Privacy Policy

We collect information you provide directly, information generated by your use of the Platform, and limited technical information necessary to operate and secure the service.

• ▪Operating and delivering the Platform — displaying your library, enabling sharing with invited viewers, and powering the core features of the service.
• ▪AI-powered book recommendations — your library content and personal notes are sent to Anthropic's API to generate personalized recommendations. See Section 9 for details. You may opt out of this feature in Account Settings at any time.
• ▪Processing payments — charging subscription fees, issuing billing receipts, and handling refund requests through Stripe.
• ▪Transactional communications — account confirmation emails, password reset links, and billing receipts. These are required for the service and cannot be opted out of while your account is active.
• ▪Optional product updates — we may send occasional emails about new features. You may unsubscribe from these at any time.
• ▪Security and fraud prevention — detecting abuse, unauthorized access attempts, and terms-of-service violations.
• ▪Legal compliance — retaining records as required by applicable law, including tax and financial regulations.

We do not use your data for advertising, behavioral profiling, or any purpose not listed above.

We share personal information only with the following categories of recipients, and only to the extent necessary to operate the Platform:

We do not sell, rent, license, or otherwise trade your personal information to any third party.

Regardless of where you live, we honor the following rights for all Lexagy users:

• ▪Access — request a complete copy of the personal data we hold about you. We will provide it within 30 days in a machine-readable format.
• ▪Correction — update or correct any inaccurate information in your account at any time through Account Settings.
• ▪Deletion — request permanent deletion of your account and all associated personal data. Most data is deleted within 30 days; see Section 6 for exceptions.
• ▪Portability — export your full library (book data and personal notes) in JSON or CSV format at any time from Account Settings.
• ▪Opt out of AI processing — disable AI recommendations at any time from Account Settings. When disabled, no library data will be sent to Anthropic.
• ▪Opt out of marketing emails — click the unsubscribe link in any marketing email or contact us at privacy@lexagy.com.

To exercise any of these rights, email us at privacy@lexagy.com or use the tools in Account Settings. We will respond within 30 days. We may ask you to verify your identity before processing certain requests.

• ▪Active accounts — your personal data is retained for as long as your account is active.
• ▪Deleted accounts — upon account deletion we remove your profile, library content, and notes within 30 days. Aggregated, anonymized analytics derived from your usage may be retained indefinitely.
• ▪Financial records — billing history and transaction records are retained for 7 years to comply with federal and Massachusetts tax law, even after account deletion.
• ▪Support communications — retained for 3 years from the date of the last message in the thread.

Lexagy uses a small number of cookies strictly necessary to operate the Platform. We do not use advertising cookies, third-party tracking pixels, or any cross-site behavioral tracking.

You may disable cookies in your browser settings, but doing so will prevent you from logging in to the Platform. We do not honor Do Not Track (DNT) headers because we do not engage in the tracking those signals are designed to prevent.

Lexagy is not directed to children under the age of 13. We do not knowingly collect personal information from any person under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@lexagy.com. Upon verification, we will delete the information within 14 days.

This policy is consistent with the Children's Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected personal information from a child under 13, we will take prompt steps to delete it.

Massachusetts residents have specific rights under Chapter 93H of the Massachusetts General Laws and related data protection regulations. In addition to the rights described in Section 4, Massachusetts residents have:

• ▪The right to know what categories of personal data we collect and the purposes for which we use it — this Privacy Policy constitutes that disclosure.
• ▪The right to know whether we sell personal data to third parties — we do not sell personal data.
• ▪The right to delete personal data we have collected about you, subject to certain legal retention requirements.
• ▪The right to correct inaccurate personal data.
• ▪The right to opt out of the sale or sharing of personal data for cross-context behavioral advertising — we do not engage in such activities.

To exercise these rights, contact us at privacy@lexagy.com with the subject line “Massachusetts Privacy Request.” We will respond within 45 days. We will not discriminate against you for exercising these rights.

Lexagy's recommendation feature uses Claude, an AI model developed by Anthropic, PBC. When you request recommendations, we send your library content (book titles, authors, genres, and your personal notes) to Anthropic's API. We do not send your name, email address, or payment information to Anthropic.

Under our agreement with Anthropic, they are prohibited from using your content to train their AI models and may only use it to respond to the specific API request we make on your behalf.

You may disable AI recommendations at any time in Account Settings → AI Features. When disabled, no data is sent to Anthropic.

We implement reasonable technical and organizational measures to protect your personal information:

• ▪All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• ▪Your library data and account information are stored in encrypted databases managed by Supabase.
• ▪Passwords are hashed using bcrypt with a work factor of 12 and are never stored in plain text.
• ▪Access to production databases is restricted to authorized personnel and requires multi-factor authentication.
• ▪We conduct periodic security reviews of our infrastructure and codebase.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. For non-material changes (such as corrections or clarifications), we will update the effective date and post the revised policy. For material changes — such as new categories of data collection, new sharing arrangements, or changes to your rights — we will notify registered users by email at least 30 days before the changes take effect.

Your continued use of Lexagy after the effective date of any change constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated policy, you may delete your account before the effective date.

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us: