Privacy Policy

1. What we collect

• Your account: your email address, the name you show to others, whether you are staff, who invited you, and when you accepted the terms.
• Connections and invitations: who you are connected with (people you share a group with, or invited to Diplet, or who invited you), which you can see and remove on the People page, and invitations to groups that wait for an answer. Members can invite anyone by email address; we send that address one invitation email and nothing else, and keep it with the invitation.
• The waitlist: if you ask for an invitation, your email address and what you wrote about yourself. Staff read it to decide; a request is deleted when you are added, and one that was turned down is deleted after about three months.
• What you add: readings (PDFs, EPUB books, saved web pages and pasted text), comments, voice notes and their transcripts, reactions, bookmarks, and who you @mention; in your reading room also the labels you give its readings. If you block someone, we keep that you did, to apply it. The person you blocked isn't told, and you can lift the block on the People page.
• How you use the app: which comments you've marked as read, where you are in each reading, read-aloud listening sessions, questions you ask the AI assistant, and, if you turn on calendar feeds, the secret that makes up their addresses. For each request to OpenAI that you cause (a read-aloud paragraph, a voice note's transcription, a question to the AI) we record its size, its estimated cost and the group it was in, so admins can see what the service spends. We also keep your plan and any features staff gave you, and count what you use each month (AI questions, transcribed voice-note minutes, storage), to apply the limits of your plan; staff see these counts, never your content.
• Technical information: your sign-in sessions with the IP address and browser they came from, and the request logs our hosting provider keeps. When the app fails in your browser, or loads slowly, it sends a short report with the kind of page it was (“a reading”, not which one), the kind of error, timings, your browser and device, and your account's number, never what you wrote or read and never your name or email address.
• On your device: a cookie that keeps you signed in, and your preferences (theme, focus mode, comment order, read-aloud speed, reading positions) in your browser's storage. The installed app also keeps an offline page. Readings you choose to save for offline use (the text or PDF, the comments you can see in it, your bookmarks and your place), and anything you write there without a connection, are stored on your device until you remove them, sign out, or lose access to the reading, when the app deletes the copy the next time it starts with a connection. There are no advertising, analytics or tracking cookies.
• Notifications on your device: only if you turn them on in Settings. For each device we keep the address your browser's push service gave it, the keys that encrypt messages to it, the browser's name, and when it last received one.
• The browser extension: only if you install it. It reads a web page, its selected text or a PDF only when you ask it to clip it (or start a comment on a passage), and sends what it read to Diplet, where it becomes a reading of yours like any other (see “What you add”). When you open it over a page, it sends that page's address to Diplet, and only to Diplet, to show whether the page is already there (it never sees the addresses of pages you merely visit); we use it to answer that question and don't keep it. It sends nothing to anyone else, has no analytics, and reads no other tab and no history. On your device it keeps nothing but your name (to show who is signed in) and the last place you clipped to; it uses your browser's sign-in to Diplet and never sees your email address or a password.

2. How we use it

We use this information to run the service: to sign you in, show your content to your group, send sign-in links, comment digests and notifications, transcribe voice notes, read texts aloud, answer questions put to the AI assistant, handle copyright notices, and keep the service secure and free of abuse. We don't sell personal information or use it for advertising.

3. Who can see it

• A group's readings and comments can be seen by its members, and by nobody else. The people who run the service (staff) have no way into a group: they cannot read its readings, discussions or members. Private threads can only be seen by their members. Bookmarks and reading positions are only visible to you. There are two exceptions. A report: if a member reports a comment, a reading or a person, staff see that, with enough of what surrounds it to judge it, and decide what to do. And an appeal: if the check against the code of conduct refused something you wrote and you ask staff to look again, they see what you send them, your words, the passage you quoted, the rule and your note, and nothing else of the group.
• Your reading room, its readings and labels and what you write there are only visible to you, staff included; staff can only find a room reading's title and link, to handle a copyright notice. When you add a reading from your room to a group, its copy and the comments you chose to bring along are seen like the group's other readings.
• Staff can see the names and email addresses of the people in the app, to manage invitations and help with accounts. What staff do is written to a log that the admins can read.
• When you report a comment, a reading or a person, our staff see your report (your name, the reason and your note) and only the reported item with what they need to judge it: for a comment, the thread it is in (a private thread too) and the names of those who wrote in it; for a reading, its title, link, details and the start of its text, but never the file; for a person, their name and their reported comments. Nothing else from the group is opened, and each time staff look at a report it is recorded in a log. The person you reported isn't told who reported them. We email you when your report has been handled, saying only whether we took action.

