Your information — privacy notice.

Who controls your information

Wayne Malyon trading as Built From One, 20 Shearers Drive, Spalding, PE11 3ZJ, United Kingdom, controls BF1 Reads account and reading information. Contact hello@builtfromone.com for privacy questions and rights requests.

Accounts and paid memberships are for UK and US residents aged 18 or over. Contact us if eligibility checks incorrectly restrict your account.

Information and purposes

We use your email, any name you supply, securely hashed password, verification and session records to operate and secure your account. Saved books, reading position and completed milestones let you continue reading. We use contract performance as the basis for the account and membership functions you request.

We record separate residence/adult declarations, Stripe customer and payment references, subscription state, accepted Terms and early-supply statements. Stripe handles card and billing details; BF1 Reads does not store full card numbers or security codes or copy your billing address. We retain the country-check result and its subscription binding, and US state in the separate sales ledger for US purchases.

Support correspondence, cancellations, payment disputes and purchase evidence let us respond to requests, comply with applicable obligations and establish or defend claims. The applicable basis is contract, legal obligation or legitimate interests depending on the purpose.

Security logs, rate limits and first-party account-linked book measurements support fraud prevention, reliable operation and understanding use of the collection. We rely on legitimate interests and balance them against your rights. You can object to measurement or other processing on that basis by contacting hello@builtfromone.com.

We do not sell reader information, build advertising profiles or charge individually targeted prices. Checkout and early-supply statements are not consent to unrelated personal-data uses. Any future separate consent-based purpose would require an optional choice and a way to withdraw it.

Book discovery and optional release emails

Your signed-in homepage uses your saved reading place and saved books to help you continue and suggest published novels with shared editorial moods or genres. Recommendations also offer other novels by the author and a different choice. Completed books are excluded where possible. The book finder uses the choices you submit and existing book labels; it does not use an external AI service.

Saving an upcoming book does not request email. On an upcoming book page, a verified account can separately request one release email. We rely on that optional consent and record the account, book, email address, choice date and send status. We recheck consent, email verification and publication before sending. Namecheap Private Email delivers the message using our existing gradual sending queue, so it may arrive after release time.

Cancel a pending release email on the book page or use its email unsubscribe link, which stops that book alert. This choice is separate from the Saturday Reading Club newsletter. Alert records stay with the account to prevent duplicate sending and record the choice, and are removed on account deletion or book deletion. Unsubscribe tokens are stored as hashes. Contact support@builtfromone.com for help or earlier erasure.

When you choose membership from a chapter, this browser tab can temporarily remember that chapter link through joining and checkout. It is stored in session storage for the tab, contains a book/chapter path rather than novel text, and grants no reading access.

Saturday Reading Club emails

The Saturday Reading Club is an optional email newsletter about BF1 Reads novel releases. It is separate from a reading account or paid membership. We use your email address and record the wording and revision of your signup choice, request and confirmation dates, and subscription status. We rely on your consent to send these newsletters; joining or buying a book does not sign you up.

We send an address-confirmation message when you request to join. The confirmation link expires after 24 hours. You only join the active newsletter list after confirming. After confirmation, you may receive one automatic copy of our latest sent newsletter before the next release email. We check your current subscription status before sending it, and repeated confirmation does not create duplicate copies. Confirmation and unsubscribe tokens are stored as hashes. Railway stores the subscriber list and Namecheap Private Email sends the confirmation message.

We record which newsletter was queued for your address, the consent checked, send attempts and delivery status. These limited records help us prevent duplicate sending, honour unsubscribe requests and investigate delivery issues while we operate the list. They show acceptance by our mail provider, not that you opened or read an email. We do not add newsletter tracking pixels. Newsletter reading links contain a shared campaign code, identical for every recipient, to count anonymous visits as described under Anonymous visitor statistics. Test emails do not include this code. Namecheap Private Email delivers the newsletters as well as confirmation messages.

Withdraw consent at any time using the unsubscribe link or by contacting support@builtfromone.com. Unsubscribing stops newsletter eligibility immediately, without changing your reading account or purchases. We retain a minimal subscriber and suppression record to honour your choice and document the latest consent; we rely on legitimate interests for this limited record while we operate the list and review justified erasure requests. A fresh signup needs a fresh confirmation to resume emails.

Unconfirmed new signups older than seven days are removed in bounded cleanup when another signup is processed or an administrator opens the subscriber list, rather than at an exact scheduled time. For abuse prevention, signup limits use a keyed hash of the supplied network address, not a plain IP address; expired rate-limit records are removed on subsequent accepted signup attempts. Authorised administrators can view and export subscribers to administer the list. We do not sell the list. Contact hello@builtfromone.com to exercise your information rights.

Providers and international processing

Railway hosts the application, PostgreSQL database and infrastructure logs. The currently configured hosting is in the United States. Namecheap Private Email delivers account messages and holds support correspondence. Stripe supplies Checkout, subscription management and payment processing and has its own privacy information.

Authorised administrators and providers access information only for their operational functions. Provider processing may take place outside the UK. Applicable international transfers require an adequacy arrangement or appropriate contractual safeguards, including a UK Addendum where applicable, and the relevant assessment.

Railway publishes a Data Processing Addendum with a UK Addendum; Namecheap publishes a Data Processing Addendum; Stripe publishes its Data Processing Agreement and Data Transfers Addendum. Contact hello@builtfromone.com for information about the safeguards applicable to your data and a copy where available.

