Privacy Policy

In short: the JK RapidReader extension has no account, no tracking and no analytics. It sends us nothing. Your library, settings and keys stay on your computer. This website counts visits on its own server without cookies, uses Google Analytics only if you allow it, and keeps your email address if you sign up for our emails. We do not sell your information, and we do not share it for advertising.

Who we are

JK RapidReader and rapidreader.io are run by John Kirker Inc., 92 Corporate Park, Suite C, Irvine, CA 92606, USA (“we”, “us”). We decide how the information described here is used, so under European and UK data protection law we are the “controller”. For anything about privacy, write to support@rapidreader.io.

This policy has two parts: Part 1 covers the JK RapidReader browser extension, in both its versions (for Chrome and the browsers built on it, and for Firefox and the browsers built on it), and Part 2 covers this website and our emails.

Part 1: The JK RapidReader extension

What we collect

Nothing. The extension sends no information to us: no usage statistics, no crash reports, no identifiers, no advertising data. There is no account. We cannot see what you read. This is the same in Chrome and in Firefox.

What stays on your computer

• Your library: articles, books, notes, bookmarks, chats, summaries and reading statistics. They are saved as files in a folder you choose, or, if you choose none, in your browser’s own storage for the extension. In Firefox, and other browsers that cannot open a folder, the same files are kept in the browser’s own private storage for the extension, on your computer; they are not sent anywhere. If you use Download Library, a copy is saved as a file where your browser saves downloads.
• Your settings, in your browser’s storage for the extension.
• Your API keys for AI services and your Readwise token, if you add them. They are kept in this browser on this computer, encrypted. They are never sent to us, and they are left out of backups. From version 2.8, they are never written to your library folder. Earlier versions also kept an encrypted copy in the folder; version 2.8 moves it into the browser and removes it from the folder.

If your library folder is in a cloud-synced location (for example Dropbox or Google Drive), that service’s privacy policy applies to the copy it stores.

When text leaves your computer

Only when you use one of these optional features, and only to the service involved. None of it passes through us.

• AI features: chat, summaries, quizzes, flashcards, key takeaways, document cleanup, finding feeds by topic, and describing or generating images. What you choose to send goes directly from your browser to the AI provider you picked (Anthropic, OpenAI, Google or xAI), with your own API key, under that provider’s terms and privacy policy. With Ollama, the AI runs on your own computer and nothing leaves it.
• AI voices (optional, experimental): the text being read aloud is sent to OpenAI. The built-in browser voices work on your computer.
• Readwise export (optional): when you choose to export, the selected passages, your notes, and the article’s title and web address are sent to Readwise with your Readwise token.
• Web pages and RSS feeds: when you import a page, open a link or refresh a feed, your browser fetches it from that website, as it would if you visited it.

Permissions

The extension uses the right-click menu (for “Read it Fast” and “Add to Library”), access to the tab you are using when you choose one of those (to read the text you selected), and storage for your settings and, if you choose no folder, your library. Permission to fetch web pages, and to show notifications, is optional: your browser (Chrome or Firefox) asks the first time a feature needs it, and you can say no. It is used only to fetch the pages and feeds you ask for.

In Firefox Add-ons, the extension declares to Mozilla that it collects no data (“none”).

The use of information by JK RapidReader complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Part 2: This website (rapidreader.io) and our emails

Below, each kind of information has what we collect, why, our legal reason under European and UK law (the “legal basis”), and how long we keep it. The services that handle it for us are listed under “Who handles your information”.

Delivering the site and keeping it secure

What: your IP address, the page you ask for, your browser’s user agent (its name and version), and the time. Why: to send you the page and to protect the site from attacks and abuse. Every request passes through Cloudflare, which protects and speeds up this site, and reaches our server, which keeps standard access logs. Legal basis: our legitimate interest in running a working, secure website. Kept: our server’s access logs for about 30 days; Cloudflare keeps its own records under its policy.

Visit statistics on our own server

What: the pages you view, the site that sent you here, your browser and device type (from the user agent), how fast pages load, your browser’s time zone, and a country worked out from that time zone. Your IP address is shortened before anything is stored (the last part is replaced with a zero), so it points to a block of addresses, not to you. Why: to see which pages are read and fix the ones that are slow or unclear. The tool (Must-Have Analytics) runs on our own server. It sets no cookie, does not build a profile of you, does not follow you to other websites, and is not shared with anyone. Our own visits are left out. Legal basis: our legitimate interest in understanding how the site is used. Kept: 24 months, then deleted automatically.

Cloudflare Web Analytics, part of Cloudflare’s service, also counts page views and measures how fast pages load. Cloudflare adds its small script to our pages. It sets no cookie and does not follow you across sites. Legal basis: our legitimate interest in a fast, working site.