4. Service providers

We use these providers to run the service. They process information for us, under their own terms:

• OpenAI, for voice-note transcripts, read aloud, the AI assistant and checking what is posted against the code of conduct. Voice notes, the text being read aloud, and the reading and discussion the AI is asked about are sent to OpenAI. So are the comments you write (with the thread they answer, as you can see it), voice-note transcripts, the titles of readings you add to a group and the start of their text, group names, house rules and the notes of reports, to check them against the code. What is in your own reading room, which you share with nobody, is not sent for this until you bring it into a group. The AI assistant can search the web, so searches based on a question go out through OpenAI. Under OpenAI's API policies, this data isn't used to train its models by default.
• Your browser's push service (run by Google, Apple, Mozilla or Microsoft, depending on your browser), if you turn on notifications. It relays short messages such as “Ben mentioned you in Chapter 1”, which name a person and a reading or meeting, never what a comment says.
• Amazon Web Services, to run the service, store its database and files, and send email, in the United States. It also protects the service: a firewall blocks requests from addresses known for abuse or that send far too many requests, and a threat-detection service watches our account and the software we run for signs of attack and known flaws. They see network addresses and technical details of requests, never what you write or read.
• Grafana Labs (Grafana Cloud), for operational telemetry: how the service performs and where it fails. It receives ids, timings, error types and page names from our servers and from the app in your browser, which includes the IP address a request comes from, and the results of the checks that test from outside whether the service is up. It never receives content: no comments, titles, search words, addresses of readings or email addresses. It keeps this for about two weeks.

We also share information when the law requires it. If you send a counter-notice about a copyright removal, we forward it, with your contact details, to the person who sent the notice, as the law requires.

5. How long we keep it

• Your account information, for as long as you have an account.
• Readings and comments, until someone allowed to delete them does, or the group is deleted.
• Read-aloud audio, until nobody has listened to it for 30 days.
• A comment that the check against the code of conduct refused, so you can rework it: until you dismiss it, and for 30 days at most. Only you can see it, unless you ask staff to look at it again: then it is kept until 30 days after they decided, like anything else of yours the check refused that you ask them to review. The check also keeps counts of what it found (the kind of item and the rule, never any text or name), which show admins how often a rule applies, and counts of whether people found its reminders helpful and what staff decided about appeals. If you tell us a reminder doesn't fit, a note you write, and your words if you choose to share them, are kept for the admins without your name, until they have read it and for 90 days at most.
• Records of requests the firewall blocked (the IP address, the time and the rule, without the page address or cookies): 14 days. Security findings about our account and software: 90 days.
• Records of OpenAI usage (size and estimated cost, not the content), for as long as the service runs, to compare spending over time. They no longer say who you are once you delete your account.
• Records of copyright removals, including who added the removed reading, for as long as we need them to handle repeat infringement.
• Reports and what staff decided about them, so that repeated breaches of the rules of conduct can be recognized; staff log entries stay as long as the service runs.
• Deleted information may remain in our providers' backups for a limited time.

6. Your choices and rights

• You can change your name, turn off email digests and push notifications (all at once, or per device), and delete your comments, voice notes and bookmarks at any time.
• You can delete your account in Settings, or on its own page. That deletes your login, email address, voice notes, reactions, bookmarks, reading positions, calendar feed addresses, notification settings, group memberships, the people you blocked and your reading room with everything in it. Your comments stay in their discussions so they still make sense, shown as “Deleted user” (a voice note's transcript stays as its comment's text). Delete any comments you don't want kept before you go.
• You can download a copy of your data at any time from Settings (“Download my data”): a ZIP file with your profile, your comments with the readings and passages they were about, your voice notes and their transcripts, your reactions, bookmarks and reading positions, in a format other programs can read. It doesn't include other people's comments. A group's owners can likewise download the group's discussions and the list of its readings (but not the readings themselves), including your comments in them; private threads are only included for owners who are part of them.
• Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, or to object to how we use it. You can use several of these rights yourself in the app, as described above; contact us for the rest. We won't treat you differently for using them.
• If you're in the European Union or the United Kingdom: we process your information to provide the service you signed up for, and for our legitimate interests in keeping it secure and handling copyright notices. Your information is stored in the United States. You can complain to your data protection authority.

7. Children

The service isn't meant for children under 13, and we don't knowingly collect their information. If we learn that we have, we delete it.

8. Security

Connections are encrypted, you sign in with emailed links (a password is optional, and we keep only a salted hash of it, never the password), and every page and request checks that you're allowed to see what you ask for. You can also add an authenticator app to your password: its secret is stored encrypted on our servers and never shown again after you set it up, and your backup codes are stored encrypted too. No system is perfectly secure, though, so we can't guarantee that information will never be accessed without permission.

9. Changes

We may update this policy. The date at the top shows when it last changed, and we'll tell you about significant changes in the app or by email.

10. Contact

Questions about your information, and requests to use your rights, go to our contact address.