Cookies and device preferences

Essential session cookies keep you signed in, normally for up to seven days subject to renewal or revocation. Security and authentication features use necessary storage. We do not use advertising cookies or cross-site marketing trackers.

If you choose Remember settings on this device, reading appearance preferences are stored locally without a fixed expiry. You can switch remembering off or clear them in Reading settings. Your account bookmark is stored separately. Stripe-hosted pages have their own storage notices.

Retention and deletion

Account and saved reading information are normally retained while the account exists. Password-reset and verification links normally expire after one hour. Book-view and catalogue events older than 90 days are removed on the next matching measurement rather than by a guaranteed nightly purge.

Account deletion removes active credentials, email, saved library, progress and account-linked analytics. Minimal frozen purchase disclosures, separate choices, confirmation/cancellation evidence and limited issuance/refund references may be retained in a restricted record for six years after deletion to support claims. This is a targeted policy, not a blanket legal minimum; justified earlier-erasure requests are considered individually.

The retained record excludes passwords, session tokens, email, IP address, billing address and full novel text. It does not restore an account or mail queue. Expired records are immediately unavailable and removed in bounded worker sweeps. Backup copies expire under the provider schedule; deletion and cancellation actions after a backup are reconciled before a restored service reopens.

Stripe maintains its own payment records. Support or dispute information may be kept as needed for the specific request, obligation or claim. We restrict access and review retention when that need ends.

Your rights and questions

Subject to applicable conditions, you can request access, correction, erasure, restriction or portability, and object to legitimate-interest processing. Contact hello@builtfromone.com. We may verify identity proportionately and normally respond within one month, subject to lawful extensions.

Automated checks of verification, payment, eligibility and purchase evidence decide whether paid chapters can be supplied. Ask support@builtfromone.com for review if access is incorrect. We do not treat a server issuance timestamp as proof that you read a chapter.

You may complain to the UK Information Commissioner at https://ico.org.uk/make-a-complaint/. Contacting us first is optional. A notice revision is saved at signup and the exact notice is frozen with purchases; this shows what was made available, not proof of reading or blanket consent. We explain material new processing before it starts.

Anonymous visitor statistics and your choice

We use first-party aggregate visitor statistics to improve BF1 Reads: visits, page views and the number of browser sessions active on each page within the last five minutes. These statistics are separate from account-linked reading progress. They are not used for advertising, profiling, personalised pricing or decisions about individual visitors.

A random identifier and sequence number are stored in browser session storage for the current tab. We do not link this identifier to your account, name, email, IP address, payment details or other websites. Search text, URL fragments, verification tokens and arbitrary URL parameters are not sent to the traffic statistics endpoint. The sole URL-parameter exception is a recognised shared newsletter campaign code: we send this code when a visitor opens a newsletter reading link, to count visits from that campaign. It contains no recipient identifier and is not linked to a subscriber, account, reading progress or purchase. Our infrastructure security logs remain separate.

Temporary server records contain only the random tab identifier, current page, activity time and daily deduplication information, including recognised newsletter campaign codes. Each campaign counts at most one visit per tab per UK day; test and draft campaigns are excluded. After the UK calendar day ends, they are removed when the next traffic measurement or visitor dashboard request is handled. We keep only aggregate daily page, visit and newsletter-campaign visit counts for up to 90 days, with older totals removed on subsequent measurement or dashboard requests. These counts cannot identify unique people.

You can object at any time, free of charge, by opening Privacy choices in the website footer and switching off anonymous visitor statistics. This stops measurement and removes current page activity when the request reaches us. Only a temporary identifier-based objection marker remains until daily cleanup, to reject already-in-flight measurement requests. Your preference is saved in local storage until you change it or clear browser storage. Existing anonymous aggregate totals remain. Blocking analytics does not affect reading or purchases. We also honour supported Do Not Track and Global Privacy Control signals.

Railway hosts this first-party statistics service with the application and database in the United States. We do not send the statistics to an advertising analytics provider or sell them. We use the statistical-purpose storage exception for this limited aggregate service and legitimate interests where the short-lived processing involves personal data. Contact hello@builtfromone.com with questions or requests.

US purchases and privacy requests

For US purchases we retain declared residence, verified billing country and US state, product type, transaction amount and currency for fulfilment, support and sales-tax review. We do not copy the street address or ZIP code into this ledger. Sales evidence is retained for six years; test records are segregated from live sales.

US readers can contact hello@builtfromone.com to request access, correction or deletion, or object to processing. We assess requests under the laws applicable to the person and our business. We do not sell or share reader data for targeted advertising. This notice does not limit mandatory state privacy rights.

The service is intended for adults aged 18 or over. If we learn an account belongs to a child, contact support so we can investigate and take appropriate action. Membership and purchases do not subscribe you to the optional Saturday Reading Club newsletter.

Ebook purchase records

For a separate EPUB purchase, we record your account reference, purchased edition, price, payment references, exact purchase terms, checkout choices, eligibility confirmation, billing country and any review, confirmation status and first download time. We use these to fulfil the purchase and handle support under the contract, and retain required financial records under legal obligations.

Account deletion removes login and download access and the email delivery queue. Restricted order and refund evidence remains until at least five years after the 31 January filing deadline for the relevant tax year. An unresolved dispute or required hold can extend retention. Expired records are removed by the mail worker when running. These records cannot restore account access or send marketing. Other provider, privacy-rights and contact information in this notice applies.