to run the payment, under Paddle’s privacy notice. Paddle and its payment providers may also set security cookies on their own domains to run the payment and prevent fraud; these are needed for the payment and so need no consent.

Analytics and cookies

Only if you press “Accept” on the cookie banner does this site load Google Analytics 4. Declining, or ignoring the banner, means no analytics at all.

• It records the pages you view, scrolling and which buttons you click, with the technical details your browser sends: approximate location (worked out from your IP address, which Google Analytics does not store), browser, device type and the site you came from.
• Events carry only a fixed set of labels, never page content, searches or project descriptions. Advertising features are switched off.
• It sets two cookies, _ga and _ga_<id>, holding a random identifier. They expire after 180 days.
• Google keeps the analytics data for 14 months, then deletes it automatically.

Your choice is saved in your browser’s local storage as rr_consent for 180 days, after which you are asked again. It holds no identifier, is never sent anywhere, and exists only to respect your choice, so it needs no consent itself. To change your mind, use Cookie settings in the footer of the home page, or clear your browser storage.

If you send us a message

The contact form on the about page collects nothing until you press send. Then we receive the name, email address and message you typed, and the time it arrived. Our server stores them in a private Google Sheet, and we use them only to answer you: never for a mailing list, advertising or anything else. We keep messages for 24 months, or delete yours sooner if you ask.

Cloudflare Turnstile protects the form from spam. It loads only once you start using the form and checks signals from your browser to tell a person from a bot; Cloudflare says it does not read what you type. It may set short-lived cf_chl_rc_* cookies for that check. Because it only protects a form you chose to use, it does not wait for the cookie banner.

Prefer no form? Email support@ireadingroom.com directly.

If you ask for a sample briefing

The home page and the pricing page offer a free sample briefing. It is an email link, not a form, so nothing reaches us until you send the email from your own mail program. We then receive your email address, your name if your mail program sends it, what you write about your team, and the time it arrived.

We use it only to make your sample and reply to you: no mailing list, no marketing, and we never sell it. Mail to support@ireadingroom.com is received through Cloudflare and kept in our Gmail mailbox, and we track where each request stands in a private Google Sheet. The founder makes each sample by hand: your email address and what you write are never put into an AI tool or service, and are passed to nobody else.

The legal basis is taking steps you asked for before a possible contract (Art. 6(1)(b) GDPR). We keep your request for 12 months and then delete it; if a contract follows, we keep what it needs for as long as it runs. Ask us and we will delete it sooner.

Your account in the app

To create an account at app.ireadingroom.com you need an email address and a password; without them we cannot give you an account. We store your password only as a secure hash. Everything you add (papers and their PDF copies, notes, tags, feeds, your settings, and what you keep or discard in Floodgate) is stored on our servers and is private to your account.

• The app sends you account emails, such as confirming your address or resetting your password, through Resend.
• During your free trial, the app emails you automatically through Resend: 2 days before the trial ends, when your account is frozen because no plan was bought, and 2 days after that. For this it uses only your email address and the date you signed up, and these emails contain no advertising.
• One cookie, rr_session, keeps you signed in for up to 30 days. The app also keeps your display preferences and copies of papers you open in your browser’s storage, so pages load faster. Those stay on your device.
• We count how features are used, for example whether the Summary page is opened, from our own database. The app has no third-party analytics.
• You can delete your account in Settings. You have 7 days to change your mind, then the account and everything in it is erased. An account whose email address is never confirmed is deleted after 7 days.
• A frozen account that still has no plan 3 months after it was frozen is deleted, like an account you delete yourself. We email you 30 days before.

Paid plans and Paddle

Our paid plans are sold by Paddle.com Market Limited (UK), our reseller and Merchant of Record. Paddle runs the checkout, takes your payment, sends your invoice and handles VAT and refunds. For that it is responsible for your data itself, under Paddle’s privacy notice. We never see your full card number.

From Paddle we receive what we need to run your plan: your name, email address and country, your company name and VAT ID if you give them, and your plan, billing period, status, payment dates and amounts. We link it to your account by your account ID, and use it to give you your plan, answer billing questions and count our subscriptions and revenue. If you start a checkout from the app, we send Paddle your account ID and email address to fill it in. We never send Paddle your project description, library, notes or reading history.

We keep this while your account exists and delete it with your account, except the records tax law requires us to keep. For 13 months after that we keep only a scrambled form of your plan’s Paddle number, so that late messages from Paddle about it are ignored.

If you cancel or withdraw without signing in

Our cancellation and withdrawal pages in the app work without an account. They collect what a cancellation or withdrawal has to contain: its type and, if you give one, your reason; your name (for a withdrawal); which plan it is about; when it should end; and your email address, to which we send the confirmation. We use this to carry out your cancellation or withdrawal and to be able to prove that we received it (legal obligation and legitimate interest, Art. 6(1)(c) and (f) GDPR). Resend sends the confirmation; Paddle receives only our instruction to cancel your plan, not what you entered. We keep this record for 3 years after we receive it and then delete it, also if you delete your account in the meantime.