Google Analytics, cookies and your choice

The first time you visit, a bar at the bottom of the page asks whether to allow analytics. Google Analytics is the only optional extra on this website, and nothing from Google loads unless you choose “Allow analytics”.

• If you allow it, Google Analytics sets two cookies (_ga and _ga_380B8SKK79) and sends Google the pages you view, the site that referred you, your browser and device, your approximate location, and how long you stay. We use it to understand how visitors find and use the site. Its advertising features are off: Google is told that ad storage, ad user data and ad personalisation are all denied. Google says Google Analytics 4 does not store IP addresses. Google keeps the detailed data for no more than 14 months.
• If you choose “Only what is needed”, nothing is loaded from Google and no analytics cookie is set.
• If your browser sends Global Privacy Control, we treat it as “no” without asking.

Legal basis: your consent. You can change your answer at any time with Cookie choices, which is also at the foot of every page. Taking a “yes” back stops Google Analytics and removes its cookies. Your answer is remembered in your browser, not sent to us.

This website’s fonts are served from our own server, so no request goes to Google for them.

Cookies and other things stored in your browser

On an ordinary visit, without your yes to analytics, this website sets no cookie at all. Here is everything it can store:

• rr_consent (local storage, this site): remembers your analytics choice and when you made it. Set when you choose, or on your first visit if your browser sends Global Privacy Control. After 13 months we ask you again; otherwise kept until you clear your browser’s data for this site.
• rr_subscribed (local storage, this site): stops the email course offer appearing once you have signed up. Set after you sign up, or when you open Manage Subscriptions. Kept until you clear your browser’s data for this site.
• brx_popup_184_lastShown (local storage, this site’s page builder): records when the course offer last appeared, so it shows at most once every 14 days. Set when the offer appears. Kept until you clear your browser’s data for this site.
• wpEmojiSettingsSupports (session storage, WordPress): notes whether your browser can draw emoji. Set on every visit. Gone when you close the tab.
• subscriberauth and subscriberemailauth (cookies, our mailing list): keep you signed in to your subscription settings. Set only when you open Manage Subscriptions from one of our emails; subscriberemailauth holds your email address. Both are sent only over secure connections and cannot be read by scripts on the page. Kept 30 days.
• _ga and _ga_380B8SKK79 (cookies, Google Analytics): tell one visit from another, for visit statistics. Set only after you choose “Allow analytics”, and removed if you take that back. Kept up to 2 years.
• WordPress login cookies (cookies, WordPress): keep site administrators signed in. Never set for visitors. Kept for the browser session, or 14 days with “Remember me”.

None of these is used for advertising or to follow you to other websites. The things marked “this site” are strictly necessary or remember a choice you made, so they do not need your consent.

Our emails: the free course, Read Further tips and news

What you get: if you sign up, you receive the free five-day course “Read Faster in 5 Days” (one email a day), then the Read Further tips: two short emails a week, each showing one feature of JK RapidReader. You may also get occasional news, such as a new release. You can stop any of it at any time.

What we collect: your email address, your name if you give it, the lists you joined, the date and time you signed up, the IP address you signed up from, the page you signed up on, your device type, and a country. The country comes from Cloudflare, which already handles every visit to this site; your IP address is not sent anywhere else to find it.

Why: to send you what you asked for, and to keep a record that you asked for it. Legal basis: your consent, given when you sign up. You can withdraw it at any time by unsubscribing.

Read Further invitation: if you were already on our newsletter, we may have sent you one email inviting you to the Read Further tips. Its button link carries a code that identifies your subscription, not your email address. Opening the link changes nothing; only pressing the button on the page adds the tips.

Tracking in our emails, and how to avoid it

Our emails contain a small invisible image. When your email app loads it, we record that the email was opened, the time, your IP address, and your browser or email app’s details (user agent, browser and device type). Links in our emails go through our website first, so we record which links you click, with your device type. We use this to see which emails are useful.

To avoid it, turn off automatic image loading in your email app (opens are then not recorded), and type the web address yourself instead of clicking (clicks are then not recorded). Some email apps, such as Apple Mail with Mail Privacy Protection and Gmail, load images through their own servers, which hides your IP address from us; Apple Mail may also load them before you open the email, so our record can be wrong. Or unsubscribe.

Legal basis: our legitimate interest in sending emails people find useful.

Unsubscribing

Every email has an unsubscribe link, and a link to unsubscribe from everything. You can also change or cancel your subscription on the Manage Subscriptions page, or write to support@rapidreader.io. Unsubscribing from the course list also stops the tips that follow it.

