Privacy Policy

Last updated: July 26, 2026

Marcus is built offline-first and privacy-first: your reading lives on your device, AI and sync are optional, and we never sell your data or show ads. This policy explains what we collect, why, and the choices you have. The data controller is Vuvee (“we”, “us”), reachable at marcus@vuvee.me.

1. What we collect

Account data. When you create an account: your email address and authentication identifiers, managed by our auth provider Supabase.
Reading data. Books you import, reading progress, stats, streaks and word lookups are stored locally on your device. Without an account, none of it leaves your device. If you sign in, sync runs automatically: your progress and library details are stored on our servers, and the book file itself is uploaded to our cloud storage so your other devices can download it.
Read-aloud. Speech uses the voices built into your device. Book text is not sent to us or to anyone else to generate audio.
AI requests. When you ask for a word explanation, summary or recap, the relevant text is sent to our server and forwarded to our AI provider, Anthropic, to generate the answer. Under Anthropic’s API terms, this data is not used to train their models. AI keys never live in the app itself.
Purchases. Payments are processed by Apple or Google. Our subscription provider RevenueCat tells us your subscription status via anonymous purchase identifiers. We never receive your card number or billing address.
Launch updates. If you join the launch list on this website, we store the email you submit with our email provider, Resend, to contact you about Marcus.
Diagnostics. Basic server logs (timestamps, request status, IP addresses) kept briefly for security and debugging. No advertising or cross-app tracking SDKs.

2. Why we use it

To provide Marcus — accounts, sync, AI features, subscriptions (performance of our contract with you).
To keep the service safe and working — debugging, abuse prevention (legitimate interest).
To email you about launch updates — only with your consent; every email has an unsubscribe link, and you can opt out any time.

We do not sell personal data, and we do not use it for third-party advertising.

3. Who we share it with

Only service providers (processors) that make Marcus work:

Supabase — authentication (accounts and sign-in only)
Railway — server hosting and the database holding your synced reading data
Cloudflare R2 — storage for the book files you sync
Anthropic — AI text generation for explanations, summaries and recaps
RevenueCat, Apple, Google — subscriptions and billing
Resend — the early-access email list and transactional email
Vercel — hosting for this website

Each provider processes data only on our instructions. We may also disclose data if the law requires it, or as part of a business transfer (we would notify you).

4. International transfers

Some providers process data in the United States and other countries. Where required, these transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

5. How long we keep it

Account and synced data — until you delete your account.
Synced book files — kept only so your other devices can fetch them. Delete a book in Marcus and its file is deleted from our storage; delete your account and every file we hold for you is removed. We do not keep a library of your books beyond that.
Local reading data — stays on your device and is removed when you delete the app or the book.
AI request content — processed to generate the answer, not kept as a training corpus.
Launch-update emails — until launch communications end or you unsubscribe.
Server logs — a short rolling window, typically no more than 30 days.

6. Your rights

Depending on where you live (including under the GDPR), you have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent at any time. Email marcus@vuvee.me and we will respond within 30 days. You also have the right to complain to your local data-protection authority.

7. Deleting your data

Deleting a book in Marcus removes it from your library on every signed-in device and deletes its stored file from our cloud storage. Delete your account in the app’s settings (or email us) and your cloud data — including every book file we hold — is removed. Deleting the app removes all local data from your device. Unsubscribing from the launch list removes you from future emails.

8. Security

Data is encrypted in transit (TLS). Credentials are stored using your device’s secure storage, API keys are scoped and kept server-side only, and access to production systems is restricted. No system is perfectly secure, but we design for the least data necessary — reading works entirely offline.

9. Children

Marcus is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We will update this policy as Marcus evolves and change the date at the top. For material changes, we will notify you in the app or by email.

11. Contact

Privacy questions or requests: marcus@vuvee.me.