Effective: October 18, 2026
Optional reading measurement
Optional reading and discovery measurement is off until you allow it on this device. Reading, downloads, purchases and reading circle work without it. Change your choice in Optional reading measurement. Do Not Track and Global Privacy Control override an allowed choice.
When allowed, controlled events count page and book views, sample or reading starts, recommendations, download actions, sharing and retailer links. A successful file response can be counted by the server; it does not prove that every byte was saved. reading circle submission and confirmation counters require a separate measurement choice on the device making that request. Marketing consent alone does not enable these counters.
Ordinary journey records contain a random event identifier, a fixed event name, public book or page context and a timestamp. They do not contain an email address, account, reading text, search query, full query URL or raw referrer. Approved referral context is limited to accepted campaign, source, medium, content and asset codes. With optional measurement allowed, an audiobook checkout can retain approved campaign, source and medium codes alongside its order so a verified payment can be counted with that context. The browser reference expires after 30 minutes; the accepted order context follows the two-year measurement retention period. No campaign context is attached when consent is absent, Do Not Track is enabled or Global Privacy Control is enabled. An opted-out retry clears context from an unpaid checkout. Historical opted-in support checkouts may also retain approved referral context. Missing attribution remains unknown. A download may carry a random, single-action measurement nonce; it is not a visitor or access credential.
If an optional finder test is active, an allowed device stores a random token. The server uses an experiment-specific keyed hash to count an exposed device and its first selection once. The raw token is not stored in experiment records or joined to subscriber, order or payment records. One device is not necessarily one person. Declining measurement removes the device token; completed experiment unit records are scheduled for deletion once the completed experiment’s recorded end is more than thirty days old. Ordinary event records and daily aggregates follow the two-year deletion policy. No public analytics readback is available.
Necessary consent, delivery, security and transaction records are separate from optional journey measurement. Verified payments, refunds and subscription states can be counted for service and financial reconciliation without an optional measurement choice. They are not evidence that a reader clicked an advertisement or completed a book. Synthetic quality assurance records are separated from live reporting.
Reading and listening access
The complete Short Novel Collection is available at no charge every day, without an account, payment details, email verification or newsletter subscription. Read every chapter in your browser or keep the EPUB and PDF.
The complete Whitakers audiobook is a separate paid product when available. Its current availability is shown on the audiobook page. A contribution does not unlock a paid recording. When offered, an intentionally confirmed Reading Circle subscription earns separate private listening access to The Whitakers of Sullivan’s Island, without a paid order or an MP3 download entitlement. Existing valid customer access remains private through My Books.
Reading position and display preferences may be saved in this browser; clear site data to remove them. Saving a position does not create an account or a purchased library entitlement.
Purchases and your private library
For direct purchases, the reading system stores the delivery email in encrypted form, a keyed email lookup value, ordered editions and languages, payment references, amounts, currency, tax, refunds, delivery state and reading entitlements. Stripe processes payment and billing details when direct checkout is enabled. GoodNovels.org does not store complete payment card numbers. Brevo handles transactional receipts and reading links using the existing authenticated sending identity. Buying a book does not give marketing consent.
My Books uses a secure, essential session cookie lasting up to thirty days. Reading links expire after thirty minutes and can be used once. The checkout session proof expires after two hours. Reading position, chapter bookmarks and display preferences are stored privately so they can be restored. A basket and interface language may be stored on the device. Private reading and order pages are excluded from ordinary public page analytics.
Library and purchase records are retained to provide purchased access, address customer requests and meet applicable accounting requirements. Expired access credentials are removed during store maintenance. You can request access, correction or deletion by contacting hello@goodnovels.org. Required transaction records and minimal security evidence may need to be retained. Reading activity supports access and continuity; it is not sold as an advertising profile.
Gifts and reader reviews
Gift records distinguish the purchaser’s order from a recipient’s reading access. We retain claim state, a keyed verified recipient identity, and entitlement records. Unclaimed links are stored as a cryptographic hash and an encrypted recoverable value for purchaser management. The purchaser can see payment and claim status, but not recipient identity or reading activity. Private gift and review-management pages are excluded from public analytics.
Review records contain the contributor’s keyed verified email identity, original and current text, chosen public name, consent evidence, language and edition, acquisition evidence, disclosure, spoiler status, and moderation history. Only approved review text, chosen attribution, public acquisition label, disclosure, and publication information are displayed. Edits and withdrawal are available through Manage your reviews. Private consent and moderation records remain for service integrity and handling disputes; contact us about access, correction, or deletion.
Saved books
The optional guest shortlist uses goodnovels.saved-books.v1 in local storage. It contains stable public book identifiers only, with no email, payment details, access links, or paid text. It stays in this browser until removed or site data is cleared. It is not an account, a purchased library, or a cross-device service.
The reading circle
When signup is available, the reading circle receives your email address, optional first name, consent choice, signup page, offer identifier, subscription source and any supplied reading preferences. The address is encrypted in the private site database. A keyed value supports duplicate prevention, rate limiting, consent evidence and suppression. The authorized email provider, Brevo, processes the address for confirmation, welcome delivery and owner-released subscription messages. Newsletter sender and Reply-To are hello@goodnovels.org once that sending identity is verified; signup remains unavailable until the sender is ready.
A subscription becomes active only after an intentional confirmation action. For the Whitakers listening offer, one welcome message supplies a personal access code after confirmation. Earlier offers retain their original PDF and EPUB welcome. A listening code expires after thirty minutes and is used only by an intentional action on the access page. Returning readers may request another code without enrolling again. These new credential messages are sent as plain text with a token-free page address and separate code; earlier messages retain their original links. No historical customer list is automatically enrolled, and purchases or contributions do not reverse an unsubscribe. A voluntary resubscription requires fresh confirmation; a hard bounce or complaint remains suppressed.