Messages you send us

If you write to us through the Reach Out page or by email, we receive your name (if you give it), your email address and your message. We use them only to reply to you and to follow up on what you asked. The form keeps no copy of its own on the website: it is sent to us as an email. (The spam check below keeps its own record for 90 days.) Legal basis: our legitimate interest in answering you (or, if you ask about something you use, taking steps you asked for). Kept: in our mailbox for as long as we need it to help you.

Spam protection

The Reach Out form and the email sign-up forms are checked for spam before they reach us, by SpamBorg, an anti-spam service made by John Kirker Inc. What: what you submit, your IP address, your browser’s user agent and the page you sent it from. To decide, the text of your message and the address you gave are sent to SpamBorg’s hosted AI service, which answers with a score. To show roughly where messages come from, the network part of your IP address (the last part removed) is sent to a location service. If a message is judged to be spam, its IP address and the domain of its email address (never the message itself) may be shared with SpamBorg’s network of sites that pool information about spam sources. Why: to keep spam and abuse out. Legal basis: our legitimate interest in protecting the site and our inbox. Kept: the record of each check, in our own database, for 90 days; a record we correct by hand (for example, a message wrongly marked as spam) for up to a year; shared spam records, 180 days.

Who handles your information

We use these services. They act on our instructions, for the purposes above:

• Cloudflare, Inc. (USA): carries every request to the site, protects it, and runs Cloudflare Web Analytics.
• Hetzner Online: the server this site runs on, in the USA. Our mailing list, visit statistics, spam checks and the messages sent to our support address all live on this server.
• Amazon Web Services, Inc. (USA): Amazon Simple Email Service delivers our emails and tells us when one bounces or is marked as spam.
• Google LLC (USA): Google Analytics, only if you allow it.
• SpamBorg (John Kirker Inc., USA) and the AI and location services it uses: spam checks on forms.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising (targeted ads).

International transfers

We are in the United States, and so are our server and the services above. If you are in the European Economic Area, the UK or Switzerland, your information is transferred to the United States. Where the service is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), we rely on that certification; otherwise we rely on the European Commission’s Standard Contractual Clauses (with the UK addendum) in that service’s data processing terms.

How long we keep information

• Server access logs: about 30 days.
• Visit statistics (on our server): 24 months, then deleted automatically.
• Google Analytics (only with your yes): no more than 14 months, at Google.
• Your subscription (email address, name, lists, sign-up record): while you are subscribed. When you leave every list, we keep your record for 24 months, then delete it automatically. After that we keep only your email address on a do-not-mail list, so we do not email you again. Ask us and we will delete your record sooner.
• Email opens and clicks: 24 months, then deleted automatically (sooner if your subscription record is deleted).
• Spam checks: 90 days (corrected records up to a year; shared spam records 180 days).
• Messages you send us: up to 3 years, so we can follow up and see earlier conversations.
• What is stored in your browser: see the table above.

Your rights

Wherever you live, you can ask us to:

• tell you what information we hold about you, and give you a copy (access);
• correct it (correction);
• delete it (deletion);
• give it to you in a common, machine-readable format, to take elsewhere (portability);
• stop using it, or use it only in limited ways, where we rely on legitimate interests (objection and restriction);
• withdraw your consent, for emails or Google Analytics, at any time. This does not affect what we did before you withdrew it.

In practice, what we hold about you is your subscription details, email open and click records, and messages you have sent us. To ask, write to support@rapidreader.io. We will answer within one month (within 45 days for California requests). We may need to check that the request comes from you, usually by replying from the email address involved. We will not treat you differently for using your rights.

In the EEA, the UK or Switzerland, you can also complain to your local data protection authority (in the UK, the Information Commissioner’s Office). We would like the chance to help first.

In California and other US states with privacy laws, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share it, and we do not use sensitive personal information. You may use an authorised agent to make a request. Our browser treatment of Global Privacy Control is described above.

Children

The extension collects no information from anyone. This website and our emails are not directed at children under 16, and we do not knowingly collect information from children under 13 (or under 16 in the EEA and UK). If you believe a child has signed up for our emails, write to us and we will delete it.

Security

The site is served only over HTTPS, access to our server and accounts is limited to us, and we collect as little as we can. No system is perfectly secure; if a breach affecting your information happens, we will tell you and the authorities where the law requires.

Changes to this policy

If this policy changes, the new version will be posted here with a new effective date. If a change matters (for example, a new use of your information, or an optional online feature in the extension), we will say so on this page before it takes effect, and email subscribers if it affects them. Any such extension feature will be off unless you turn it on.

Contact

Questions or requests about privacy: support@rapidreader.io, or the Reach Out page. By post: John Kirker Inc., 92 Corporate Park, Suite C, Irvine, CA 92606, USA.