Privacy Policy

Last updated: September 29, 2026

Stories Circle ("we", "us") runs this website, a free place to read web serials. This policy explains what personal information we handle, why, how long we keep it and what you can do about it. The short version: you can read everything without an account; if you create one, we keep only what the account features need; we do not sell data; and we run no advertising or tracking cookies (our visit statistics are cookie-free).

Who is responsible

The site is operated by the imprint Stories Circle, based in Vietnam. We are the controller of the personal data described here. You can reach us at [email protected].

What we collect, by feature

Everyone who visits

• Server logs. Our server records each request: the page requested, the time, the response status and size, and a shortened IP address (the last part is removed before it is written, for example 203.0.113.0). We use these logs to keep the site running, fix errors and stop abuse. They are not shared and are deleted automatically as the server's system log rotates.
• Chapter view counts. Each chapter page loads a tiny image that adds one to that chapter's view counter and to a per-day total for that chapter. We store only those totals, not who read the chapter or from where. Obvious bots are not counted. So that reloads are not counted twice, the server remembers in memory only, until the end of the day (UTC), which chapters have already been counted from a shortened network address (the first three parts of an IPv4 address, the first half of an IPv6 address), and each network counts only a limited number of views a day. This is never written to disk or to the logs.
• Visit statistics. We use Cloudflare Web Analytics to count page views and visits: which pages are read, the referring site, and the country, browser and device type. It uses no cookies and no local storage, does not fingerprint you and does not follow you across other websites; we only see totals.
• Google Analytics. We also use Google Analytics 4 to understand how readers find and use the site: pages viewed, time on page, how you arrived (referring site or search), and your approximate location (country and city), browser, device and screen size. Google Analytics sets its own cookies (see Cookies below) to recognise a returning browser, and Google receives your IP address; Google Analytics 4 does not log or store IP addresses. We see reports, not individual visitors, and we do not use it for advertising. You can block it with the Google Analytics opt-out browser add-on or any content blocker.
• Settings in your browser. Some choices are saved in your own browser's local storage (see below). They stay on your device and are not sent to us.

If you create a reader account (optional)

• Account details: your email address, the username you choose, and your password. We never store the password itself, only a one-way argon2id hash of it. We also record when the account was created, when you last signed in and whether you have confirmed your email address.
• Email confirmation and password reset: when you register or ask for a password reset we create a one-time link for your email address, which is sent to you by email when email delivery is enabled. We store only a hash of the link's secret, not the link. Confirmation links expire after 48 hours and reset links after 1 hour.
• Sessions: when you sign in we store a hash of your session token (never the token itself), its expiry date, a shortened IP address (the network part only: /24 for IPv4, /48 for IPv6) and your browser's user-agent string, so that sessions can be recognised and misuse detected.
• Sign-in and sign-up protection: to stop password guessing and mass sign-ups we briefly record attempts keyed by the email address or username tried and by shortened IP address. Records older than two hours are deleted automatically at the next clean-up, which runs whenever a new attempt is recorded.
• Your library: the stories you follow, favourite or save to read later, the pen names you follow, and your reading progress (the last chapter you opened in each story).
• Community activity: your ratings (five scores per story), reviews, chapter comments and replies, comment upvotes and reports you file. We also keep a short log of when you posted, to enforce posting limits; entries older than 48 hours are deleted the next time you post, and all of them when you delete your account.

If you open our writing site

One Stories Circle account is used for both storiescircle.com and our writing site, write.storiescircle.com; the writing site has no separate sign-up or password. When you choose to open the writing site from here, we pass your email address, username and account id to it in a short-lived signed link (valid for 60 seconds) so it can sign you in. We only do this for accounts with a confirmed email address. Purchases and your writing data are handled on write.storiescircle.com under the terms and privacy information shown there.

If you write to us

We keep your message and email address to reply, and to keep a record of copyright notices and privacy requests.

We do not ask for your real name, address, phone number or date of birth, and we do not collect payment information.

What is public

If you post, other visitors can see your username, the text of your reviews and comments, and the date they were posted. Upvote counts are shown as totals. Ratings on their own are not shown individually: a story's scores appear only once at least 5 readers have rated it, and only as averages. If you also write a review of a story, the overall score you gave it is shown next to your review. Your email address, library, reading progress and reports are private.

Why we use it (legal bases)

• To provide the account you asked for (performance of a contract): your account details, sessions, library, reading progress and the posts you choose to publish.
• Legitimate interests in running a secure, fair community: server logs, sign-in protection, posting limits, and moderation (holding posts from new accounts for review, handling reports, hiding content and disabling accounts that break our Terms).
• Replying to you when you contact us, and legal obligations where the law requires us to keep or disclose information.

We do not use your data for advertising, profiling or automated decisions with legal effect, and we do not sell, rent or trade it.

Moderation

Comments and reviews from accounts less than 24 hours old are held for review before they appear. Our moderators can see reported and held posts together with the posting account's username, and can hide posts or disable accounts. Moderation is done by people; there is no automated profiling.

Cookies

We use strictly necessary cookies, plus Google Analytics cookies to measure how the site is used. None of them are used for advertising. From us, visitors who just read get only the Google Analytics cookies; the rs_csrf security cookie is set only when you open a sign-in, registration or account form, or start a report, and the other two only when you sign in.