Pending confirmation tokens expire after twenty four hours. Unconfirmed subscriber records are scheduled for deletion after seven days. Confirmed readers can change preferences, download their reading circle data, unsubscribe immediately, or delete the subscriber record through the private preference link. An unsubscribed subscriber profile without an active listening gift is scheduled for deletion after ninety days. A minimal subscriber identity and consent evidence remain while an earned listening gift is active, so marketing opt-out does not remove it. Choosing explicit deletion revokes the listening gift and removes the subscriber profile and saved preferences from the site database immediately, while encrypted provider deletion work remains available for a retry if needed. After either choice, a minimal keyed suppression value remains so the choice can be honored without retaining the email address in readable form. Pending reading circle email work is canceled and its encrypted message payload is cleared when you unsubscribe or delete the subscriber record.
Consent and delivery evidence may retain the keyed email value with controlled event, campaign, delivery status, and timestamp fields for no more than two years. A completed preference action has an encrypted replay record that expires after thirty days. For a data export, that encrypted replay record contains the generated export until it expires. Completed privacy request records are also scheduled for deletion after thirty days. Encrypted provider work remains in the restricted outbox until it succeeds or reaches its retry limit. Terminal outbox records are deleted after ninety days. When provider deletion succeeds, its encrypted email payload is cleared immediately.
Hosting and security
Private catalog and purchase backups are kept in restricted site storage. A scheduled service from cron-job.org calls the protected store maintenance endpoint to recover payment and delivery work and create backups. Its responses contain operational counts, not customer email addresses, payment details or book text. Render hosts the EPUB validation service used by the private publishing desk. It temporarily processes uploaded book files for format validation and deletes the temporary files after each check; customer purchase records are not sent to that service.
Hosting and security logs may process IP address, browser and device information, request metadata, timestamps, and security signals for delivery, abuse prevention, and incident response. The exact provider retention period has not been independently verified by GoodNovels.org.
Cloudflare, the site's security and content delivery provider, may set the strictly necessary __cf_bm bot management cookie. It expires after 30 minutes of inactivity and is not used by GoodNovels.org for advertising.
Cookies and local storage
The public site does not require an account and does not intentionally set advertising cookies. The edition selector stores your country, language, and locale choice in local storage undergoodnovels.preferences.v2. The Reading Room stores your voluntary light setting and text size undergoodnovels.reader.display. The opening sample uses goodnovels.opening.display and goodnovels.opening.position for local display and section preferences. Those preferences remain on your device until you remove them or clear site data. The Reading Room stores the names of completed progress milestones in locale specific session storage under goodnovels.sample.events.v3 with the approved campaign code so each milestone is sent no more than once for that campaign during the browser session. The session value is not a user identifier and is not transmitted as a value to the server.
Approved referral continuity uses goodnovels.analytics.attribution.v2. It contains only accepted campaign, source, medium, content, and asset codes and disappears when the browser session ends. It does not contain your name, email address, message, account, full page address, query string, raw referrer, or a generated visitor identifier. Synthetic quality assurance records can be created only by protected server workflows and are excluded from owner commerce reporting.
External destinations
Amazon, Cash App, your mail application, and a destination selected through your device's native sharing feature have their own privacy practices. Choosing one of those actions leaves GoodNovels.org or opens another application under that provider's terms.
Contact forms and email inquiries
Email links open your mail application and address the Microsoft 365 mailbox provided through GoDaddy for hello@goodnovels.org. When the website contact form is available, it receives your name, email address, selected subject and message to deliver a fixed-recipient inquiry to that same inbox. Your address is used as the reply address, not as a forged sender identity. An inquiry does not subscribe you to marketing.
The contact-delivery queue encrypts the message payload and uses identifiers and digests for abuse prevention and delivery status. The queued payload is cleared after provider acceptance. Unsent or review-held payloads expire and are cleared after thirty days when processing runs; provider identifiers and delivery status may remain for service administration. Provider acceptance does not by itself prove inbox receipt. No formal mailbox retention schedule is published, so include only information needed for the inquiry. Do not send passwords, payment-card details or private access links.
Contribution records
When direct contributions are enabled, payment and acknowledgment records are kept separately from audiobook entitlements and newsletter consent. They include the selected amount and currency, processor references, status and necessary receipt details. Payment providers collect card or donor-bank information in their own secure flow. A click to an external giving service is not treated as a confirmed contribution or proof of bank settlement.
The contribution form keeps your amount choice and any saved checkout reference in session storage under gn-donation-choice-v2. If session storage is unavailable, this choice lasts only while the page remains open. A secure return-proof cookie lasts up to twenty four hours. These values support checkout recovery and do not contain card details or grant book access.
The acknowledgment queue encrypts necessary receipt details and the recipient address. Its payload is cleared after provider acceptance; unsent or review-held payloads are canceled and cleared after thirty days when processing runs. Minimal references and delivery status remain for service administration. A provider-accepted acknowledgment is not proof of inbox receipt.
Your requests
You may ask about access, correction, or deletion of information you sent by email. A confirmed reading circle reader can also use the private preference link for access and deletion. Requests are handled subject to applicable law and provider retention requirements. GoodNovels.org does not intentionally sell personal data or use advertising identifiers on this site.
Contact
Questions may be sent to hello@goodnovels.org.
See also the cookie notice and consent notice.