Your project description and outside AI

In Settings you can describe what you are working on, so that new papers can be ranked for you. To turn that text into a short list of research interests, we send it (and only it, never your library, notes or reading history) to OpenRouter, Inc. in the USA, which passes it to an AI model host.

• We use only hosts that OpenRouter lists as zero data retention: they do not keep your text, and it is not used to train models.
• The host may be in the USA or another country outside the EU. The transfer is covered by the Standard Contractual Clauses in OpenRouter’s data processing terms.
• It is sent only when you save new or changed text. Clearing it stops any further sending.

AI on our own hardware

All other AI in the app runs on a computer we operate ourselves, reached over a private, encrypted connection. No outside AI provider is involved, and nothing is used to train models.

That model reads the name and short description of each of your research interests (never your project description, library or notes) together with the public title and abstract of papers delivered to you, and judges how relevant each paper is to you. The verdict changes that paper’s score for you, and is kept with your account until you delete it.

When the model finds a paper clearly not relevant to you, we may slightly adjust the shared ranking data of that public paper, so that it ranks lower for interests like yours. The change is small and capped, is designed not to lower the paper for anyone it was judged relevant to, and is undone when you delete your account.

The Summary page

The Summary page shows the papers recommended to you on each of the last seven days, each with a short summary, grouped by your research interests. For a paper on arXiv, our server fetches its public page from arxiv.org, sending nothing about you, and the model writes a short summary of it; the page’s text is never stored. A summary contains nothing about you and is shared by everyone who is recommended that paper. It is deleted after 30 days. To group your papers, the model reads only the names of your research interests, never their descriptions. Your daily lists and groups are deleted after 7 days, and with your account. We also record when you first open each day, to see whether the page is used.

Agent access (optional)

In Settings you can create a personal access token for an AI agent you use, such as Claude Code or Cursor. With it, the agent can read the papers recommended to you on a given day: their titles, links, short summaries and scores, and the names of the research interests they matched. It cannot read anything else or change anything. What the agent reads goes to the AI model your agent runs on, under that provider’s terms; you choose them, and we send them nothing ourselves.

We store only a fingerprint (a hash) of each token, and note when it was last used. A token expires after at most a year, and you can delete it at any time. Changing your password, or deleting your account, deletes all your tokens.

Server logs in the app

Our servers keep technical logs for up to 15 days and then delete them automatically. They include your account ID, and for security events (such as sign-ins) your IP address. They never include your password, email address, searches, project description or the papers you read. They are stored only on our own server and used only to keep the service secure and working (legitimate interest, Art. 6(1)(f) GDPR). After you delete your account, its log entries expire on the same 15-day schedule.

The browser extension

The optional iReading Room extension for Chrome lets you add an arXiv paper to your library from the paper’s own page.

• On arxiv.org paper pages it reads only the page’s address, to recognise the paper. It does not read the page’s content or your browsing history.
• When you click Add, it opens your library in a new tab and fills in the app’s Add form there for you, using your own signed-in session. It reads nothing from your library and never touches the sign-in form.
• It keeps the paper’s link in your browser only until the paper is added (10 minutes at most). It sends nothing anywhere itself and has no analytics.

Gemini Notebook (optional, off by default)

If you switch this on in the app’s Settings, then when you move papers from Floodgate to your Library, the extension opens Gemini Notebook in your browser and creates a notebook there with those papers’ links, 20 at most. Your browser sends those links to Google, under your own Google account and Google’s terms. Our servers send nothing to Google, and the extension reports nothing back to us and does not read your notebooks. It needs your permission to use notebook.google.com, and acts only in the tab it opened. The app stores only your on/off choice.

Who else receives data

Each of these companies receives data only for the job listed here:

• Cloudflare, Inc. (USA): delivers and protects the website and the app, receives email sent to support@ireadingroom.com, and runs the contact form’s spam check.
• Hetzner Online GmbH (Germany): hosts the app’s servers and database in the EU.
• Resend, Inc. (USA): sends the app’s account, trial, cancellation and withdrawal emails.
• Paddle.com Market Limited (UK): sells our paid plans as reseller and Merchant of Record, under its own privacy notice.
• OpenRouter, Inc. (USA), and the AI model host it selects: turns project descriptions into research interests.
• Google (Google Ireland Limited, and Google LLC in the USA): Google Analytics if you accept it, and the Gmail mailbox and Google Sheets in which we receive and keep track of messages and sample requests.

Transfers to the UK (Paddle) are covered by the EU’s adequacy decision for the UK. Transfers to the USA are covered by the EU–US Data Privacy Framework (Cloudflare, Resend, Google) or by Standard Contractual Clauses (OpenRouter). Services you connect yourself, such as your AI agent or Gemini Notebook, work under their own terms, as described above. We share your data with anyone else only if the law requires it.

Your rights

You can ask us for a copy of your data, and ask us to correct it, delete it or give it to you in a portable format. You can ask us to restrict how we use it, and object to any use based on our legitimate interest. Where you gave consent, you can withdraw it at any time; that does not affect what happened before. For any of these, email support@ireadingroom.com.

You can also complain to a data protection authority: ours is the Berlin Commissioner for Data Protection and Freedom of Information, or you can contact the one where you live.

If we change how we handle your data, we update this page before the change takes effect and change the date at the top.