Cloudflare, which delivers the site, may set its own strictly necessary security cookies to block attacks. The private admin area uses its own strictly necessary cookies, which are not set for readers.

Local storage in your browser

These settings are saved only on your device and never sent to us: theme (day, night or sepia), text size, reader preferences (font and page width) and the sort order you chose for comments. You can clear them at any time in your browser settings.

Personal picks. To show "Continue reading" and stories picked for you (on the home page, on genre pages and in "Others also liked"), your browser remembers the chapters you read in each story and whether you reached the end of them, the story pages you looked at, the genre pages and tags you opened, your last few searches on this site, the genres you tapped, and the stories and tags you asked to see less of. This list stays on your device: the picks are worked out in your browser and the list is never sent to us if you are not signed in.

If you are signed in, the picks also use what your account already holds (reading history, Follows, Favorites, Read Later, the authors you follow and your ratings). Your choices on the picks (genres tapped, "Not interested", "Fewer") are saved to your account so they work on your other devices, and stories you read on this device before signing in are added to your account's reading history. Deleting your account deletes all of this.

You can clear this list or turn picks off at any time with the "Clear" and "Turn off" links under the picks on the home page.

How the picks perform. To learn whether the picks are useful, your browser tells us when a row of picks is shown, when you open a story from it and when you hide one: only the row, the story and its position. There is no cookie or identifier with these requests, and we keep only daily totals per story, not who sent them. Nothing is sent when personal picks are turned off.

Service providers

We rely on a small number of providers. They process data only to provide their service to us:

• Cloudflare delivers the site as a content delivery network and security layer. It sees your IP address and request details to deliver pages and block attacks, and it provides the cookie-free visit statistics described above (Cloudflare Web Analytics). Backup copies of our database, which now include account data, are also stored with Cloudflare R2 object storage. See Cloudflare's privacy policy.
• Google Analytics (Google LLC) measures visits as described above and receives your IP address and the cookie IDs. See Google's privacy policy and how Google uses data from sites that use its services.
• Google Fonts serves the typefaces used on the site, so your browser requests font files from Google, which sees your IP address. See Google's privacy policy.
• If email delivery is enabled, the messages with confirmation and reset links are passed to an email delivery service to send them.

Apart from the sign-in hand-off to our own writing site described above, we share personal data with nobody else, unless the law requires it.

How long we keep it

• Account data, library, ratings, reviews and comments: until you delete your account (or we delete it for breaking the Terms).
• Sessions: a session stops working 30 days after your last visit, and is deleted when you sign out, change your password (other devices) or delete your account. Expired session records are deleted automatically within an hour.
• Confirmation and reset links: valid for 48 hours and 1 hour; the stored hashes are deleted automatically within an hour after they are used or expire, or with your account.
• Sign-in attempt records: two hours, then deleted automatically within the next hour. Posting-limit log: 48 hours, then deleted automatically within the next hour (or with your account).
• Reports: kept for moderation records. If you delete your account, your reports stay but are no longer linked to you.
• Server logs: deleted automatically as the system log rotates.
• Backups: when you delete your account it is removed from the live database immediately; older backup copies that still contain it are overwritten as backups rotate, and are never used to restore a deleted account except to recover from a disaster.

Security

The site is served only over HTTPS. Passwords are hashed with argon2id; session tokens and email-link secrets are stored only as hashes; stored IP addresses are shortened. Sign-in and posting are rate limited, and changing your password signs out your other devices. No system is perfectly secure, so please use a unique password.

Your rights and how to use them

Depending on where you live (for example under the EU GDPR, the UK GDPR, the California CCPA/CPRA, or Vietnam's Decree 13/2023/ND-CP on personal data protection), you may have the right to know what personal data we hold about you and get a copy, to have it corrected or deleted, to restrict or object to its use, to take it elsewhere (portability), and to withdraw consent where we rely on it. We do not sell or share personal data for cross-context behavioural advertising, and we will not treat you differently for using your rights.

• Delete your account yourself on your Account page. This immediately erases your account and everything linked to it: sessions, library, reading progress, followed pen names, ratings, reviews, comments (replies other readers wrote to them stay, shown as ordinary comments), upvotes and posting records.
• Change your password on the same page. You can remove library items, ratings, reviews and comments one by one at any time.
• For anything else (a copy of your data, a correction, an objection, or help if you cannot sign in), write to [email protected] from the email address on the account. We may ask you to confirm the request comes from you, and we reply within one month.

You can also complain to your local data protection authority.

Children

The site is for readers aged 13 and over, and accounts are only for people aged 13 or older. If you live in the EEA or UK and are under 16 (or the age of digital consent in your country), please ask a parent or guardian before creating an account. If we learn an account belongs to a child under 13 we will delete it; parents can write to us to ask for this.

International transfers

The site is operated from Vietnam and delivered worldwide through Cloudflare, and our providers may process data in other countries, including the United States. Where the law requires it, these transfers rely on the providers' standard contractual clauses or equivalent safeguards.

Changes

If we change this policy we will update this page and the date at the top. If a change materially affects how we use account data, we will say so on the site before it takes effect.

Contact

Questions or requests about privacy: [email protected].