Privacy Policy

Who we are

Danshu Books (丹書) at danshubooks.com is run by an individual operator, who is responsible for the personal data described here. Contact: [email protected].

Reading without an account

You can read everything on the site without an account. We use no analytics, no advertising and no tracking cookies, and we do not build profiles of readers.

Your settings (theme, text size, interface language, how the original and the translation are shown), where you are in each book, and whether you dismissed the install prompt are kept in your browser’s local storage, on your device. Chapters you open, and books you save for offline reading, are kept in your browser’s cache so they can be read without a connection. None of this is sent to us; only once you sign in is your reading progress kept in your account as well (see below). You can clear it at any time in your browser’s settings.

What we keep when you have an account

• Your email address. With Google or Apple, it is the address that service gives us; Apple may give a private relay address instead of your own.
• With Google or Apple, the account identifier that service issues for you. Their sign-in token can carry other profile details, such as your name; we do not keep them.
• If you set a password, a salted hash of it (scrypt). We never store or see the password itself.
• When the account was created and when it last signed in.
• Your reading progress: for each book, the chapter, your place in it and when it was recorded.
• Sign-in sessions: a random token kept in a cookie on your device. We store only a hash of it, with when it was created and when it expires.

Email codes

When you sign in with an email code, create an account or reset a password, we send a six-digit code to your address through our email provider, Resend. We store only a hash of the code; it expires after 15 minutes and is deleted once used.

Security records and server logs

To stop repeated guessing, each request for a code and each sign-in attempt with a password or code is briefly recorded with your IP address and a hashed form of the email address. They count for one hour and are deleted within a day after that.

Like any website, our server and Cloudflare, which delivers the site, process technical data about each request, such as the IP address, the page requested, the browser’s user agent and the time, in order to deliver the site and protect it from abuse. Server logs are kept for a limited period and used only for security and fixing faults.

Cookies

We set one cookie, and only when you sign in: __Host-danshu_session, which keeps you signed in. It is strictly necessary for the account and is used for nothing else. It lasts 60 days from the last time you use the site and is removed when you sign out.

On the sign-in page, Google’s and Apple’s sign-in buttons are loaded from their servers and may set cookies of their own under their own policies.

How we use your data

Only to run your account and your membership: to sign you in, keep your reading progress the same across your devices, send sign-in codes, open paid chapters to members and handle refunds, keep the service secure, and reply when you write to us. We do not sell or rent personal data, show advertising, or use your data to train AI models.

If you are in the European Economic Area or the United Kingdom: we process account and membership data because it is needed to provide what you asked for (contract), keep payment records because accounting and tax law require it (legal obligation), and process security records and logs for our legitimate interest in keeping the site safe.

Services that process data for us

• Amazon Web Services (Lightsail, Tokyo, Japan) hosts the site, the account database and our billing service.
• Cloudflare delivers and protects the site; every request passes through its network.
• Resend sends the emails that carry sign-in codes.
• Creem, our merchant of record, takes payments by card, Apple Pay and Google Pay.
• DeepSeek (China), and OpenAI through OpenRouter (United States), read WeChat Pay screenshots to check the payment.
• Google Fonts serves the site’s Chinese typefaces; Google receives your IP address and browser details when a page loads them.
• Google and Apple, only if you choose to sign in with them.

These providers handle data under their own privacy terms. We share personal data with no one else, except where the law requires it.

Where your data is kept

The account database and our billing service are on servers in Tokyo, Japan. Our providers may process data in other countries, including the United States and, for WeChat Pay screenshots, China, so your data may be handled outside the country where you live.

How long we keep it

• Account data and reading progress: until you delete the account.
• Your membership, your agreement to immediate access, and the record of paid chapters sent to you: until you delete the account.
• Orders in our billing service and at Creem, including WeChat Pay screenshots and what was read from them, and records of USDT transfers received: as long as accounting and tax law require, also after you delete your account.
• Sessions: until you sign out, or 60 days after their last use; expired ones are deleted within a day. Setting a new password ends every other session.
• Email codes: each works for 15 minutes and is deleted once used; an unused code’s record (the email address and the code’s hash) is deleted within a day of expiring.
• Security records: one hour, then deleted within a day.
• Daily backups of the database: 14 days. After you delete your account, its data is gone from the backups within 14 days.

Deleting your account, and your other rights

You can delete your account at any time on the Account page. A Creem subscription that would renew is cancelled first. Deleting then removes at once your account, its linked Google or Apple identities, its sessions, any unused email codes, the reading progress kept in it, and its membership records. Payment records that the law requires us to keep, listed above, remain. Progress stored in your browser stays until you clear it.

You can also ask us for a copy of your data, or to correct or delete it, by writing to [email protected] from the address on the account. Depending on where you live (for example under the EU or UK General Data Protection Regulation, California law, or China’s Personal Information Protection Law), you may have further rights, including to object to processing and to complain to a data-protection authority. We will reply within one month.

Children

The site is not directed at children under 13, and we do not knowingly keep accounts for them. If you believe a child has given us personal data, write to us and we will delete it.

Security

The site is served only over HTTPS. Passwords are stored as salted hashes, and session tokens and email codes as hashes only; the account service accepts changes only from the site itself. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

Membership and payments

Membership is not on sale yet. Once it is, you can pay in three ways:

• By card, Apple Pay or Google Pay, through Creem, our merchant of record. You give your card and billing details to Creem, under Creem’s own privacy policy; we never see your card number. We give Creem your email address and account identifier, and Creem tells us the plan, its period, and whether it has renewed, been cancelled or been refunded.
• With WeChat Pay. You pay to our WeChat account and upload a screenshot of the payment to our billing service, which also receives your account identifier and email address. An AI model reads the screenshot to check the amount, the payee and the time: DeepSeek first, then OpenAI’s model through OpenRouter if needed. If the result is unclear, the operator looks at the screenshot.
• With USDT on the TRC20 network. Blockchain transfers are public. For each transfer to our address we record its transaction ID, amount, sending address and time, to match it to your order.

For your account we keep the membership you bought, how you paid, its period and status, and the order numbers. When you buy, we record that you ticked the box agreeing to immediate access, with the plan and the date of the Refund Policy you agreed to. When a paid chapter is first sent to your account, we record which chapter and when; that is how we check a refund request under our Refund Policy.

Changes and language

Any change to this policy will be posted here with a new date, and significant changes will also be announced on the site. This policy is written in English; the Chinese versions are translations, and if they differ, the English version prevails.

Contact

Questions or requests about your data: [email protected].