Privacy Policy
Last updated: 4 June 2026
This policy explains exactly what data Reads touches, what it stores, and what it does not. Reads is a personal project and deliberately collects as little as possible.
1. The short version
- We never store your Hacker News password. It is forwarded to Hacker News to log you in, then discarded.
- We store your Hacker News session cookie, encrypted, so the app can post on your behalf.
- We store your Hacker News username to show who you are signed in as.
- Your bookmarks live only in your own browser — they never reach our server.
- No analytics, no ad trackers, no selling of data.
2. What we collect and why
| Data | Stored? | Where | Why |
|---|---|---|---|
| HN password | No | In memory only, momentarily | Forwarded to Hacker News to log you in, then cleared. Never written to disk or logs. |
| HN session cookie | Yes — encrypted (AES-256-GCM) | A file on our server | Lets Reads act as you on Hacker News (e.g. submit a post) without re-asking your password. |
| HN username | Yes | Same file | To display your account and link to your HN profile. |
| Reads session ID | Yes | An httpOnly cookie in your browser + our server | Keeps you signed in for up to 30 days. Random value, holds no personal data. |
| IP address | Briefly, in memory | Server RAM only | Rate-limits login attempts to prevent abuse. Not written to disk; cleared on restart. |
| Bookmarks | No (client-side) | Your browser’s localStorage | Saved stories stay on your device and are never sent to us. |
3. About the stored session cookie
This is the most important thing to understand. When you sign in, Hacker News returns a session cookie. Reads encrypts it and stores it so it can submit posts as you. While stored, this cookie can be used to act on your Hacker News account. We protect it by encrypting it at rest and restricting access to the file, but no system is perfectly secure — if our server were compromised, a stored session could be misused. We disclose this plainly so you can make an informed choice. If you are not comfortable with this, do not sign in; you can still read everything without an account.
4. Retention & deletion
- Signing out immediately deletes your Reads session from our server.
- Your stored Hacker News cookie is removed when you sign out or when the session is invalidated.
- To revoke any cookie we may still hold, change your Hacker News password — that invalidates it on HN’s side.
- Bookmarks are cleared by clearing your browser’s site data.
5. Sharing
We do not sell, rent, or share your data with third parties. The only external service Reads talks to on your behalf is Hacker News itself (news.ycombinator.com), to read content and to post as you. Hacker News’ own handling of your account is governed by their policies, not ours.
6. Cookies
Reads sets a single httpOnly session cookie (mhn_sid) when you sign in, to keep you logged in. It contains a random identifier only. We use no advertising or analytics cookies.
7. Security
Login happens over HTTPS. Passwords are never persisted. Session cookies are encrypted at rest with AES-256-GCM and login attempts are rate-limited. This is a personal project, though, and we cannot guarantee absolute security. See section 3.
8. Children
The Service is not directed to children under 13, and we do not knowingly collect their data.
9. Changes
We may update this policy; the “Last updated” date reflects the current version. Material changes will be reflected here.
10. Contact
Questions or a deletion request? Email [email protected].
See also the Terms of Service.