Privacy Policy

Last updated: September 23, 2026

Ember Serials ("we", "us") runs this website, a free place to read web serials. This policy explains what personal information we handle, why, how long we keep it and what you can do about it. The short version: you can read everything without an account; if you create one, we keep only what the account features need; we do not sell data; and we run no advertising or tracking cookies.

Who is responsible

The site is operated by the imprint Ember Serials, based in Vietnam. We are the controller of the personal data described here. You can reach us at [email protected].

What we collect, by feature

Everyone who visits

• Server logs. Our server records each request: the page requested, the time, the response status and size, and a shortened IP address (the last part is removed before it is written, for example 203.0.113.0). We use these logs to keep the site running, fix errors and stop abuse. They are not shared and are deleted automatically as the server's system log rotates.
• Chapter view counts. Each chapter page loads a tiny image that adds one to that chapter's view counter and to a per-day total for that chapter. We store only those totals, not who read the chapter or from where. Obvious bots are not counted.
• Settings in your browser. Some choices are saved in your own browser's local storage (see below). They stay on your device and are not sent to us.

If you create a reader account (optional)

• Account details: your email address, the username you choose, and your password. We never store the password itself, only a one-way argon2id hash of it. We also record when the account was created, when you last signed in and whether you have confirmed your email address.
• Email confirmation and password reset: when you register or ask for a password reset we create a one-time link for your email address, which is sent to you by email when email delivery is enabled. We store only a hash of the link's secret, not the link. Confirmation links expire after 48 hours and reset links after 1 hour.
• Sessions: when you sign in we store a hash of your session token (never the token itself), its expiry date, a shortened IP address (the network part only: /24 for IPv4, /48 for IPv6) and your browser's user-agent string, so that sessions can be recognised and misuse detected.
• Sign-in and sign-up protection: to stop password guessing and mass sign-ups we briefly record attempts keyed by the email address or username tried and by shortened IP address. Records older than two hours are deleted automatically at the next clean-up, which runs whenever a new attempt is recorded.
• Your library: the stories you follow, favourite or save to read later, the pen names you follow, and your reading progress (the last chapter you opened in each story).
• Community activity: your ratings (five scores per story), reviews, chapter comments and replies, comment upvotes and reports you file. We also keep a short log of when you posted, to enforce posting limits; entries older than 48 hours are deleted the next time you post, and all of them when you delete your account.

If you write to us

We keep your message and email address to reply, and to keep a record of copyright notices and privacy requests.

We do not ask for your real name, address, phone number or date of birth, and we do not collect payment information.

What is public

If you post, other visitors can see your username, the text of your reviews and comments, and the date they were posted. Upvote counts are shown as totals. Ratings on their own are not shown individually: a story's scores appear only once at least 5 readers have rated it, and only as averages. If you also write a review of a story, the overall score you gave it is shown next to your review. Your email address, library, reading progress and reports are private.

Why we use it (legal bases)

• To provide the account you asked for (performance of a contract): your account details, sessions, library, reading progress and the posts you choose to publish.
• Legitimate interests in running a secure, fair community: server logs, sign-in protection, posting limits, and moderation (holding posts from new accounts for review, handling reports, hiding content and disabling accounts that break our Terms).
• Replying to you when you contact us, and legal obligations where the law requires us to keep or disclose information.

We do not use your data for advertising, profiling or automated decisions with legal effect, and we do not sell, rent or trade it.

Moderation

Comments and reviews from accounts less than 24 hours old are held for review before they appear. Our moderators can see reported and held posts together with the posting account's username, and can hide posts or disable accounts. Moderation is done by people; there is no automated profiling.

Cookies

We use only strictly necessary cookies. None of them are used for analytics, advertising or tracking, so we do not show a consent banner. Visitors who just read get no cookie from us; the rs_csrf security cookie is set only when you open a sign-in, registration or account form, or start a report, and the other two only when you sign in.

Cloudflare, which delivers the site, may set its own strictly necessary security cookies to block attacks. The private admin area uses its own strictly necessary cookies, which are not set for readers.

Local storage in your browser

These settings are saved only on your device and never sent to us: theme (day, night or sepia), text size, reader preferences (font and page width) and the sort order you chose for comments. You can clear them at any time in your browser settings.

Service providers

We rely on a small number of providers. They process data only to provide their service to us:

• Cloudflare delivers the site as a content delivery network and security layer. It sees your IP address and request details to deliver pages and block attacks. Backup copies of our database, which now include account data, are also stored with Cloudflare R2 object storage. See Cloudflare's privacy policy.
• Google Fonts serves the typefaces used on the site, so your browser requests font files from Google, which sees your IP address. See Google's privacy policy.
• If email delivery is enabled, the messages with confirmation and reset links are passed to an email delivery service to send them.

We share personal data with nobody else, unless the law requires it.

How long we keep it

• Account data, library, ratings, reviews and comments: until you delete your account (or we delete it for breaking the Terms).
• Sessions: a session stops working 30 days after your last visit, and is deleted when you sign out, change your password (other devices) or delete your account. Expired session records are deleted automatically within an hour.
• Confirmation and reset links: valid for 48 hours and 1 hour; the stored hashes are deleted automatically within an hour after they are used or expire, or with your account.
• Sign-in attempt records: two hours, then deleted automatically within the next hour. Posting-limit log: 48 hours, then deleted automatically within the next hour (or with your account).
• Reports: kept for moderation records. If you delete your account, your reports stay but are no longer linked to you.
• Server logs: deleted automatically as the system log rotates.
• Backups: when you delete your account it is removed from the live database immediately; older backup copies that still contain it are overwritten as backups rotate, and are never used to restore a deleted account except to recover from a disaster.

Security

The site is served only over HTTPS. Passwords are hashed with argon2id; session tokens and email-link secrets are stored only as hashes; stored IP addresses are shortened. Sign-in and posting are rate limited, and changing your password signs out your other devices. No system is perfectly secure, so please use a unique password.

Your rights and how to use them

Depending on where you live (for example under the EU GDPR, the UK GDPR, the California CCPA/CPRA, or Vietnam's Decree 13/2023/ND-CP on personal data protection), you may have the right to know what personal data we hold about you and get a copy, to have it corrected or deleted, to restrict or object to its use, to take it elsewhere (portability), and to withdraw consent where we rely on it. We do not sell or share personal data for cross-context behavioural advertising, and we will not treat you differently for using your rights.

• Delete your account yourself on your Account page. This immediately erases your account and everything linked to it: sessions, library, reading progress, followed pen names, ratings, reviews, comments (replies other readers wrote to them stay, shown as ordinary comments), upvotes and posting records.
• Change your password on the same page. You can remove library items, ratings, reviews and comments one by one at any time.
• For anything else (a copy of your data, a correction, an objection, or help if you cannot sign in), write to [email protected] from the email address on the account. We may ask you to confirm the request comes from you, and we reply within one month.

You can also complain to your local data protection authority.

Children

The site is for readers aged 13 and over, and accounts are only for people aged 13 or older. If you live in the EEA or UK and are under 16 (or the age of digital consent in your country), please ask a parent or guardian before creating an account. If we learn an account belongs to a child under 13 we will delete it; parents can write to us to ask for this.

International transfers

The site is operated from Vietnam and delivered worldwide through Cloudflare, and our providers may process data in other countries, including the United States. Where the law requires it, these transfers rely on the providers' standard contractual clauses or equivalent safeguards.

Changes

If we change this policy we will update this page and the date at the top. If a change materially affects how we use account data, we will say so on the site before it takes effect.

Contact

Questions or requests about privacy: [email protected].