Privacy
Privacy policy
StoaReads is a small, free, open source project. We collect what a book club app needs to work, we don't sell it, we don't show ads, and we don't track you around the web.
Last updated November 1, 2026.
This policy covers the StoaReads website at stoareads.com, the Stoa app at stoareads.app, and club sites that StoaReads runs on Stoa under a club's own domain. Stoa is open source, so anyone can run their own copy. A copy someone else runs is theirs, and their own policy applies to it.
What we collect
- Your account: your name and email address. You give us these when you start or join a club, or we get them from Google or GitHub if you sign in that way.
- Your profile, if you fill it in: a photo, a short bio, what you're reading and topics you like.
- What you add to your club: books you nominate and their pitches, votes and rankings, reviews and ratings, posts, replies and reactions, RSVPs, and gathering details such as places, video links, notes and discussion questions.
- Your club's settings: its name, tagline, time zone, colors and invite code.
- Sign-in records: a session cookie that keeps you signed in, and short-lived sign-in links and codes. We store only scrambled (hashed) versions of these, never the codes themselves.
- Abuse protection: to stop people from spamming sign-in emails or new clubs, we count recent requests by IP address. These counts are deleted after a day. When a new club is started we keep a scrambled (hashed) form of the IP address, not the address itself.
We don't use analytics, advertising or tracking cookies, on the website or in the app. The only cookies are the ones that keep you signed in, plus a short-lived one that protects a Google or GitHub sign-in while it's in progress.
Signing in
Stoa has no passwords. You can sign in in any of these ways:
- With your email: we email you a link or a code that works once and expires soon after.
- With a link from your organizer: organizers can copy a one-time sign-in link for a member.
- With Google or GitHub: if your club has them turned on.
Google and GitHub sign-in
If you choose Continue with Google, we ask Google only for your basic profile: your name, your email address and an account ID. If you choose GitHub, we ask for your public profile and your email addresses, and use your name and a verified email address. We use these only to sign you in, to match you to your Stoa account and to show your name to your club.
We store your name, email address and the account ID that Google or GitHub gives us. We don't keep their access tokens after sign-in, and we can't read your Gmail, contacts, calendar, files or repositories. We never sell this information, use it for advertising, or share it with anyone except as this policy describes. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who can see what
- Your club: other members see your name, photo, bio, reading and topics, and everything you post, review or RSVP to.
- Your organizers: they can also see your email address, so they can reach members.
- Nobody else: a club's books, posts, reviews and members are only shown to people signed in to that club.
Votes can be anonymous if the organizer sets them up that way. Then members see the totals, not who voted for what.
Services we use
We rely on a few other services to run Stoa. Each gets only what it needs.
- Cloudflare hosts the website and the app. Club data is stored in Cloudflare D1, a database Cloudflare runs for us. Cloudflare handles every request, so it sees IP addresses and keeps its own short-lived logs.
- Resend delivers our email: sign-in links and codes, email-change confirmations and club updates. Resend receives your email address and the message.
- Google and GitHub, only if you sign in with them.
- Venn, an open source scheduling app run by the same maintainer, finds a date for each gathering. When an organizer asks for dates, Stoa sends Venn the club and gathering names, the time zone, the dates to choose from, the organizer's name and, if set, the place and the book. When you answer a date poll, you give Venn the name and times you enter.
- Open Library supplies book details and covers. We send it the titles you search for, and your browser loads cover images from it.
Book links may go to Amazon. Some clubs add an Amazon Associates tag to those links. If you follow one, Amazon's own privacy policy applies on Amazon.
We send email you need to use Stoa, such as sign-in links. We also send club updates, such as new gatherings and reminders. You can turn updates off from your profile at any time. We never send marketing for anyone else.
How long we keep it
- Your account and what you add to your club stay for as long as you're a member, so your club keeps its history.
- Sessions end after 90 days without a visit, and always a year after you sign in.
- Sign-in links and codes expire within minutes to days, and expired ones are cleared out.
- IP-address counts for abuse protection are deleted after a day.
Leaving and deleting your data
You can leave your club from your profile at any time. Leaving deletes your account: your name, email address, photo, bio and profile, your sessions and sign-in links, and your Google or GitHub link. Your reviews and posts stay in the club's history but no longer show your name or photo; they're shown as from "a former member".
If you'd like those posts and reviews deleted too, a copy of your data, or anything corrected, email us at hello@stoareads.app and we'll do it within 30 days. Organizers can ask us to delete a whole club the same way.
Security
Everything travels over HTTPS. Sign-in tokens are stored hashed, sign-in attempts are rate-limited, and the code is public, so anyone can check how it works. No system is perfectly secure, and if something goes wrong that affects you, we'll tell you.
Children
Stoa is for adults and teens. It isn't meant for children under 13, and we don't knowingly collect their information.
Changes
If we change this policy, we'll update the date at the top. If a change matters, such as a new kind of data or a new service that receives it, we'll tell members in the app or by email before it takes effect.
Contact
StoaReads is run by Seph Mard. Questions or requests: hello@stoareads.app. Our terms explain the rules for using Stoa.