Privacy Policy

Last updated: October 7, 2026

This policy explains what Lil Red Wagon (lilredwagon.org) collects, why, who sees it, and what you can do about it. The short version: you can read without an account and we collect very little; with an account we keep what you need for your highlights, notes and place in the text; we do not sell your information. I don’t even know how I would!

1. What we collect

If you only read

  • Our host and Cloudflare (which delivers and protects the site) see your IP address, browser type and the pages you request. This is standard server logging, used for security and troubleshooting.
  • Highlights and notes you make without an account are stored in your own browser only. We never receive them.
  • Your reading preferences (text size, light or dark) are kept in your browser.
  • We do not set cookies on signed-out visitors.

If you create an account

  • Account details: your first and last name, email address and password (stored only as a one-way hash; we cannot read it).
  • Reading data: which chapters you open and when (so we can offer “continue reading”), your highlights, notes, bookmarks, notebooks and replacement sets.
  • Content you add: libraries and books you create or import, and any publish requests you make.
  • The feed app and notifications (if you use them): your topic and library preferences, saved verses, and, if you switch on notifications, the address your browser gives us for delivering them.
  • AI assistant (if switched on): the questions you ask and the answers given.
  • Authors and purchases (if you apply to sell or buy a book): the details of the application and the purchase record. Card details go straight to Stripe; we never see them.
  • Sign-in cookies, so the site knows you are signed in.

If you write to us

We keep your message and email address so we can reply. If you join the plugin waitlist, we keep the email you give there.

2. How we use it

  • To run the site: show your notes and place across your devices, confirm your email, reset passwords, and process publish requests.
  • To keep it safe: limit abuse, filter spam, and investigate problems.
  • To improve it: simple, cookie-free traffic counts from Cloudflare.
  • To email you things you asked for or need: confirmation and password emails, decisions on publish requests, and notifications you turn on. We do not send marketing email without your consent.

If you are in the EU/UK, our legal bases are: performing the service you asked for (account and reading data), our legitimate interest in security and improving the site, and your consent where we ask for it.

3. Who else is involved

We use these services to run the site. Each receives only what it needs.

  • Hosting provider: stores the site and its database.
  • Cloudflare: delivers and protects the site, and provides cookie-free analytics.
  • Google Fonts: serves the fonts the pages use, which means your browser contacts Google to fetch them.
  • SendGrid: delivers the emails we send you.
  • Akismet: screens form submissions for spam, which sends the submission and IP address to Automattic.
  • Cloudflare Turnstile (if enabled): checks that sign-ups come from people.
  • Stripe (if selling is enabled): processes payments.
  • AI providers (if the assistant is switched on): receive your question and the passages used to answer it.
  • Browser push services (Google, Apple, Mozilla, Microsoft), only if you turn on notifications.

When you arrive from an advertisement, the advertising network may place a cookie or use the ad-click identifier in the link to measure whether the ad worked. You can opt out in your browser or through the network’s ad settings.

We do not sell your personal information, and we do not share it for third parties’ advertising. We may disclose information if the law requires it or to protect the site and its users.

4. How long we keep it

Account and reading data stay until you delete your account or ask us to erase it. Server logs are kept by our host and Cloudflare for their usual short periods. Purchase records, if any, are kept as long as accounting and tax rules require.

5. Your choices and rights

  • See or export your data: email [email protected] from your account address and we will send a copy (reading history, highlights and notes, notebooks, AI conversations, libraries and purchases).
  • Erase it: ask us and we will delete your reading data and the private libraries you created. Records of purchases are kept for accounting, and a library you published stays on the site without your name.
  • Correct it: update your name and email from your profile or ask us.
  • Turn off notifications in your browser or the feed app settings at any time.

EU/UK: you may also object to or restrict processing, withdraw consent, and complain to your data-protection authority. California and other US states: you may ask what we collect, request deletion or correction, and we will not discriminate against you for doing so; we do not sell or share personal information as those laws define it. We will respond within the time the law requires, usually 30 to 45 days.

6. Security

The site uses HTTPS, passwords are hashed, private libraries are visible only to their owner, and access is rate-limited. No system is perfectly secure; please use a strong, unique password.

7. Children

The site is not directed to children under 13 and we do not knowingly collect their information. If you believe a child has given us information, write to us and we will delete it.

8. Where your data goes

The site and its providers are based in the United States and elsewhere. If you use the site from outside the US, your information will be processed in the US.

9. Changes

If we change this policy we will update the date above and, for significant changes, tell signed-in readers.

10. Contact

Web Master, [email protected]