Privacy policy

Who is responsible

The controller under the GDPR is:

[Your full name]
[Street and number]
[Postal code and city]
Germany
Email: [contact@your-domain]

What Afterthought stores, and why

• Your account: your email address, used to sign you in (magic links) and to deliver your issues.
• Your Kindle highlights: book titles, authors, Amazon book IDs (ASIN), highlighted passages, your notes, colour, location and page — sent by the Afterthought extension when it syncs. Used only to write your issues and show your library to you.
• Your settings and history: schedule, time zone, preferences, which highlights were sent in which issue, and delivery status, so no highlight is sent twice.
• Technical logs: request logs with status codes and error types, kept briefly for security and debugging. They contain no highlight text.

Legal basis: providing the service you signed up for (Art. 6(1)(b) GDPR); security logs on our legitimate interest in running a safe service (Art. 6(1)(f) GDPR).

The Chrome extension

The extension syncs when you press Sync and, unless you switch this off in the extension, once a day while Chrome is open. Each time, it opens your Kindle notebook page at Amazon in a background tab of your own browser, reads your highlights and notes there, and sends those to your Afterthought account. If Amazon asks you to sign in, an automatic sync stops and the extension's icon shows a hint; it never signs in for you. It never reads or transmits your Amazon password or cookies, and it does not read any other website. It stores a personal access key, your chosen Amazon store and the time of the last sync locally in Chrome.

Service providers

Afterthought uses these processors, each bound by a data processing agreement:

• Supabase (database and sign-in) — data stored in the EU (Frankfurt).
• Vercel (hosting of the website and API) — requests are processed in the EU (Frankfurt) where possible.
• Loops (email delivery) — receives your email address and the content of each issue you are sent. Loops is based in the USA; transfers rely on the EU–US Data Privacy Framework and/or standard contractual clauses.

We do not sell your data, show ads, use analytics or tracking, or use your highlights to train AI models.

Cookies

Afterthought keeps your sign-in session in first-party cookies. They are strictly necessary to provide the service (§ 25(2) TDDDG), so no consent banner is needed. There are no tracking or advertising cookies.

How long data is kept

Until you delete your account in the dashboard (Account → Delete account), which removes your highlights, settings, issues and login immediately. Copies in provider backups expire within their regular backup cycles.

Your rights

You can access, correct, export (Account → Download my data) and delete your data, restrict or object to processing, and withdraw consent at any time. Write to [contact@your-domain]. You also have the right to complain to a data protection supervisory authority.